Preparing an ISO/IEC 27001 Audit

Preparing an ISMS audit: initial contact and terms of engagement, audit feasibility, objectives, scope and criteria, ISMS scope versus audit scope, materiality, reasonable assurance and audit risk, audit team roles, and the audit plan.

5 minutes 5 Questions

In the ISO/IEC 27001 Lead Auditor framework, preparing an audit is the phase that sets up an effective, evidence-based, and risk-based assessment of an organization's Information Security Management System (ISMS). It follows the guidance of ISO 19011 and, for certification audits, ISO/IEC 17021-1 a…

Concepts covered
Audit ObjectivesAudit FeasibilityInherent, Control and Detection RiskCultural Aspects in an AuditRisk-Based Audit PlanningSteps and Activities to Prepare an ISMS AuditAudit Scope Versus ISMS ScopeMulti-Site Audits and Site SamplingReasonable AssuranceAudit CriteriaInitial Contact with the AuditeeMateriality in an ISMS AuditTerms of the Audit EngagementAudit Team Leader ResponsibilitiesAudit Team Members and Technical ExpertsAudit Plan PreparationAudit Team Selection and Audit Time
Test mode:
Start practice test

ISO 27001 LA - Preparing an ISO/IEC 27001 Audit Example Questions

Test your knowledge of Preparing an ISO/IEC 27001 Audit

Question 1

According to ISO 19011, which description best matches the auditor personal behaviour of being culturally sensitive?

Correct Answer: Being observant of and respectful toward the auditee's customs and values

ISO 19011 clause 7.2.2 lists culturally sensitive among the desired personal behaviours of an auditor and defines it as being observant of and respectful to the culture of the auditee, so recognising and respecting the auditee's customs and values is the correct description.
Adapting the audit criteria is wrong because the criteria are agreed in advance and must stay consistent. Changing them to suit local customs would undermine objectivity and the evidence-based approach.
Assigning team members who share the auditee's nationality is wrong because cultural sensitivity is a behaviour expected of every auditor. It is not a team selection rule based on shared background.
Key concept: auditor personal behaviour, specifically cultural sensitivity, under ISO 19011 clause 7.2.2.

Question 2

A healthcare services provider seeks certification of one centrally managed ISMS covering its head office and twelve clinics. During initial contact, the ISMS manager proposes that the stage 2 sample consist of four clinics chosen by the organization. Two other clinics are under refurbishment, and a third recently suffered a data breach. How should the audit team leader evaluate this proposal?

Correct Answer: Decline it, because the certification body selects the sample, combining random and risk-based choices, and the breached clinic is a likely candidate.

Under ISO/IEC 27006 and IAF MD 1, the certification body, not the auditee, determines the multi-site sample, typically combining random selection with risk-based choices. A clinic that recently suffered a data breach is a clear risk-based candidate for stage 2.
Accepting the organization's chosen sites undermines auditor independence and objectivity, and fixing the sample in the engagement terms does not transfer that responsibility. Deferring the breached clinic to surveillance ignores the very site most likely to reveal weaknesses in the effectiveness of the ISMS and its incident handling before certification is granted.
Key concept: Multi-site sampling is the certification body's responsibility, with risk-based and random site selection.

Question 3

An audit team leader is preparing a surveillance audit for a cloud hosting provider. A team member proposes cutting the planned audit time on the backup and restoration process. The reasons given are that the backup tool's licence is inexpensive and the previous audit raised no findings there. Customer contracts within the ISMS scope commit the provider to restoring data within agreed timeframes. How should the audit team leader evaluate this proposal?

Correct Answer: Reject it, because materiality reflects how backup failures would affect contractual availability obligations

The proposal should be rejected because materiality in an ISMS audit depends on the impact a control failure would have on information security objectives and obligations. Here, backup or restoration failures would directly breach contractual commitments to restore customer data within agreed timeframes.
Previous audits with no findings may reduce detection or control risk, but they do not lower the inherent risk of the backup process, which still supports critical availability commitments. Materiality is also not set by a predefined financial threshold. The low licence cost of the backup tool says nothing about the consequences of losing data.
Key concept: risk-based audit planning, where materiality is judged by impact on information security and contractual obligations, not by asset cost or past results.

More Preparing an ISO/IEC 27001 Audit questions
402 questions (total)
Practice 100 questions
One session at a time, always new questions