You are an experienced ISMS audit team leader. You are providing an introduction to ISO/IEC 27001:2022 to a class of Quality Management System Auditors who are seeking to retrain to enable them to carry out information security management system audits.
You ask them which of the following characteristics of information does an information security management system seek to preserve?
Which three answers should they provide?

• A.Clarity
• B.Accessibility
• C.Completeness
• D.Importance
• E.Availability
• F.Confidentiality
• G.Integrity
• H.Efficiency

Comment: *

Name: *

Email: *

Verification: *

Which option below is NOT a role of the audit team leader?

• A.Preventing and solving conflict during the audit
• B.Setting up an ethics committee
• C.Preparing and explaining the audit conclusions

Comment: *

Name: *

Email: *

Verification: *

In regard to generating an audit finding, select the words that best complete the following sentence.
To complete the sentence with the best word(s), click on the blank section you want to complete so that it Is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

Correct Answer:

Explanation
Audit evidence should be evaluated against the audit criteria in order to determine audit findings.
* Audit evidence is the information obtained by the auditors during the audit process that is used as a basis for forming an audit opinion or conclusion12. Audit evidence could include records, documents, statements, observations, interviews, or test results12.
* Audit criteria are the set of policies, procedures, standards, regulations, or requirements that are used as a reference against which audit evidence is compared12. Audit criteria could be derived from internal or external sources, such as ISO standards, industry best practices, or legal obligations12.
* Audit findings are the results of a process that evaluates audit evidence and compares it against audit criteria13. Audit findings can show that audit criteria are being met (conformity) or that they are not being met (nonconformity). They can also identify best practices or improvement opportunities13.
References :=
* ISO 19011:2022 Guidelines for auditing management systems
* ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements
* Components of Audit Findings - The Institute of Internal Auditors

Comment: *

Name: *

Email: *

Verification: *

The scope of an organization certified against ISO/IEC 27001 states that they provide editing and web hosting services. However, due to some changes in the organization, the technical support related to the web hosting services has been outsourced. Should a change in the scope be initiated in this case?

• A.Yes, because any change in the external environment initiates a change in the scope
• B.No, because the change does not require implementation of new security controls
• C.No, because the organization is already certified for its editing and web hosting services

Comment: *

Name: *

Email: *

Verification: *

An organisation is looking for management system initial certification. Please identify the sequence of the activities to be undertaken by the organisation.
To complete the sequence click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the options to the appropriate blank section.

Correct Answer:

Explanation
The correct sequence of activities is:
* Establish the management system
* Plan the audit programme
* Conduct internal audits
* Hold a Management Review
* Engage a Certification Body for stage 1 and stage 2 audits
* Complete any corrective actions
Comprehensive but Short Explanation: = According to the PECB Candidate Handbook - ISO/IEC 27001 Lead Auditor, the steps for achieving certification are as follows1:
* Establish the management system: This involves defining the scope, objectives, policies, procedures, and controls of the ISMS, as well as ensuring the availability of resources and top management commitment.
* Plan the audit programme: This involves defining the audit objectives, criteria, scope, frequency, methods, and responsibilities for conducting internal audits of the ISMS.
* Conduct internal audits: This involves verifying the conformity and effectiveness of the ISMS, as well as identifying any nonconformities or opportunities for improvement.
* Hold a Management Review: This involves reviewing the performance and suitability of the ISMS, as well as deciding on any changes or actions needed to improve it.
* Engage a Certification Body for stage 1 and stage 2 audits: This involves selecting a reputable and accredited certification body to conduct an external audit of the ISMS, consisting of two stages: a documentation review and an on-site assessment.
* Complete any corrective actions: This involves addressing any nonconformities or findings identified by the certification body, and providing evidence of their implementation and effectiveness.
References: = 1: PECB Candidate Handbook - ISO/IEC 27001 Lead Auditor, pages 25-26.

Comment: *

Name: *

Email: *

Verification: *