Question 1 of 10 · Fundamental principles and concepts of an information security management system
What does 'conformity' mean in auditing terms?
Conformity is fulfilment of a requirement. It differs from legal compliance, auditor opinion and best practice.
Question 2 of 10 · Information security management system (ISMS)
How does an auditor test clause 9.1?
Auditors verify the organization determined and applied the clause 9.1 elements and retains results. Volume, positive trends or tools are not required.
Question 3 of 10 · Fundamental audit concepts and principles
What is an audit sampling risk?
Sampling risk is that conclusions from a sample differ from those that testing the whole population would give.
Question 4 of 10 · Preparation of an ISO/IEC 27001 audit
Why is the auditee's documented information reviewed before fieldwork?
Document review informs planning and the focus of fieldwork. It does not replace fieldwork, pre-decide outcomes or provide consultancy.
Question 5 of 10 · Conducting an ISO/IEC 27001 audit
When should an auditor raise an opportunity for improvement rather than a nonconformity?
OFIs are for areas that conform but could improve. They are not a compromise for disputes, weak evidence or convenience.
Question 6 of 10 · Closing an ISO/IEC 27001 audit
What does it mean if the audit team recommends certification with conditions?
Recommendations can depend on accepted corrective action plans for minors or verified corrections for majors.
Question 7 of 10 · Managing an ISO/IEC 27001 audit program
How are internal audit programs different from certification body programs?
Internal audit programs meet clause 9.2 and management needs; they do not certify.
Question 8 of 10 · Fundamental principles and concepts of an information security management system
Why must top management be committed to the ISMS?
Clause 5 requires leadership and commitment.
Question 9 of 10 · Information security management system (ISMS)
The policy lacks a commitment to continual improvement. How should the auditor classify this?
Clause 5.2 requires commitments to satisfy requirements and to continual improvement. A missing commitment is a nonconformity.
Question 10 of 10 · Fundamental audit concepts and principles
Which risk should be considered when using remote audit methods?
Remote methods affect evidence reliability and coverage, so their use is planned and risks addressed. They can produce findings and are permitted.
0 of 10
Fundamental principles and concepts of an information security management system
Information security management system (ISMS)
Fundamental audit concepts and principles
Preparation of an ISO/IEC 27001 audit
Conducting an ISO/IEC 27001 audit
Closing an ISO/IEC 27001 audit
Managing an ISO/IEC 27001 audit program
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.