What is the main objective of stage 2 audit?

• To review the internal audit activities

• To evaluate the implementation of the ISMS

• To verify the information security objectives of the ISMS

Answer explanation

The purpose of stage 2 audit is to evaluate the implementation and effectiveness of the management system

Which of the following is a step in audit planning?

• Conducting risk assessment

• Determining the audit criteria

• Preparing the audit test plans

Answer explanation

The audit planning steps include: learning about the auditee’s mission, objectives, and processes, defining the audit objectives and audit scope, conducting a risk assessment, and developing the audit strategy

How does the audit team select processes and systems to be tested?

• Based on the technical experts’ advice

• Based on audit procedures

• Based on materiality

Answer explanation

Since not all of the elements of a management system can be validated, the processes and systems to be tested are selected based on their materiality.

During the audit, documented information involving proprietary information was protected at all times. Which principle of maintaining audit work documents has been followed?

• Confidentiality

• Authorship

• Conciseness

Answer explanation

All work documents during the audit that may contain confidential information of the auditee should be suitably safeguarded to preserve their confidentiality

A well-designed documentation standard improves the overall quality of the audit.

• True

• False

Answer explanation

A standardized documentation procedure can save a lot of time and improve the audit quality, particularly with regard to the audit report

What is the main purpose of the opening meeting in an audit?

• To obtain detailed information about management system-related processes

• To verify audit evidence and obtain a reasonable level of assurance

• To ensure that planned audit activities can be performed

Answer explanation

The purpose of the opening meeting is to ensure that all planned audit activities can be performed

The opening meeting agenda can include information on:

• The availability of the resources

• The examination of documented information

• The creation of audit test plans

Answer explanation

The opening meeting agenda includes an introduction of the audit team members, audit methods and procedures to be followed, and information on the availability of resources

The auditor has accessed logs to the server room. What source of information was collected?

• Documents

• Observations

• Records

Answer explanation

Records that auditors can collect include access logs to the server room, visitor logs, and information security event logs

How is audit evidence evaluated?

• By conducting quality review

• By comparing it against the audit criteria

• By utilizing audit tests

Answer explanation

Audit evidence is evaluated against the audit criteria in order to obtain audit findings

The quality review of audit evidence will assure that the audit findings are reliable and valid.

• True

• False

Answer explanation

The quality review of audit findings will assure that the audit conclusions are reliable and valid