Day#3 Lead Auditor

What is the main objective of stage 2 audit?

• To review the internal audit activities

• To evaluate the implementation of the ISMS

• To verify the information security objectives of the ISMS

Answer explanation

The purpose of stage 2 audit is to evaluate the implementation and effectiveness of the management system

Which of the following is a step in audit planning?

• Conducting risk assessment

• Determining the audit criteria

• Preparing the audit test plans

Answer explanation

The audit planning steps include: learning about the auditee’s mission, objectives, and processes, defining the audit objectives and audit scope, conducting a risk assessment, and developing the audit strategy

How does the audit team select processes and systems to be tested?

• Based on the technical experts’ advice

• Based on audit procedures

• Based on materiality

Answer explanation

Since not all of the elements of a management system can be validated, the processes and systems to be tested are selected based on their materiality.

During the audit, documented information involving proprietary information was protected at all times. Which principle of maintaining audit work documents has been followed?

• Confidentiality

• Authorship

• Conciseness

Answer explanation

All work documents during the audit that may contain confidential information of the auditee should be suitably safeguarded to preserve their confidentiality

What is the main purpose of the opening meeting in an audit?

• To obtain detailed information about management system-related processes

• To verify audit evidence and obtain a reasonable level of assurance

• To ensure that planned audit activities can be performed

Answer explanation

The purpose of the opening meeting is to ensure that all planned audit activities can be performed

The opening meeting agenda can include information on:

• The availability of the resources

• The examination of documented information

• The creation of audit test plans

Answer explanation

The opening meeting agenda includes an introduction of the audit team members, audit methods and procedures to be followed, and information on the availability of resources

The auditor has accessed logs to the server room. What source of information was collected?

• Documents

• Observations

• Records

Answer explanation

Records that auditors can collect include access logs to the server room, visitor logs, and information security event logs

How is audit evidence evaluated?

• By conducting quality review

• By comparing it against the audit criteria

• By utilizing audit tests

Answer explanation

Audit evidence is evaluated against the audit criteria in order to obtain audit findings

How often should audit team meetings be held?

• A meeting held in the morning and another at the end of the day

• A meeting per day held in the morning

• A meeting per day held in the evening

Answer explanation

The best practice is to schedule a meeting in the morning and another at the end of the day to review the progress of the audit and the issues faced by auditors.

What is the role of an observer?

• To assist the audit team

• To accompany the audit team

• To help the auditor with the audit procedures

Answer explanation

An observer is an individual who accompanies the audit team, provided that they received prior approval from the audit team leader.