NEW
Font size
WorksheetsDay#3 ISO 27001 Lead Auditor
Total questions: 28
Worksheet time: 14mins
The documentation of audit work should properly represent the planned examinations and their outcomes. Which principle does this statement describe?
Consistency
Accuracy
Completeness
Which of the following is a step in audit planning?
Incorporating the outputs of the stage 1 audit
Determining the audit criteria
Preparing the audit test plans
How does the audit team select processes and systems to be tested?
Based on the technical experts’ advice
By selecting a random sample of processes or systems
Based on their materiality
A leading audit firm has assigned a technical expert to provide advice to the audit team for the preparation and planning of an upcoming audit. The audit team is responsible for evaluating the financial statement and internal control of a major manufacturing company, therefore they recognize the need for specialized knowledge in the manufacturing industry to enhance the audit’s effectiveness. Is this acceptable?
Yes, technical experts can provide advice to the audit team for the preparation, planning, or audit
No, technical experts should not be included during the audit nor give advice to the audit team
Yes, technical experts can act as auditors in some cases and also provide advice to the audit team
The documented information for the audit must include audit visual information only.
True
False
What is the main purpose of the opening meeting?
To provide a short explanation of how the audit activities will be undertaken
To ensure that all planned audit activities can be performed
Both A and B
Which of the following is NOT included in the opening meeting agenda?
Information on the availability of resources
Information on audit findings feedback
Information on how to solve potential nonconformities
Which of the following examples are considered as records?
Information policy and employee manual
Employee databases and intranet
Internal audit report and management review meeting minutes
How is audit evidence evaluated?
By comparing it against the audit criteria
By conducting a quality review
By performing audit tests
The quality review of audit findings will ensure that the audit conclusions are reliable and valid.
True
False
How often should audit team meetings be held according to audit best practices?
A meeting in the morning and another at the end of the day
A meeting per day held in the morning
A meeting per day held in the evening
Why should an auditor consider cultural aspects at every stage of the audit?
To solve conflicts between employees of the auditee
To document conflictual situations
To avoid possible conflicts or misunderstandings
Which of the following is a characteristic of autocratic leaders?
They make all important decisions and closely supervise and control their employees
They delegate the decision-making authority to their employees and allow them to set goals and deadlines to complete the job
They provide guidance to their employees, consult them, and listen to their opinions, and then take decisions
What is the purpose of interviewing the auditee’s top management?
To validate the auditee’s top management commitment to the ISMS
To establish evidence of conformity to ISO/IEC 27001 related to management responsibilities
Both A and B
The auditor must communicate the situations observed during the audit, including those that could represent a potential risk, after completing the audit.
True
False
Which of the following statements describes the purpose of semi-structured interviews?
Interviews that begin by identifying key topics for discussion and then encourage a neutral, unstructured conversation to fold
Employing interviews that adhere to a predetermined structure
Interviews that enable interviewees to align their response with distinct themes predetermined by auditors and organized within an interview guide
Which of the following options is an evidence collection tool?
Interview
Technical verification
Observation
A manufacturing company is undergoing an ISO/IEC 27001 certification audit. During the audit, the auditee and the audit team disagree on the employees who should be interviewed as part of the audit process. The auditee wants to exclude senior manager, John, from interviews to avoid potential delays in the Marketing Department, whereas auditors insist on interviewing John because his perspective is vital for the audit. In response to the auditee's request, the auditors remind the auditee of audit principles and certification agreements, which require interviewing relevant individuals. Is this a good practice to follow?
No, auditors do not have a say in interviewee selection if the auditee expresses a preference for a specific individual
No, if the auditee insists that a particular individual should not be interviewed, auditors should consider their request and adapt the interviewee selection accordingly
Yes, auditors should maintain a polite approach, and it is the auditor’s responsibility to make the final decision on interviewee selection
During the stage 2 audit, an auditor observes the backup media being tested. What type of observation is the auditor conducting?
General observation
Unstructured observation
Detailed observation
The study of a population by studying representative samples is known as:
Synthesis
Scanning
Analysis
What is the definition of a sample in statistical analysis?
Each element of the population
Set of persons, objects, or elements selected from the population
Set of persons, objects, or elements on which the statistical analysis is based
Which of the following statements best describes evaluation in auditing?
A systematic search for all control-related elements to uncover potential deviations
The verification of information to get a reasonable level of assurance
The action of assessing the results of the previous procedures to ensure that the evidence is sufficient, relevant, and reliable
Which of the following steps is performed after determining the sampling method in a sampling process?
Determining the sampling size
Collecting the sampling
Defining the population
How can an auditor avoid disrupting the auditee’s operations?
By developing audit test plans using only observation
By conducting virtual audits
By grouping audit test plans
To verify conformity to clause 7.5.3 Control of documented information of ISO/IEC 27001, the audit team has validated the electronic structure for classifying and storing documented information. Which audit procedure did the auditor utilize?
Technical verification
Analysis
Documented information review
Which of the following can serve as audit evidence, among others, to verify conformity to clause 4.3 Determining the scope of the information security management system of ISO/IEC 27001?
Statement of applicability
Information security policy
Corrective actions
Which of the following can serve as audit evidence, among others, when verifying conformity to clause 10.2 Nonconformity and corrective action of ISO/IEC 27001?
Information security objectives
Preventive action results
Management review results
A combination of audit test plans should be used to verify conformity to the requirements of the standard.
True
False
