LEAD-AUDITOR Sample Questions & Answers

ISO 19011 outlines the typical contents of an audit plan, which includes objectives, scope, criteria, locations, dates, times, and team roles. However, it does not mandate that the specific, detailed list of documents and records to be sampled be included in the formal plan shared with the auditee. While the audit team will develop a sampling plan as part of its preparation, the final selection of evidence often happens dynamically during the audit itself. Providing an exhaustive list in advance could also allow the auditee to prepare only the requested items, potentially hiding systemic issues.

The closing meeting's purpose is to present the audit findings and conclusions. If a disagreement arises, the lead auditor should act professionally. This involves listening to the auditee's perspective to ensure no misunderstanding occurred, but then calmly and clearly presenting the objective evidence upon which the nonconformity is based. The final decision rests with the audit team. If the evidence is sound, the finding should be recorded. The auditee has a formal channel to appeal the finding later, but the closing meeting is not the venue for negotiation. The auditor must maintain the integrity of the audit process.

Clause 5.1 explicitly requires top management to demonstrate commitment by 'ensuring that the information security policy and information security objectives are established and are compatible with the strategic direction of the organization.' Aligning security objectives with strategic goals (like protecting research data to maintain reputation and funding) shows that security is seen as an enabler of business, not just a compliance cost. This integration is a far stronger demonstration of commitment than simply signing a policy or providing a one-time budget.

ISO/IEC 27001, Clause 6.1.2, requires the organization to define and apply an information security risk assessment process that establishes and maintains information security risk criteria. A key requirement is that the repeated application of the process produces 'consistent, valid and comparable results.' Without documented criteria for what constitutes 'Low,' 'Medium,' and 'High' risk, the assessment is subjective and cannot be reproduced consistently by different people or at different times. This is a clear nonconformity against the requirements of the standard.

The PDCA cycle maps to the ISO/IEC 27001 clauses as follows: Plan (Clauses 4, 5, 6, 7), Do (Clause 8), Check (Clause 9), and Act (Clause 10). Clause 9, 'Performance evaluation,' covers monitoring, measurement, analysis, evaluation, internal audit, and management review, which are all activities associated with the 'Check' phase of ensuring the ISMS is performing as intended.

A well-written nonconformity statement should contain three key parts: 1) The requirement that was not met (the policy). 2) The statement of nonconformity (rules were not reviewed). 3) The objective evidence that proves it. The current statement has the first two parts but lacks the specific evidence, such as 'Review of firewall change logs (e.g., log file XYZ from date A to date B) showed no entries for rule reviews' or 'Interview with network administrator John Doe on [Date] confirmed no review had taken place.' Without evidence, the finding is an unsubstantiated claim.

ISO/IEC 27001 Clause 9.3 specifies mandatory inputs and outputs for the management review. The scenario clearly indicates that required inputs (risk assessment results, interested party needs) were omitted and the assumption that they haven't changed is not a valid substitute for review. Furthermore, the required outputs (decisions on continual improvement and changes to the ISMS) were not documented. The failure to include mandatory inputs and document mandatory outputs demonstrates that the management review process is not effective and does not meet the requirements of the standard, constituting a major nonconformity.

According to ISO/IEC 27001 Clause 6.1.3 d), the Statement of Applicability must contain the necessary controls and a 'justification for their inclusion, whether they are implemented or not, and the justification for excluding any of the Annex A controls.' The justification for exclusion must be based on the risk assessment and treatment process. If the risk assessment identifies no risks that would require the implementation of a specific control, that provides a valid reason for its exclusion.

As per ISO 19011, preparing and distributing the audit report is a key step in the audit process. The lead auditor is responsible for the report's preparation and content. The report provides a complete, accurate, concise, and clear record of the audit and should include the findings, conclusions, and other relevant information.