Question:
In a joint audit involving multiple audit teams, how many audit team leaders are typically designated per audit?

• A. One audit team leader per audit, regardless of the number of audit teams involved
• B. There are no designated audit team leaders in joint audits
• C. Each audit team appoints its own audit team leader

Question:
A cybersecurity company implemented an access control software that allows only authorized personnel to access sensitive files. Which type of control has the company implemented in this case?

• A. Corrective control
• B. Preventive control
• C. Detective control

Which one of the following options best describes the main purpose of a Stage 1 third-party audit?

• A. To check for legal compliance by the organisation
• B. To prepare an independent audit report
• C. To introduce the audit team to the client
• D. To determine redness for a stage 2 audit
• E. To learn about the organisation's procurement
• F. To get to know the organisation's customers

Scenario 6: Sinvestment is an insurance company that offers home, commercial, and life insurance. The company was founded in North Carolina, but have recently expanded in other locations, including Europe and Africa.
Sinvestment is committed to complying with laws and regulations applicable to their industry and preventing any information security incident. They have implemented an ISMS based on ISO/IEC 27001 and have applied for ISO/IEC 27001 certification.
Two auditors were assigned by the certification body to conduct the audit. After signing a confidentiality agreement with Sinvestment. they started the audit activities. First, they reviewed the documentation required by the standard, including the declaration of the ISMS scope, information security policies, and internal audits reports. The review process was not easy because, although Sinvestment stated that they had a documentation procedure in place, not all documents had the same format.
Then, the audit team conducted several interviews with Sinvestment's top management to understand their role in the ISMS implementation. All activities of the stage 1 audit were performed remotely, except the review of documented information, which took place on-site, as requested by Sinvestment.
During this stage, the auditors found out that there was no documentation related to information security training and awareness program. When asked, Sinvestment's representatives stated that the company has provided information security training sessions to all employees. Stage 1 audit gave the audit team a general understanding of Sinvestment's operations and ISMS.
The stage 2 audit was conducted three weeks after stage 1 audit. The audit team observed that the marketing department (which was not included in the audit scope) had no procedures in place to control employees' access rights. Since controlling employees' access rights is one of the ISO/IEC 27001 requirements and was included in the information security policy of the company, the issue was included in the audit report. In addition, during stage 2 audit, the audit team observed that Sinvestment did not record logs of user activities.
The procedures of the company stated that "Logs recording user activities should be retained and regularly reviewed," yet the company did not present any evidence of the implementation of such procedure.
During all audit activities, the auditors used observation, interviews, documented information review, analysis, and technical verification to collect information and evidence. All the audit findings during stages 1 and 2 were analyzed and the audit team decided to issue a positive recommendation for certification.
According to ISO/IEC 27001 requirements, does the company need to provide evidence of implementation of the procedure regarding logs recording user activities? Refer to scenario 6.

• A. No, the company only recommended implementing this procedure
• B. No, because the implementation of this procedure is not a requirement of the standard
• C. Yes, event logs recording user activities must be kept and regularly reviewed

You are an experienced ISMS audit team leader. During the conducting of a third-party surveillance audit, you decide to test your auditee's knowledge of ISO/IEC 27001's risk management requirements.
You ask her a series of questions to which the answer is either 'that is true' or 'that is false'. Which four of the following should she answer 'that is true'?

• A. Risk identification is used to determine the severity of an information security risk
• B. Risk assessments should be undertaken following significant changes
• C. The initial phase in an organisation's risk management process should be information security risk assessment
• D. The organisation must produce a risk treatment plan for every business risk identified
• E. ISO/IEC 27001 provides an outline approach for the management of risk
• F. The organisation must operate a risk treatment process to eliminate it's information security risks
• G. Risks assessments should be undertaken at monthly intervals
• H. The results of risk assessments must be maintained