By the end of this module, you will be able to:
- Apply the concepts learned in Modules 1-9 to realistic audit scenarios.
- Analyze complex audit evidence to determine conformity or nonconformity.
- Test your readiness for the formal ISO/IEC 27001 Lead Auditor certification exam.
Scenario: You are conducting a Stage 2 audit of "TechCorp," a mid-sized software development company. The scope of their ISMS covers "the design, development, and support of the TechCorp HR Management SaaS platform."
During an interview with the Lead Developer, you ask about the environments used for testing new code. The developer states, "We usually test on our internal servers, but when we need to do heavy load testing, we spin up instances on a public cloud provider using a corporate credit card. It's much faster than waiting for IT to provision hardware."
You ask to see the risk assessment and the Statement of Applicability (SoA) regarding the use of this public cloud provider. The Information Security Manager looks surprised and says, "That cloud provider isn't in our SoA. We only use them temporarily for testing, so we didn't include them in the ISMS scope or the risk assessment."
You then ask the Lead Developer what kind of data is used during these load tests. The developer replies, "To get an accurate test, we usually take a snapshot of the live production database, which includes real customer HR data, and load it into the cloud instances."
Auditor Analysis: This is a critical situation involving multiple failures.
- Clause 4.3 (Scope): The organization defined the scope as the "design, development, and support" of the platform. Load testing is clearly part of development. By arbitrarily excluding the public cloud environment where development activities occur (especially using live data), the scope is inaccurate and misleading.
- Clause 6.1.2 (Risk Assessment): The organization failed to identify the risks associated with moving highly sensitive customer data to an unmanaged, unassessed public cloud environment.
- Clause 8.1 (Operational planning and control): The organization failed to control an outsourced process (the cloud hosting) that is relevant to the ISMS.
- Annex A 8.33 (Test information): This control specifically requires that test information be carefully selected, protected, and controlled. Using live, unanonymized customer PII in an unmanaged test environment is a severe violation of this control.
The Finding: This represents a Major Nonconformity. The ISMS is fundamentally failing to manage a significant risk within its stated scope, leading to the unauthorized exposure of highly sensitive customer data.
Example NCR (PLO Structure):
- Provision: ISO/IEC 27001:2022 Clause 6.1.2 requires the organization to identify information security risks within the scope of the ISMS. Furthermore, Annex A Control 8.33 requires test information to be carefully selected, protected, and controlled.
- Location: Development Department; Public Cloud Load Testing Environment.
- Objective Evidence: During an interview with the Lead Developer on [Date], it was confirmed that live production customer HR data is routinely copied to unmanaged public cloud instances for load testing. The Information Security Manager confirmed that this public cloud environment and the associated data transfer process have not been subjected to a risk assessment and are not covered by the ISMS controls.
Note: These questions are designed to simulate the style and difficulty of formal Lead Auditor exams. Try to answer them without referring back to the previous modules.
Question 1: During a Stage 1 audit, the auditor notes that the organization's Statement of Applicability (SoA) lists Annex A Control 5.22 (Monitoring, review and change management of supplier services) as "Implemented." However, the organization's Risk Treatment Plan shows that the project to implement a vendor risk management tool is only 50% complete and will not be finished for another three months. What is the most appropriate action for the auditor? A) Raise a Major Nonconformity during Stage 1 and cancel the Stage 2 audit. B) Note this as an area of concern in the Stage 1 report to be investigated thoroughly during Stage 2. C) Ignore it, as the SoA is just a planning document. D) Ask the organization to change the SoA to "Not Implemented" before Stage 2 begins.
Question 2: Which of the following is NOT a mandatory input to the Management Review (Clause 9.3)? A) The status of actions from previous management reviews. B) Feedback from interested parties. C) A detailed technical review of all firewall rule changes made in the last quarter. D) Results of risk assessments and status of the risk treatment plan.
Question 3: An auditor is reviewing the physical security of a data center (Annex A 7.1 to 7.4). The organization's policy states that "All visitors must be escorted at all times within the secure perimeter." While walking through the data center, the auditor observes an individual wearing a "Visitor" badge working alone on a server rack. The escorting employee is nowhere to be seen. When questioned, the visitor says, "My escort went to get a coffee 15 minutes ago." What should the auditor do? A) Immediately escort the visitor out of the building. B) Wait for the escort to return and reprimand them. C) Document the observation as objective evidence of a nonconformity against the organization's physical security policy and Annex A controls regarding securing offices, rooms, and facilities. D) Assume the visitor is trustworthy since they have a badge.
Question 4: An organization decides to accept a specific information security risk because the cost of implementing the necessary controls far exceeds the potential financial impact of the risk materializing. Which document MUST formally record the approval of this decision? A) The Information Security Policy. B) The Internal Audit Report. C) The Risk Treatment Plan (approved by the risk owners). D) The Scope Document.
Question 5: According to ISO 19011, which auditing principle ensures that the audit findings and conclusions are based on verifiable facts? A) Confidentiality B) Independence C) Fair Presentation D) Evidence-Based Approach
Answer 1: B. Stage 1 is a readiness review. Discrepancies between planning documents (SoA) and reality (RTP) are classic red flags that the auditor should note in the Stage 1 report and target for deep investigation during Stage 2 to determine if the control is actually effective.
Answer 2: C. Clause 9.3 lists specific high-level inputs. While top management needs to know about overall security performance, reviewing individual firewall rules is an operational task (Clause 8), not a strategic management review input.
Answer 3: C. The auditor's job is to collect objective evidence. The observation directly contradicts the established policy and the requirements for physical security perimeters. The auditor should document the facts (time, location, visitor statement) for the NCR.
Answer 4: C. Clause 6.1.3 (f) explicitly requires the organization to obtain risk owners' approval of the information security risk treatment plan and acceptance of the residual information security risks.
Answer 5: D. The Evidence-Based Approach is the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process.
[1] ISO/IEC. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection -- Information security management systems -- Requirements. https://www.iso.org/standard/82875.html [2] ISO. (2018). ISO 19011:2018 Guidelines for auditing management systems. https://www.iso.org/standard/70017.html