Which of the following types of audit requires that the auditee and audit team agree on remote access protocols prior to conducting the audit?
Answer(s): A
A virtual audit typically requires the auditee and the audit team to agree on remote access protocols before the audit is conducted. Since the audit is performed remotely, both parties must ensure secure and efficient access to the necessary systems, documents, and data. This agreement helps facilitate the audit process while maintaining confidentiality and compliance with relevant security standards.
What is the purpose of audit test plans in the audit process?
Answer(s): B
The purpose of audit test plans is to guide the audit process by outlining the procedures and activities that will be used to gather evidence. This includes specific methods like observation, interviews, sampling, testing, and document reviews to assess the effectiveness and compliance of the management system with relevant standards. The test plans help auditors focus their efforts and ensure that the audit procedures are systematic, thorough, and aligned with the audit objectives.
The auditor used sampling to ensure that event logs recording information security events are maintained and regularly reviewed. Sampling was based on the audit objectives, whereas the sample selection process was based on the probability theory. What type of sampling was used?
Statistical sampling is a method where the sample selection process is based on probability theory, ensuring that each item in the population has a known, non-zero chance of being selected. In this case, the auditor used sampling based on probability theory to ensure event logs were maintained and reviewed, which is characteristic of statistical sampling. This method allows the auditor to draw conclusions about the entire population based on the sample selected.
Which option below is correct about the audit plan?
The audit plan is a document that outlines the audit's objectives, scope, methodology, and timeline. It should be flexible to allow for modifications during the audit process, as unforeseen circumstances or issues may arise that require adjustments. The plan is typically prepared by the audit team, not the auditee's top management, and while it may involve several audit procedures, the flexibility ensures that the audit remains effective in addressing key risks and concerns.
Which of the following can be considered as a minor nonconformity?
Answer(s): C
Minor nonconformities are typically less severe issues that do not significantly affect the overall system's ability to meet the required standards but still need to be addressed. In option C, the information security policy lacks reference to continual ISMS improvement, which is an important element under ISO/IEC 27001. While this is a shortcoming, it is considered a minor nonconformity since the policy addresses other essential elements like objectives and compliance requirements. The issue can be easily corrected without fundamentally affecting the effectiveness of the ISMS.
Post your Comments and Discuss PECB ISO-IEC-27001-Lead-Auditor exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the ISO-IEC-27001-Lead-Auditor content, but please register or login to continue.