Monitoring, Audit & Improvement

Which clause requires the organisation to determine what needs to be monitored and measured?

• AClause 9.3
• BClause 9.1✓
• CClause 9.2
• DClause 10.1

Answer: Clause 9.1 covers monitoring, measurement, analysis and evaluation, including what is monitored, by which methods, when, and who analyses the results. Clause 9.2 is internal audit and 9.3 management review.

What does Clause 9.1 require in addition to deciding what to monitor?

• AThat a dedicated monitoring team is appointed
• BThe methods to be used, so that results are valid and comparable✓
• CThat monitoring is automated wherever technically possible
• DThat results are published to interested parties

Answer: Clause 9.1 requires the methods for monitoring, measurement, analysis and evaluation to be determined so that the results are valid. Publication, automation and staffing structure are not requirements.

Which of these is the most fundamental requirement of an internal audit programme?

• AAudit findings must be reviewed and approved by the certification body before closure
• BEvery clause must be audited every month
• CAudits must be carried out by an external firm
• DAuditors must be objective and impartial with respect to what they audit✓

Answer: Clause 9.2 requires the selection of auditors and the conduct of audits to ensure objectivity and impartiality of the audit process, which is why auditors do not audit their own work. Frequency is risk-based and external firms are optional.

What must the internal audit programme take into account?

• AThe availability of trained audit staff, ahead of any other consideration
• BThe certification body’s three-year cycle, and nothing beyond that timetable
• CThe importance of the processes concerned and the results of previous audits✓
• DThe number of Annex A controls the organisation has chosen to implement

Answer: Clause 9.2.2 requires the audit programme to consider the importance of the processes concerned and the results of previous audits. It is a risk-based and evidence-based programme rather than a flat schedule.

An internal auditor is asked to audit the process they designed and operate. What is the problem?

• AIt breaches the requirement for objectivity and impartiality✓
• BIt is acceptable if the findings are countersigned
• CIt is acceptable because internal auditors know the process best
• DIt is only a problem during a certification audit

Answer: Clause 9.2 requires the audit process to be objective and impartial. Auditing your own work is the clearest failure of that, regardless of who countersigns the result.

Which of these must be an input to the management review?

• AA complete list of every documented procedure currently in force
• BThe certification body’s audit fee schedule for the coming cycle
• CThe results of risk assessment and the status of the risk treatment plan✓
• DThe organisation’s annual financial statements for the preceding year

Answer: Clause 9.3.2 lists required inputs including changes in issues and interested parties, feedback on information security performance, audit results, and the results of risk assessment and status of the risk treatment plan.

Which of these must be an output of the management review?

• AA report to the certification body summarising the review and its conclusions
• BWritten confirmation that no nonconformities were raised since the last review
• CA revised Statement of Applicability, produced after every review without exception
• DDecisions related to continual improvement opportunities and any need for change✓

Answer: Clause 9.3.3 requires the outputs to include decisions related to continual improvement opportunities and any need for changes to the ISMS. A revised SoA is only produced when the controls have actually changed.

Who must carry out the management review?

• AThe information security manager
• BThe certification body
• CThe internal audit function
• DTop management✓

Answer: Clause 9.3.1 requires top management to review the ISMS at planned intervals. It can be informed by others, but the review itself is a top-management responsibility that cannot be delegated away.

An organisation fixes a failed backup but does nothing about why it failed. What has it completed?

• ABoth a correction and a corrective action, since the failure was resolved
• BA corrective action, but not a correction
• CA correction, but not corrective action✓
• DNeither, because no nonconformity was formally recorded at the time

Answer: A correction eliminates the detected nonconformity itself. Corrective action goes further and eliminates the cause so it does not recur, which is what Clause 10.2 requires the organisation to evaluate the need for.

What does Clause 10.2 require when a nonconformity occurs?

• ASuspend the affected process until it can be considered at the next management review
• BReport it to the certification body within 30 days
• CReact to it, and evaluate whether action is needed to eliminate its causes✓
• DRaise a change request against the Statement of Applicability

Answer: Clause 10.2 requires the organisation to react to the nonconformity and deal with its consequences, then evaluate the need for action to eliminate its causes so that it does not recur elsewhere.

What documented information must be retained about nonconformities?

• AThe name of the individual whose action or omission caused it
• BThe date the nonconformity was closed, which is the minimum the standard requires
• CA copy of the Annex A control that the nonconformity relates to
• DThe nature of the nonconformity, actions taken, and the results of corrective action✓

Answer: Clause 10.2 requires documented information as evidence of the nature of the nonconformities and any subsequent actions taken, and of the results of any corrective action.

Which statement about continual improvement in ISO/IEC 27001:2022 is correct?

• AImprovement targets are set annually by the certification body at each surveillance audit
• BImprovement applies to the Annex A controls but not to the clause requirements
• CImprovement is required only in response to a recorded nonconformity
• DThe organisation must continually improve the suitability, adequacy and effectiveness of the ISMS✓

Answer: Clause 10.1 requires continual improvement of the suitability, adequacy and effectiveness of the ISMS. It is a standing obligation rather than a reaction to failure.

A metric is collected every month but nobody uses it to make a decision. What is the weakness?

• AIt fails the documented-information requirements of Clause 7.5
• BIt is not being analysed and evaluated, which is what Clause 9.1 requires✓
• CIt breaches the requirement for objectivity in Clause 9.2
• DThere is no weakness, provided the data is retained

Answer: Clause 9.1 requires the organisation to evaluate the information security performance and the effectiveness of the ISMS, not merely to collect data. Collection without analysis produces no evaluation.

How often must internal audits be conducted?

• AMonthly, so that every process is covered within the year
• BOnce per three-year certification cycle, ahead of recertification
• CAt planned intervals that the organisation determines for itself✓
• DAnnually, on a fixed date agreed with the certification body

Answer: Clause 9.2 requires internal audits at planned intervals, with the programme informed by the importance of the processes and previous results. The standard sets no fixed frequency.