PECB ISO-IEC-27001-Lead-Auditor Dumps Updated Jul 06, 2024 WIith 280 Questions
View All ISO-IEC-27001-Lead-Auditor Actual Free Exam Questions Jul 06, 2024 Updated
NEW QUESTION # 59
Scenario 5: Data Grid Inc. is a well-known company that delivers security services across the entire information technology infrastructure. It provides cybersecurity software, including endpoint security, firewalls, and antivirus software. For two decades, Data Grid Inc. has helped various companies secure their networks through advanced products and services. Having achieved reputation in the information and network security field, Data Grid Inc. decided to obtain the ISO/IEC 27001 certification to better secure its internal and customer assets and gain competitive advantage.
Data Grid Inc. appointed the audit team, who agreed on the terms of the audit mandate. In addition, Data Grid Inc. defined the audit scope, specified the audit criteria, and proposed to close the audit within five days. The audit team rejected Data Grid Inc.'s proposal to conduct the audit within five days, since the company has a large number of employees and complex processes. Data Grid Inc. insisted that they have planned to complete the audit within five days, so both parties agreed upon conducting the audit within the defined duration. The audit team followed a risk-based auditing approach.
To gain an overview of the main business processes and controls, the audit team accessed process descriptions and organizational charts. They were unable to perform a deeper analysis of the IT risks and controls because their access to the IT infrastructure and applications was restricted. However, the audit team stated that the risk that a significant defect could occur to Data Grid Inc.'s ISMS was low since most of the company's processes were automated. They therefore evaluated that the ISMS, as a whole, conforms to the standard requirements by asking the representatives of Data Grid Inc. the following questions:
*How are responsibilities for IT and IT controls defined and assigned?
*How does Data Grid Inc. assess whether the controls have achieved the desired results?
*What controls does Data Grid Inc. have in place to protect the operating environment and data from malicious software?
*Are firewall-related controls implemented?
Data Grid Inc.'s representatives provided sufficient and appropriate evidence to address all these questions.
The audit team leader drafted the audit conclusions and reported them to Data Grid Inc.'s top management.
Though Data Grid Inc. was recommended for certification by the auditors, misunderstandings were raised between Data Grid Inc. and the certification body in regards to audit objectives. Data Grid Inc. stated that even though the audit objectives included the identification of areas for potential improvement, the audit team did not provide such information.
Based on this scenario, answer the following question:
Based on scenario 5, the audit team disagreed with the proposed audit duration by Data Grid Inc. for the ISMS audit. How do you describe such a situation?
- A. Unacceptable, once the audit mandate is accepted, the audit duration cannot be changed
- B. Unacceptable, the audit duration is defined by the auditee and cannot be changed by the auditors
- C. Acceptable, auditors have the right to object, even refuse the audit mandate, if they deem that the audit duration is not sufficient
Answer: C
Explanation:
Auditors have the authority to object or even refuse an audit mandate if they believe that the audit duration proposed by the auditee is not sufficient to thoroughly assess the ISMS. It is crucial for the audit to be comprehensive enough to cover all necessary aspects of the system, ensuring its effectiveness and compliance.
References: ISO 19011:2018, Guidelines for auditing management systems
NEW QUESTION # 60
What is an example of a human threat?
- A. a lightning strike
- B. phishing
- C. fire
- D. thunderstrom
Answer: B
Explanation:
Explanation
A human threat is a threat that originates from a person or a group of people who intentionally or unintentionally cause harm to an organization's information assets. Examples of human threats include hackers, insiders, terrorists, criminals, competitors, or disgruntled employees. A human threat can exploit technical, physical, or organizational vulnerabilities to compromise the confidentiality, integrity, or availability of information. Phishing is an example of a human threat that uses social engineering techniques to trick users into revealing sensitive information, such as passwords, credit card numbers, or bank account details. Phishing attacks often involve sending fraudulent emails or messages that appear to be from legitimate sources, such as banks, government agencies, or trusted contacts. The messages may contain links to malicious websites or attachments that contain malware. Therefore, the correct answer is C. References: ISO/IEC 27000:2022, clause 3.25; What is Phishing? | How to Identify & Avoid Phishing Scams.
NEW QUESTION # 61
An employee caught temporarily storing an MP3 file in his workstation will not receive an IR.
- A. False
- B. True
Answer: A
Explanation:
Explanation
An employee caught temporarily storing an MP3 file in his workstation will receive an IR, because this is also a violation of the organization's information security policy and acceptable use policy. An MP3 file is a type of media file that may contain copyrighted or illegal content, or may introduce malware or viruses into the organization's network. The employee should not store any unauthorized or personal files in his workstation, as this may compromise the confidentiality, integrity and availability of the organization's information assets. References: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], [ISO/IEC
27001:2022 Information technology - Security techniques - Information security management systems - Requirements], Example of an information security policy, Example of an acceptable use policy
NEW QUESTION # 62
Implement plan on a test basis - this comes under which section of PDCA
- A. Act
- B. Plan
- C. Do
- D. Check
Answer: C
Explanation:
The PDCA cycle is a four-step method for managing and improving processes. The steps are Plan, Do, Check, and Act. In the Plan phase, the objectives and scope of the process are defined, and the resources and activities are planned. In the Do phase, the process is implemented on a test basis, and the results are recorded and analyzed1. Reference: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA
NEW QUESTION # 63
You are an experienced ISMS audit team leader. An auditor in training has approached you to ask you to clarify the different types of audits she may be required to undertake.
Match the following audit types to the descriptions.
To complete the table click on the blank section you want to complete so that It is highlighted In fed, and then click on the applicable text from the options below. Alternatively, you may drag and drop each option to the appropriate blank section.
Answer:
Explanation:
NEW QUESTION # 64
Which one option best describes the purpose of retaining documented information related to the Information Security Management System (ISMS) of an organisation?
- A. To the extent necessary, to have confidence that the processes have been carried out as planned.
- B. To show compliance with legal requirements.
- C. To ensure that all workers will follow the established procedure.
- D. To show objective evidence to third-party auditors.
Answer: A
Explanation:
The purpose of retaining documented information related to the ISMS of an organisation is to the extent necessary, to have confidence that the processes have been carried out as planned. This means that the documented information provides evidence of the conformity and effectiveness of the ISMS, as well as the achievement of the information security objectives and the continual improvement of the ISMS. Documented information also supports the analysis and evaluation of the ISMS performance and the identification of opportunities for improvement. References: = ISO/IEC 27001:2022, clause 7.5.1; PECB Candidate Handbook ISO 27001 Lead Auditor, page 17.
NEW QUESTION # 65
Which two activities align with the "Check'' stage of the Plan-Do-Check-Act cycle when applied to the process of managing an internal audit program as described in ISO 19011?
- A. Verify effectiveness of the internal audit programme
- B. Establish a risk-based internal audit programme
- C. Update the internal audit programme
- D. Conduct internal audits
- E. Review trends in internal audit result
- F. Retains records of internal audits
- G. Define audit criteria and scope for each internal audit
Answer: A,E
Explanation:
Explanation
The Check stage of the PDCA cycle involves monitoring and measuring the performance of the process and comparing it with the planned objectives and criteria. In the context of managing an internal audit programme, this stage includes verifying the effectiveness of the internal audit programme by evaluating whether it meets its objectives, scope, and criteria, and whether it is implemented in accordance with ISO 19011 guidelines1. It also includes reviewing the trends in internal audit results by analyzing the data collected from the audits, such as audit findings, nonconformities, corrective actions, opportunities for improvement, and customer feedback1. References: ISO 19011:2018 - Guidelines for auditing management systems
NEW QUESTION # 66
Which two of the following statements are true?
- A. The purpose of an ISMS is to apply a risk management process for preserving information security.
- B. The benefit of certifying an ISMS is to show the accreditation certificate on the website.
- C. The purpose of an ISMS is to demonstrate awareness of information security issues by management.
- D. The purpose of an ISMS is to demonstrate compliance with regulatory requirements.
- E. The benefits of implementing an ISMS primarily result from a reduction in information security risks.
- F. The benefit of certifying an ISMS is to increase the number of customers.
Answer: A,E
Explanation:
Explanation
The benefits of implementing an ISMS primarily result from a reduction in information security risks. E. The purpose of an ISMS is to apply a risk management process for preserving information security.
Comprehensive and Detailed Explanation: According to the ISO 27001 standard, the benefits of implementing an ISMS include the following1:
Assuring customers and other stakeholders of the confidentiality, integrity and availability of information Enhancing the ability to respond to information security incidents and minimize their impacts Improving the governance and management of information security Reducing the costs and losses associated with information security breaches Increasing the competitiveness and reputation of the organization Complying with legal, regulatory and contractual obligations The purpose of an ISMS is to provide a systematic approach to managing information security risks, based on the Plan-Do-Check-Act (PDCA) cycle1. The ISMS enables the organization to establish, implement, maintain and continually improve its information security performance, in alignment with its business objectives and the needs and expectations of interested parties1. The ISMS consists of the following elements1:
The information security policy and objectives
The scope and boundaries of the ISMS
The processes and procedures for information security risk assessment and treatment The resources and competencies for information security The roles and responsibilities for information security The performance evaluation and improvement of the ISMS The internal and external communication and awareness of the ISMS References:
ISO/IEC 27001:2013, Information technology - Security techniques - Information security management systems - Requirements, clauses 1, 4, 5, 6, 7, 8, 9 and 10 PECB Candidate Handbook ISO 27001 Lead Auditor, pages 9-11 ISO/IEC 27001:2013 Information Security Management Standards
4 Key Benefits of ISO 27001 Implementation | ISMS.online
ISO/IEC 27001:2022
An Introduction to the ISO 27001 ISMS | Secureframe
NEW QUESTION # 67
You are the lead auditor of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You decide to take measures for the large risks but not for the small risks.
What is this risk strategy called?
- A. Risk bearing
- B. Risk skipping
- C. Risk neutral
- D. Risk avoidance
Answer: A
Explanation:
Explanation
The risk strategy that involves taking measures for the large risks but not for the small risks is called risk bearing. Risk bearing is a strategy that accepts the existence of risks and their potential consequences without implementing any specific controls to reduce them. Risk bearing is usually applied to risks that have low likelihood and low impact, or when the cost of controls outweighs the benefits. Risk bearing implies that the organization has enough resources and resilience to cope with the risks if they materialize. ISO/IEC
27001:2022 defines risk acceptance as "decision to accept risk" (see clause 3.4). References: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology
- Security techniques - Information security management systems - Requirements, [What is Risk Bearing?]
NEW QUESTION # 68
You are an experienced ISMS audit team leader providing guidance to an auditor in training.
The auditor in training appears to be confused about the interpretation of competence in ISO 27001:2022 and is seeking clarification from you that his understanding is correct. He sets out a series of mini scenarios and asks you which of these you would attribute to a lack of competence. Select four correct options.
- A. A system administrator deleted two live accounts as well as five redundant accounts as a result of receiving an incorrect instruction
- B. An IT technician failed to configure a new model of server correctly as a result of not reading the supplied instructions
- C. A data centre operator inadvertently placed a backup tape into an incorrect drive because they were in a hurry to move on to another task
- D. An experienced receptionist allowed a contractor she recognised to enter the data centre without his access card
- E. An employee recently transferred from the IT networks team to Software development was unaware of the need to complete product release forms prior to shipping
- F. A senior manager could not assist in the organisation's information security incident recovery process as she had not received the required training
- G. A new starter was unable to switch on CCTV monitoring because they had not been shown how to do this
- H. A senior programmer did not check their coding for errors as they were running late for a doctor's appointment
Answer: B,E,F,G
Explanation:
These four scenarios are examples of a lack of competence, which is defined as the ability to apply the knowledge and skills needed to perform a work role or a task effectively and efficiently12. Competence in ISO
27001:2022 is determined by the organisation's needs and expectations, and it is based on the relevant education, training, or experience of the people involved in the ISMS34. The organisation is required to ensure that all the people who affect the performance of the ISMS are competent, and to provide them with the necessary training and awareness to fulfil their roles and responsibilities35. The four scenarios indicate that the people involved either lack the knowledge or skills to perform their tasks, or have not received the appropriate training or guidance to do so. The other scenarios are not related to competence, but to other factors such as negligence, error, or policy violation.
References: = 1: ISO 19011:2018 Guidelines for auditing management systems, clause 3.72: ISO/IEC
27007:2011 Information technology - Security techniques - Guidelines for information security management systems auditing, clause 53: ISO/IEC 27001:2022 Information technology - Security techniques
- Information security management systems - Requirements, clause 7.24: ISO 27001 Requirement 7.2 - Competence | ISMS.online15: ISO27001 Clause 7.2 Competence - Ultimate Certification Guide - High Table3
NEW QUESTION # 69
Which one of the following options is the definition of an interested party?
- A. A group or organisation that can interfere in or perceive itself to be interfered with by a management decision
- B. A person or organisation that can affect, be affected by or perceive itself to be affected by a decision or activity
- C. A third party can appeal to an organisation when it perceives itself to be affected by a decision or activity
- D. An individual or organisation that can control, be controlled by, or perceive itself to be controlled by a decision or activity
Answer: B
Explanation:
Explanation
This is the definition of an interested party according to ISO 27001:2013, clause 3.16. An interested party is essentially a stakeholder, i.e., a person or organization that can influence or be influenced by the information security management system (ISMS) or its activities. Interested parties can have different needs and expectations regarding the ISMS, and these should be identified and addressed by the organization.
References:
* ISO/IEC 27001:2013, Information technology - Security techniques - Information security management systems - Requirements, clause 3.16
* PECB Candidate Handbook ISO 27001 Lead Auditor, page 10
* Identifying interested parties and their expectations for an ISO 27001 ISMS
* Examples of ISO 27001 interested parties
NEW QUESTION # 70
Which one of the following options best describes the main purpose of a Stage 1 third-party audit?
- A. To introduce the audit team to the client
- B. To check for legal compliance by the organisation
- C. To prepare an independent audit report
- D. To learn about the organisation's procurement
- E. To determine redness for a stage 2 audit
- F. To get to know the organisation's customers
Answer: E
Explanation:
The main purpose of a Stage 1 third-party audit is to determine readiness for a Stage 2 audit. A Stage 1 audit is a preliminary assessment that evaluates the organization's ISMS documentation, scope, context, and objectives, and identifies any major gaps or nonconformities that need to be addressed before the Stage 2 audit. A Stage 1 audit does not introduce the audit team to the client, as this is done during the audit planning phase. A Stage 1 audit does not check for legal compliance by the organization, as this is done during the Stage 2 audit. A Stage 1 audit does not prepare an independent audit report, as this is done after the Stage 2 audit. Reference: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 70. : ISO/IEC 27001 LEAD AUDITOR - PECB, page 23.
NEW QUESTION # 71
What is the standard definition of ISMS?
- A. A project-based approach to achieve business objectives for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's information security
- B. A systematic approach for establishing, implementing, operating,monitoring, reviewing, maintaining and improving an organization's information security to achieve business objectives.
- C. Is an information security systematic approach to achieve business objectives for implementation, establishing, reviewing,operating and maintaining organization's reputation.
- D. A company wide business objectives to achieve information security awareness for establishing, implementing, operating, monitoring, reviewing, maintaining and improving
Answer: B
Explanation:
The standard definition of ISMS is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's information security to achieve business objectives. This definition is given in clause 3.17 of ISO/IEC 27001:2022, and it describes the main components and purpose of an ISMS. An ISMS is not a project-based approach, as it is an ongoing process that requires continual improvement. An ISMS is not a company wide business objective, as it is a management system that supports the organization's objectives. An ISMS is not an information security systematic approach, as it is a broader concept that encompasses the organization's context, risks, controls, and performance. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 15. :
ISO/IEC 27001:2022, clause 3.17.
NEW QUESTION # 72
You are conducting an ISMS audit. The next step in your audit plan is to verify that the organisation's information security risk treatment plan has been established and implemented properly. You decide to interview the IT security manager.
You: Can you please explain how the organisation performs its information security risk assessment and treatment process?
IT Security Manager: We follow the information security risk management procedure which generates a risk treatment plan.
Narrator: You review risk treatment plan No. 123 relating to the planned installation of an electronic (invisible) fence to improve the physical security of the nursing home. You found the risk treatment plan was approved by IT Security Manager.
You: Who is responsible for physical security risks?
IT Security Manager: The Facility Manager is responsible for the physical security risk. The IT department helps them to monitor the alarm. The Facility Manager is authorized to approve the budget for risk treatment plan No. 123.
You: What residual information security risks exist after risk treatment plan No. 123 was implemented?
IT Security Manager: There is no information for the acceptance of residual information security risks as far as I know.
You prepare your audit findings. Select three options for findings that are justified in the scenario.
- A. Nonconformity (NC) - The risk treatment plan No. 123 should be approved by the risk owner, the Facility Manager in this case. Clause 6.1.3.f
- B. Nonconformity (NC) - The information for the acceptance of residual information security risks should be updated after the risk treatment is implemented. Clause 6.1.3.f
- C. Nonconformity (NC) - The IT security manager should be aware of and understand his authority and area of responsibility. Clause 7.3
- D. Nonconformity (NC) - The organization should provide the resources needed for the continual improvement of the ISMS. Clause 7.1
- E. There is an opportunity for improvement (OI) once the Electronic (invisible) fence is installed.
Residents' physical security is improved - F. It is good practice to adopt state-of-the-art technology as part of the continual improvement process
- G. There is an opportunity for improvement (OI) to conduct security checks on the perimetre fence
- H. Nonconformity (NC) - Top management must ensure that the resources needed for the ISMS are available. Clause 5.1.c
Answer: A,B,C
Explanation:
Explanation
The three options for findings that are justified in the scenario are:
*Nonconformity (NC) - The information for the acceptance of residual information security risks should be updated after the risk treatment is implemented. Clause 6.1.3.f
*Nonconformity (NC) - The IT security manager should be aware of and understand his authority and area of responsibility. Clause 7.3
*Nonconformity (NC) - The risk treatment plan No. 123 should be approved by the risk owner, the Facility Manager in this case. Clause 6.1.3.f According to ISO/IEC 27001:2022, clause 6.1.3.f, the organisation must retain documented information that includes the information for the acceptance of residual information security risks, and the approval of the risk treatment plan by the risk owner1. Therefore, option A and G are justified as nonconformities, because the organisation failed to update the information for the acceptance of residual risks, and the risk treatment plan was approved by the IT security manager, who is not the risk owner.
According to ISO/IEC 27001:2022, clause 7.3, the organisation must ensure that the persons assigned to perform the roles and responsibilities for the ISMS are competent, and are aware of the consequences of not conforming to the ISMS requirements2. Therefore, option E is justified as a nonconformity, because the IT security manager, who is responsible for the information security risk management process, was not aware of his authority and area of responsibility.
The other options are not justified as findings, because they are either irrelevant or incorrect. For example:
*Option B is irrelevant, because it is not related to the information security risk treatment plan No. 123, which is the focus of the audit.
*Option C is incorrect, because it is not an opportunity for improvement, but rather a benefit of the risk treatment plan No. 123, which is already implemented.
*Option D is incorrect, because it is not a nonconformity, but rather a requirement for the organisation to provide the resources needed for the ISMS, which is not the same as the resources needed for the risk treatment plan No. 123.
*Option F is incorrect, because it is not a nonconformity, but rather a requirement for the organisation to provide the resources needed for the continual improvement of the ISMS, which is not the same as the resources needed for the risk treatment plan No. 123.
*Option H is irrelevant, because it is not a finding, but rather a good practice, which is not the objective of the audit.
References: 1: ISO/IEC 27001:2022, 6.1.3.f; 2: ISO/IEC 27001:2022, 7.3; : ISO/IEC 27001:2022; : ISO/IEC
27001:2022
NEW QUESTION # 73
In the context of a management system audit, please identify the sequence of a typical process of collecting and verifying information. The first one has been done for you.
Answer:
Explanation:
Explanation:
A screenshot of a computer Description automatically generated
Identifying the source of information (already given)
Gathering audit evidence: This involves collecting information from various sources such as documents, records, interviews, and observations.
Sampling the available data: Due to the vast amount of information available, auditors typically use sampling techniques to select representative data for closer scrutiny.
Verifying objective evidence: This involves checking the accuracy, completeness, and reliability of the collected evidence.
Evaluating evidence against the audit criteria: Auditors compare the collected evidence to the established criteria (e.g., standards, policies, procedures) to assess compliance and effectiveness.
Recording audit findings: This involves documenting the results of the evaluation, including observations, conclusions, and recommendations.
Making audit conclusions: Based on the recorded findings, auditors formulate overall conclusions about the status of the management system.
Therefore, the correct sequence is:
1. Identifying the source of information 2. Gathering audit evidence 3. Sampling the available data 4.
Verifying objective evidence 5. Evaluating evidence against the audit criteria 6. Recording audit findings 7.
Making audit conclusions
NEW QUESTION # 74
Scenario 4: SendPay is a financial company that provides its services through a network of agents and financial institutions. One of their main services is transferring money worldwide. SendPay, as a new company, seeks to offer top quality services to its clients. Since the company offers international transactions, it requires from their clients to provide personal information, such as their identity, the reason for the transactions, and other details that might be needed to complete the transaction. Therefore, SendPay has implemented security measures to protect their clients' information, including detecting, investigating, and responding to any information security threats that may emerge. Their commitment to offering secure services was also reflected during the ISMS implementation where the company invested a lot of time and resources.
Last year, SendPay unveiled their digital platform that allows money transactions through electronic devices, such as smartphones or laptops, without requiring an additional fee. Through this platform, SendPay's clients can send and receive money from anywhere and at any time. The digital platform helped SendPay to simplify the company's operations and further expand its business. At the time, SendPay was outsourcing its software operations, hence the project was completed by the software development team of the outsourced company.
The same team was also responsible for maintaining the technology infrastructure of SendPay.
Recently, the company applied for ISO/IEC 27001 certification after having an ISMS in place for almost a year. They contracted a certification body that fit their criteria. Soon after, the certification body appointed a team of four auditors to audit SendPay's ISMS.
During the audit, among others, the following situations were observed:
1.The outsourced software company had terminated the contract with SendPay without prior notice. As a result, SendPay was unable to immediately bring the services back in-house and its operations were disrupted for five days. The auditors requested from SendPay's representatives to provide evidence that they have a plan to follow in cases of contract terminations. The representatives did not provide any documentary evidence but during an interview, they told the auditors that the top management of SendPay had identified two other software development companies that could provide services immediately if similar situations happen again.
2.There was no evidence available regarding the monitoring of the activities that were outsourced to the software development company. Once again, the representatives of SendPay told the auditors that they regularly communicate with the software development company and that they are appropriately informed for any possible change that might occur.
3.There was no nonconformity found during the firewall testing. The auditors tested the firewall configuration in order to determine the level of security provided by these services. They used a packet analyzer to test the firewall policies which enabled them to check the packets sent or received in real-time.
Based on this scenario, answer the following question:
How do you evaluate the evidence obtained related to the monitoring process of outsourced operations? Refer to scenario 4.
- A. Irrelevant, monitoring the outsourced operations is not a requirement of the standard
- B. Not reliable. SendPay provided only verbal evidence regarding the monitoring of its outsourced operations
- C. Appropriate and sufficient, verbal confirmation from the SendPay's representatives indicates that the they were aware that outsourced operations must be monitored
Answer: B
Explanation:
The evidence provided by SendPay, which is solely verbal confirmation about the monitoring of outsourced operations, is not considered reliable under ISO/IEC 27001. The standard requires documented evidence to support claims of effective monitoring and control over outsourced processes.
References: ISO/IEC 27001:2013 Standard, Clause A.15 (Supplier relationships)
NEW QUESTION # 75
Auditor competence is a combination of knowledge and skills. Which two of the following activities are predominately related to "knowledge"?
- A. Determining what evidence to gather
- B. Communicate with the auditee
- C. Determining how to seek evidence from the auditee
- D. Understanding how to identify findings
- E. Follow an audit trail deviating from the prepared checklist
- F. Designing a checklist
Answer: A,F
Explanation:
Knowledge is the understanding of facts, concepts, principles, theories and practices related to a specific subject or discipline. Skills are the ability to apply knowledge and use know-how to complete tasks and solve problems. According to ISO 19011:2018, the knowledge and skills of an auditor include the following:
Knowledge of audit principles, procedures and methods
Knowledge of management system standards and reference documents
Knowledge of the organization's context, scope, processes and objectives Knowledge of relevant legal, regulatory and contractual requirements Knowledge of applicable industry, sector or technical disciplines Knowledge of risk management and risk-based thinking Skill in collecting and verifying information Skill in evaluating conformity and effectiveness of management systems Skill in reporting and communicating audit results Skill in managing audit activities and teams Based on this, the activities that are predominately related to knowledge are designing a checklist and determining what evidence to gather, as they require the auditor to understand the audit criteria, scope, objectives and methods, as well as the organization's context, processes and risks. The other activities are more related to skills, as they involve applying knowledge and using know-how to perform tasks and solve problems during the audit.
References:
ISO 19011:2018, Guidelines for auditing management systems, clauses 7.2.1, 7.2.2 and 7.2.3 PECB Candidate Handbook - ISO 27001 Lead Auditor, pages 9-10 and 16-17 ISO 9001 Auditing Practices Group Guidance on: Auditing Competence, pages 2-3 and 8
NEW QUESTION # 76
......
New ISO-IEC-27001-Lead-Auditor Exam Questions Real PECB Dumps: https://www.certkingdompdf.com/ISO-IEC-27001-Lead-Auditor-latest-certkingdom-dumps.html
Pass Authentic PECB ISO-IEC-27001-Lead-Auditor with Free Practice Tests and Exam Dumps: https://drive.google.com/open?id=1GBCgcs19TiDllM1UnCeEaA-nnBHX9RMV