Domain 4 is the largest domain on the CQI and IRCA ISO 27001 Lead Auditor exam: fourteen questions worth 36 of the 80 marks, with a minimum of 14. These fourteen practice questions match the real paper's count and mark split, with an explanation for every option.

Every question below was written for this page by 3FOLD TRAINING's tutors. None is a real CQI and IRCA examination question, and none is taken from 3FOLD TRAINING's own graded mock exams. Real exam questions cannot lawfully be published, and any site offering them is offering you something it should not have.

Why does Domain 4 decide results?

Domain 4 carries more marks than Domains 1, 2 and 3 combined, which total 24. Its floor of 14 marks is the largest single block on the paper, nothing compensates for it, and a candidate above 50 per cent overall can still fail.

The values are eight 3-mark and six 2-mark questions. It is the only domain tested at two levels, apply and evaluate, and every question is built on a scenario — a described situation carrying several questions, each standing alone. The set below follows that construction: fourteen questions across four scenarios, same 8×3 and 6×2 split, 36 marks.

What does Domain 4 cover?

• The opening meeting
• Gathering evidence, following trails, corroborating what you are told
• Interviewing and observation, including remote and cloud evidence
• Auditing Clauses 4 to 10 and a risk-based sample of Annex A controls
• Forming and grading findings

How should you use this set?

Read each scenario once, then answer every question hung off it before moving on. That is how the real paper presents them, and it is a different exercise from fourteen unrelated questions. Write down the requirement and the evidence you relied on each time: a right answer reached from the wrong evidence will not survive a differently-worded question. None of them predicts what you will be asked. They test the same understanding, in the two formats that carry most of the paper, so working through them shows you where you are weak while there is still time to act on it.

Every question below carries its mark value, and here they are 2 and 3 rather than the 1 and 2 of the smaller domains. Score in marks: fourteen questions carry 36, so what you can afford to lose works out differently from anywhere else on the paper. Where a question asks for more than one answer, select exactly the number asked for: partial marks apply throughout, and nothing CQI publishes says a wrong selection is deducted from a right one.

This set is worth timing. The framework's recommended time for Domain 4 is 45 minutes, and because these are scenario questions of the same construction, the comparison means something. Running out of time here, after too long on the smaller domains, is a common and entirely avoidable way to lose marks.

Two constraints of the real paper matter more here than anywhere else. You cannot navigate backwards once you have clicked Next, so a scenario you half-decide is one you have lost. And the exam is open book: in a domain built on naming the requirement, finding a clause quickly beats memorising it. See CQI and IRCA on online exams.

The questions

Fill in the form below to unlock your ISO 27001 Lead Auditor Domain 4 Practice Questions: Conducting the Audit.

We'll email your full results — with a detailed explanation for every question — as soon as you finish.

Full Name

Email Address

Phone

Question 1. (3 marks) Which findings does the evidence at Quaymarch support? Choose the best three.

A. The platform was moved to a new hosting provider with no record of how the change was managed

B. The Statement of Applicability should have been re-approved annually

C. The cloud-services control is marked implemented with no shared-responsibility analysis behind the claim

D. The risk assessment was not repeated following a significant change

E. Certification should be withdrawn immediately

Question 2. (2 marks) Against which requirement is the absence of any planned-change record for the migration best raised?

A. Clause 6.1.1, actions to address risks and opportunities

B. Clause 6.3, planning of changes

C. Clause 7.5.2, creating and updating documented information

D. Clause 8.1, operational planning and control

None

Question 3. (3 marks) Quaymarch's platform manager offers to demonstrate the migrated environment by sharing her screen. What most needs to be established about what you are shown?

A. That the configuration on screen matches the documented baseline for the production environment

B. That the manager holds full administrator rights over the environment she is showing you

C. That the environment shown is the live production tenancy and not a prepared or historic view

D. That the cloud provider hosting the environment is itself certified to ISO/IEC 27001

None

Question 4. (3 marks) You want to test whether Quaymarch's Statement of Applicability still reflects the organisation as it now is. Which trail does that best?

A. Take the controls the risk register relies on, and check each is applicable in the Statement of Applicability and operating in the new environment

B. Compare the Statement of Applicability against the full list of Annex A controls, to confirm that every one of them is accounted for in the document

C. Ask when the Statement of Applicability was last reviewed, by whom, and whether the review considered the migration

D. Ask whoever maintains the Statement of Applicability whether they consider it up to date following the move

None

Scenario: Ferrisbrook Shared Services Ferrisbrook Shared Services runs the finance, human resources and student-records systems for a university and three affiliated colleges, with 140 staff in the shared-services centre. It is at Stage 2 of first-time certification. Staff move frequently between the three teams. You find that access is granted on transfer but never removed from the previous role: one administrator holds live rights in all three systems, and can create a supplier record, approve it, and release the payment run. Questions 5 to 8 are based on this scenario. Each one stands on its own. Question 5. (2 marks) What the administrator in the finance system is able to do unaided engages one control most directly. Which?

A. A.5.15, access control

B. A.8.2, privileged access rights

C. A.6.6, confidentiality or non-disclosure agreements

D. A.5.3, segregation of duties

None

Question 6. (2 marks) Consider how the shared-services centre handles a member of staff moving between its three teams. Which requirement does that most directly engage?

A. A.6.5, responsibilities after termination or change of employment

B. A.5.17, authentication information

C. A.5.18, access rights

D. A.5.16, identity management

None

Question 7. (3 marks) Before you decide how to grade the accumulated rights you have found at Ferrisbrook, what should you do?

A. Extend the sample to other recent transfers to establish whether it is isolated or systemic

B. Raise it as a major straight away, on the basis that a failure of segregation over the payment run is plainly significant

C. Ask the auditee how many other members of staff are likely to be affected in the same way

D. Record it as an observation for now, and leave it there until the auditee has investigated

None

Question 8. (3 marks) Ferrisbrook's head of shared services offers to sit with you for the access-control sessions and answer your questions about how transfers are handled, rather than giving you time with the three team leads who action them. How should the audit team respond? Choose the best two.

A. Take the overview from her, then interview the three team leads who action the transfers

B. Interview only the head of shared services, since a senior manager will give more authoritative answers

C. Tell her the team must speak to the three team leads, and treat continued refusal as a restriction to resolve before the closing meeting

D. Accept the arrangement, and record in the audit report that access to process owners was restricted

E. Ask the head of shared services to obtain written answers from the three team leads on your behalf

Scenario: Ellenport Produce Group Ellenport distributes chilled produce across four emirates and runs an order and cold-chain system holding customer and supplier commercial data. It has 210 staff and is at Stage 2 of first-time certification. Its ISMS was designed and built by the IT Manager, who also carried out the single internal audit. That audit covered every clause and every applicable control and raised no findings. The management review minutes record attendance and a status update, but list no inputs and record no decisions. Nine security metrics are collected monthly into a spreadsheet, which no one has analysed. Questions 9 to 11 are based on this scenario. Each one stands on its own. Question 9. (3 marks) Ellenport offers its internal audit as evidence that the ISMS has been checked. What is the most defensible finding?

A. No finding, because the requirement is coverage of the clauses and controls and that has been met in full

B. The audit programme did not take into account the importance of the processes concerned or the results of previous audits

C. The internal audit results were not reported to the management responsible for the areas audited, as required

D. The internal audit was carried out by the person who designed and built the ISMS, so objectivity and impartiality are not demonstrated

None

Question 10. (2 marks) Judged against the way Ellenport handles its security metrics, which requirement is not met?

A. Clause 7.5, documented information

B. Clause 9.1, monitoring, measurement, analysis and evaluation

C. Clause 10.1, continual improvement

D. Clause 7.4, communication

None

Question 11. (2 marks) What do the minutes of Ellenport's management review most directly indicate?

A. A management review that does not meet the requirement for its inputs and outputs

B. A competence failure, since those attending did not know what was required

C. A documented information failure, since the minutes of the review are plainly incomplete as a record

D. A planning failure under Clause 6.2, the objectives never having been made measurable

None

Scenario: Stavemoor Engineering Consultants LLC Stavemoor provides structural design and site supervision to infrastructure clients, holding client drawings, tender pricing and design intellectual property. It has 240 staff across two offices and is at Stage 2 of first-time certification. Its Statement of Applicability records A.8.24 Use of cryptography as not applicable, justified in one line as “not applicable — we are an engineering firm”. Drawings and tender pricing are emailed daily to client teams and site contractors. Risk RSK-31, unauthorised disclosure of client design intellectual property in transit, is rated High, and the only treatment control listed against it is A.8.24. Questions 12 to 14 are based on this scenario. Each one stands on its own. Question 12. (3 marks) Judged against Clause 6.1.3 d), what is wrong with the way Stavemoor has treated A.8.24?

A. A control may not be recorded as not applicable where it appears in Annex A of the standard

B. Cryptography is a mandatory control that every certified organisation is required to implement

C. The justification given is contradicted by the way the organisation actually operates

D. A control recorded as not applicable has to be agreed with the certification body first

None

Question 13. (3 marks) Reconcile risk RSK-31 against the Statement of Applicability. What does that comparison demonstrate?

A. That the risk rating is too high and ought to be reassessed downwards

B. That the risk treatment plan has not been approved by the certification body

C. That the risk assessment method has been applied inconsistently across the register, producing a rating that cannot be relied on

D. That the Statement of Applicability does not reconcile with the risk assessment, leaving a High risk untreated

None

Question 14. (2 marks) Which further question would best test whether Stavemoor's risk treatment process works as required?

A. How often is the risk register reviewed, and when was the last review carried out?

B. Who owns risk RSK-31, and where is their acceptance of the residual risk recorded?

C. Has the risk register in its current form been formally approved by top management?

D. Which member of staff maintains the risk register, and what is their role?

None

Time's up

Where do marks actually go in Domain 4?

Three errors, all habits.

• Grading on impression rather than evidence. Seriousness is not the test, and grading on how bad something feels goes wrong in both directions.
• Recognising a nonconformity without tying it to a requirement. Name the clause or control and the evidence; an untraceable finding falls over.
• Choosing the answer that sounds most thorough. The best answer is the one the evidence supports.

One habit earns marks across the domain. Ask of every scenario: what is the requirement, and what does the evidence show? Most questions resolve once you have both. And remember the exam is open book. A question you could have answered by opening the standard is a navigation problem, not a knowledge gap, and the fix is to practise finding things rather than memorising them.

Look at why each went wrong rather than what it was about; the fix differs.

• You could not name the requirement. A knowledge gap; reading fixes it. Work Clauses 4 to 10 and the four Annex A themes until you can place a finding without hunting for it.
• You named the requirement but graded it wrongly. Judgement, improved by working scenarios.
• You chose the most thorough-sounding option. An exam habit, the easiest to break once noticed.

Frequently asked questions

Where to go next

The Domain 5 set — reporting and closing out, eight questions and 20 marks — follows separately. How the ISO 27001 Lead Auditor exam pass mark works explains why one weak domain fails an otherwise comfortable paper, and the five exam domains sets out what each asks.

• Domain 1 practice questions — concepts and principles, 6 questions, 8 marks.
• Domain 2 practice questions — audit concepts and auditor responsibilities, 6 questions, 8 marks.
• Domain 3 practice questions — planning the audit, 6 questions, 8 marks.
• The sample exam questions and answers — ten questions weighted across all five domains, if you want a spread rather than a domain.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING's Approved Training Partner record, and any provider's certified courses can be looked up in CQI and IRCA's own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.