Domain 5 of the CQI and IRCA ISO 27001 Lead Auditor exam is eight questions worth 20 of the 80 marks, with a minimum of 8. These eight practice questions match the real paper's count and mark split, with an explanation for every option.

Every question below was written for this page by 3FOLD TRAINING's tutors. None is a real CQI and IRCA examination question, and none is taken from 3FOLD TRAINING's own graded mock exams or reproduces what one of them tests. Real exam questions are covered by the confidentiality terms every candidate agrees to before sitting, so any site offering them holds material it should not have.

What makes Domain 5 different?

Two things set it apart. It is the only domain tested at evaluate alone, so every question asks you to judge rather than recognise. And it is wholly scheme-specific: the answers come from how CQI and IRCA expect an ISMS audit to be closed out, not from general auditing knowledge.

The values are four 3-mark and four 2-mark questions, and every question is built on a scenario. The set below follows that construction: eight questions across two scenarios, 20 marks.

How should you use this set?

Work each scenario whole before you look at anything. Domain 5 questions reward holding the audit in view — what was found, what it means, what happens next — and answering them one at a time is an easier exercise than the paper sets.

None of them predicts what you will be asked. They test the same understanding, in the two formats a web page can reproduce — multiple choice and multiple response, which between them carry most of the paper — so working through them shows you where you are weak while there is still time to act on it.

Every question below carries its mark value, and here they are 2 and 3 rather than the 1 and 2 of the smaller domains. Score in marks: eight questions carry 20 with a minimum of 8, so one 3-mark question is a quarter of the margin you have above that minimum. Where a question asks for more than one answer, select exactly the number asked for: partial marks apply throughout, and nothing CQI publishes says a wrong selection is deducted from a right one.

Two constraints of the real paper matter here. You cannot navigate backwards once you have clicked Next, so a scenario you half-decide is one you have lost. And the exam is open book, though it will help you less in this domain than in any other — nothing you can look up will tell you whether the evidence in front of you carries a major or a minor. See CQI and IRCA on online exams.

The questions

Fill in the form below to unlock your ISO 27001 Lead Auditor Domain 5 Practice Questions: Reporting and Closing Out.

We'll email your full results — with a detailed explanation for every question — as soon as you finish.

Full Name

Email Address

Phone

Scenario: Corvallo Diagnostics Corvallo runs four pathology laboratories processing patient samples for hospital trusts, holding patient identifiers and clinical results. It has 320 staff and is at Stage 2 of first-time certification. The audit is finished and the team is drafting its findings. At three of the four laboratories, sampled user accounts belonging to staff who had left still had active access; at the fourth, the same check was clean. Separately, the laboratory information system holds results for seven years while Corvallo's own retention schedule requires ten. Questions 1 to 4 are based on this scenario. Each one stands on its own. Question 1. (3 marks) A team member drafts this for the retention gap: “Records retention is inadequate and the laboratory system has been badly configured, which should be corrected by extending the retention period to ten years.” Judged as a nonconformity report, what is the most serious defect?

A. It is written about the configuration of a system rather than about the people who are responsible for it

B. It names no requirement and offers a solution, so it is neither traceable nor properly an auditor's finding

C. It does not say how many records were examined, or which of the four laboratories the sample was drawn from

D. It states a conclusion that the audit team has not yet formally agreed among themselves at this stage

None

Question 2. (3 marks) The leaver accounts at the three laboratories would each be a minor if taken on its own. How should the team grade them, and on what basis?

A. Three separate minors, because each laboratory is a separate site operating under its own local administrator

B. One minor, because the total number of accounts involved is small when set against the whole population sampled

C. An observation at each site, because access was not actually misused by anyone who had left

D. One major, because the same gap at three of four sites is a pattern rather than three isolated lapses

None

Question 3. (2 marks) At the end of the audit Corvallo's quality manager asks whether the retention gap could be recorded as an opportunity for improvement instead, since the shortfall is in Corvallo's own schedule rather than in the standard. How should the team leader respond?

A. Decline, because the organisation's own documented requirement is an audit criterion and failing it is a nonconformity

B. Agree, because a requirement the organisation set for itself is not one that ISO/IEC 27001 imposes on it

C. Agree, provided the opportunity for improvement is written up with the same evidence a nonconformity would carry

D. Defer the decision to the certification body, since the grading of borderline findings is not the team's to make

None

Question 4. (2 marks) While the report is being written, a team member proposes adding a finding about weak password rules that nobody raised with Corvallo at any point during the audit. What should the team leader do?

A. Add it, since the report must record everything the team observed while on site

B. Add it as an observation rather than a nonconformity, which avoids the need to have raised it

C. Leave it out of this report, because nothing in the report should be new to the auditee

D. Add it, but note in the report that the auditee had no opportunity to respond to it

None

Scenario: Marrowgate Water Services Marrowgate operates telemetry and billing systems for a regional water utility and has held certification for four years. At the last surveillance audit a major nonconformity was raised: changes were being made to the telemetry platform without any record of authorisation or testing. Marrowgate has responded with a corrective action plan, and you are the team leader for the follow-up. The plan states that the two engineers who made the unauthorised changes have been retrained and formally warned. Questions 5 to 8 are based on this scenario. Each one stands on its own. Question 5. (3 marks) Judged as a response to the major, what is wrong with Marrowgate's plan as it stands?

A. Retraining is never an acceptable corrective action, because people cannot be relied upon

B. The plan should have been submitted to the certification body rather than to the audit team

C. Disciplinary action against named individuals falls outside what an auditor may evaluate

D. It addresses the two engineers rather than the absence of any change-authorisation process

None

Question 6. (3 marks) Marrowgate's directors ask what the audit team's conclusions will say. Which of these belong in the audit conclusions? Choose the best three.

A. The extent to which the ISMS conforms to the audit criteria

B. The corrective actions Marrowgate should take to close the outstanding major

C. Whether the ISMS is effectively implemented and maintained

D. The team's confidence in its conclusions, given that they rest on a sample

E. A ranking of the areas audited, from the strongest to the weakest

Question 7. (2 marks) At the closing meeting Marrowgate's operations director says the team clearly knows the platform well, and asks the team leader to set out what a compliant change-authorisation process would look like. How should the team leader respond?

A. Decline to specify the process, restate the requirement and the evidence, and leave the design to Marrowgate

B. Set out the process in outline only, since general advice is not the same as designing a system

C. Agree, on the basis that helping the auditee understand the requirement is part of the auditor's role

D. Offer to send the specification after the audit closes, when the audit relationship has ended

None

Question 8. (2 marks) Marrowgate later reports that a change-authorisation procedure has been issued and all engineers briefed on it. What would be adequate evidence that the corrective action is effective?

A. The issued procedure, together with the attendance record from the briefing

B. A statement from the engineering manager confirming the procedure is now followed

C. Authorisation and test records for a sample of changes actually made since the procedure was issued

D. Confirmation that the procedure has been added to the document register and given a version number

None

Time's up

Where do marks actually go in Domain 5?

Three places, none of them knowledge of the standard.

• Writing findings that cannot stand up. Four errors cost marks: evidence too vague to trace, the wrong requirement or none, the finding mixed up with its cause or its fix, and unjustified grading.
• Grading on how bad it feels. The test is systemic against isolated, and its harder half is that related minors can add up to a major.
• Accepting a plan instead of evidence. A corrective action is evaluated twice: is the proposal appropriate to the cause, and later, did it work? A promise closes nothing.

One habit covers the domain. For any finding, ask what requirement it rests on and what evidence carries it; for any response, ask what the process would produce if it were running, then ask to see some.

What if you found these hard?

Domain 5 rewards a different kind of practice, because the questions are not about what the standard says. Write findings. Take a control you know is weak somewhere you have worked, write it up in three parts — requirement, evidence, statement — and ask whether another auditor could find that evidence from your description alone.

Frequently asked questions

Where to go next

This set completes the five domains. The next step is a full paper: the free 40-question ISO 27001 Lead Auditor mock exam is the whole thing, correctly weighted. For grading practice, the ISMS audit findings grading exercise gives you twelve findings from one audit to grade and justify.

• Domain 1 practice questions — concepts and principles, 6 questions, 8 marks.
• Domain 2 practice questions — audit concepts and auditor responsibilities, 6 questions, 8 marks.
• Domain 3 practice questions — planning the audit, 6 questions, 8 marks.
• Domain 4 practice questions — conducting the audit, 14 scenario questions, 36 marks.
• The sample exam questions and answers — ten questions weighted across all five domains, if you want a spread rather than a domain.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING's Approved Training Partner record, and any provider's certified courses can be looked up in CQI and IRCA's own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.