Grade These Twelve ISMS Audit Findings: A Practice Exercise
Twelve findings from a single ISMS certification audit, for you to grade as a major nonconformity, a minor, an observation, or no finding at all. Each answer explains what the grade turns on, which is what the CQI and IRCA exam actually marks.
Twelve findings from a single ISMS certification audit, for you to grade as a major nonconformity, a minor, an observation, or no finding at all. Each answer explains what the grade turns on, which is what the CQI and IRCA exam actually marks.
Every finding below was written for this page by 3FOLD TRAINING’s tutors, and the organisation they describe is invented. None is taken from a CQI and IRCA examination, and none is taken from 3FOLD TRAINING’s own graded mock exams or reproduces what one of them tests.
Why practise grading ISMS audit findings separately?
Because it is a different skill from recognising a nonconformity, and the exam tests it harder. Most candidates can see that something is wrong; rather fewer can say, on the evidence in front of them, whether it is major or minor. Domain 4 is set at apply and evaluate and Domain 5 at evaluate alone, so 56 of the 80 marks turn on judgements of this kind.
The rule is short. A major is a systemic failure, a required control or process absent altogether, or a failure serious enough to put the ISMS’s intended outcomes in doubt. A minor is an isolated lapse against a defined requirement. An observation flags a risk before any requirement is breached. Where none is engaged, the honest answer is no finding.
What makes it hard is that the rule says nothing about how bad something feels, and feeling is what most people grade on. Something can sound alarming and be a minor, or sound trivial and be a major. The grade comes from the evidence and the requirement, not the impression.
How to work this ISO 27001 audit findings grading exercise
Grade each finding as a major nonconformity, a minor nonconformity, an observation, or no finding. Write the reason down before you look, because the reason is what the exam marks and the grade on its own is worth nothing without it.
One note on observation, because the term gets used loosely. Here it means what the course means: flagging a risk before any requirement is breached. Nothing below turns on separating it from an opportunity for improvement, so where an answer says observation and you would have said opportunity for improvement, you have not made the mistake this exercise tests for.
Two habits are worth building. First, name the requirement before the grade: if you cannot cite a clause, a control or the organisation’s own arrangement, ask whether you have a finding at all. Second, read all twelve before committing to any, because the audit is one story and some of these findings explain each other.
None of these findings predicts what you will be shown in the examination. They ask for the same judgement the examination asks for, so working through them shows you where your grading is unreliable while there is still time to act on it.
Every finding below comes from the same audit: a Stage 2 certification audit of Brackenhoe Insurance Services, an invented broker with 400 staff across a head office and three regional branches, holding customer financial and health data. Grade each one, then check your reasoning against the answer.
Want structured preparation?One year of LMS access and HD recordings come with the course.
The twelve ISMS audit findings to grade
Grade each one before you read the answers, and write down the reason. The reason is what the exam marks.
- The information security policy was approved by the board and is published on the intranet. Of twenty staff interviewed across the four sites, eighteen could describe their own responsibilities under it. Two, both recent starters at the Glasgow branch, could not, and both had completed induction within the last fortnight.
- Brackenhoe’s risk assessment method defines risk as likelihood multiplied by impact on a five-by-five scale. Of the forty risks in the register, thirty-seven are rated using that scale. Three carry a rating in words — “high”, “medium” — with no likelihood or impact score recorded. All three were added by the same analyst during her first fortnight in the role; risks she has entered since are scored correctly.
- The Statement of Applicability records A.8.16 Monitoring activities as applicable and implemented. The security information and event management platform was decommissioned eleven months ago in a cost reduction and has not been replaced. Nothing now collects or reviews security events, and the Statement of Applicability has not been amended.
- Of fifteen sampled leavers, one retained an active account for nine days after their last working day. The account was not used in that period. The joiners, movers and leavers procedure requires access to be removed on the last working day, and the other fourteen were removed on time.
- The head office server room door was propped open with a fire extinguisher during the audit visit. The facilities manager said this happens when the air conditioning struggles in summer. The Statement of Applicability records A.7.1 Physical security perimeters and A.7.2 Physical entry as applicable and implemented, and the door is the only barrier between a public corridor and the server room.
- Brackenhoe’s internal audit programme schedules four audits a year. Three were completed. The fourth, covering supplier management, was postponed twice and not carried out. The audit programme records both postponements and the reason, which was the auditor’s availability.
- Supplier security reviews are required annually by Brackenhoe’s own procedure. Of eight critical suppliers, none has been reviewed since onboarding, the earliest four years ago. The supplier manager said reviews had been intended each year but never scheduled, and no review records exist for any supplier.
- Brackenhoe’s business continuity arrangements for the Bristol branch were exercised four months ago against the current arrangements, and the test report records no issues. The organisation’s procedure requires an annual exercise. The branch is due to move its customer telephony to a new supplier next quarter; the migration is planned and funded, and the continuity plan has not yet been revised for it. Nothing in the procedure requires the plan to be revised before a change takes effect.
- Of twelve sampled changes to the customer portal, two were deployed without the testing evidence the change procedure requires. Both were emergency fixes deployed out of hours. The procedure provides for emergency changes but requires retrospective testing evidence within five working days, which was not produced for either.
- The management review held in March recorded attendance, discussed the three internal audits completed and the security incidents of the previous year, and recorded four decisions with owners and dates. It did not consider the status of previous management review actions, and the minutes do not mention feedback from interested parties.
- Brackenhoe’s security metrics are analysed monthly by the information security manager, who records what each trend means and what she proposes to do about it. Her analysis goes to the board quarterly, reduced by the board pack template to a single slide of eight numbers with no commentary. The board minutes record the slide as noted.
- Awareness training records were sampled at all four sites. At head office, three of ten sampled staff had no record of completing the annual refresher. At Leeds, four of ten. At Bristol, three of ten. At Glasgow, four of ten. Brackenhoe’s procedure requires the refresher annually for all staff.
Not sure about the course yet?One year of free retraining on the same exam version is included.
Take the ISMS audit findings grading quiz
ISO 27001 audit findings answer key: what the tally should look like
Four majors, five minors, two observations and one that is not a finding. If your grades were mostly right but your reasons vague, that is the more useful thing to know: a right answer reached from the wrong reasoning will not survive a differently-worded question.
Four patterns account for most wrong grades.
- Grading on seriousness rather than evidence. Findings 4 and 5 both sound bad. One is a minor and one a major, and the difference is not how bad they sound.
- Treating an absence as a bad rate. Finding 7 is not a process working poorly; it is one that has never operated. Nought out of eight over four years differs in kind from two out of eight.
- Missing the pattern. Finding 12 reads as four local minors until you notice it is the same gap at every site in the same proportion. Related minors pointing to one underlying failure aggregate into a major, and that is a judgement you have to make deliberately.
- Reading each finding in isolation. Findings 6 and 7 are one story told twice: the internal audit never carried out is the supplier audit, and supplier review is the process that has never operated. One explains the other.
Frequently asked questions about grading ISMS audit findings
How do I decide the grade of an ISMS audit finding under CQI IRCA ISO 27001 exam conditions?
Evidence of a systemic failure, a required control absent altogether, or a failure that puts the ISMS’s intended outcomes in doubt. An isolated lapse is a minor.
Can several minor nonconformities in an ISO 27001 ISMS certification audit become a major?
Yes. Related minors pointing to one underlying failure aggregate into a major, and recognising that is a deliberate act rather than something the evidence does for you.
When should I raise an observation instead in an ISO 27001 ISMS audit?
When there is real risk and no requirement is breached. If you are stretching a control to cover the situation, an observation is what you have.
Is it wrong to raise no finding at all in an ISO 27001 Audit?
No. Raising one the evidence does not support is as serious an error as missing a real one, and if you cannot name the requirement, you do not have a finding.
Where to go next: more ISO 27001 Lead Auditor exam practice
Grading is examined hardest in the last two domains. The Domain 5 practice questions cover reporting, the closing meeting and corrective action; the Domain 4 practice questions cover conducting the audit and forming the findings in the first place. When both feel comfortable, sit the free 40-question mock exam whole — and if you have been revising from downloaded question banks, what those actually contain is worth knowing.
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply