Domain 3 of the CQI and IRCA ISO 27001 Lead Auditor exam is six questions worth eight marks, with a minimum of three. It covers everything that happens before the Stage 2 audit begins. These six practice questions match that count, with an explanation for every option.

Every question below was written for this page by 3FOLD TRAINING’s tutors. None is a real CQI and IRCA examination question, and none is taken from 3FOLD TRAINING’s own graded mock exams. Real exam questions cannot lawfully be published, and any site offering them is offering you something it should not have.

What does Domain 3 cover?

Domain 3 is planning the audit. It covers initiating the audit and confirming you can proceed, establishing scope, objectives and criteria, and judging feasibility. It then covers determining audit time on a reasoned basis, the Stage 1 review, and building a risk-based Stage 2 plan and checklist.

This domain is wholly scheme-specific, and that changes how you answer. The planning questions are set in an information security context, so a generally sensible answer about audit planning will not always be the best answer available. The best answer is the one an ISMS auditor would give.

It is also set at apply. You are not asked what Stage 1 is; you are asked what to do with what Stage 1 found.

How to use these Domain 3 practice questions

Before you look at any answer, write one word beside each question: Stage 1 or Stage 2. Most of this domain resolves to that boundary, and seeing your own answer written down next to the right one tells you more than the explanation does. Then read the explanations for everything you got wrong and everything you guessed.

None of them predicts what you will be asked. They test the same understanding, in the two formats that carry most of the paper, so working through them shows you where you are weak while there is still time to act on it.

Every question below carries its mark value, and here the values are 1 and 2. With only eight marks available, one 2-mark question is a quarter of the domain, so score in marks rather than in questions right. Where a question asks for more than one answer, select exactly the number asked for: partial marks are given on all questions, and nothing CQI publishes says a wrong selection is deducted from a right one.

The real paper allows no backward navigation: answer, click Next, and it stands. Planning questions are where candidates most want a second look, because two options often both describe reasonable practice. Decide which the requirement demands, and move on. See CQI and IRCA on online exams.

ISO 27001 Lead Auditor Domain 3 practice questions

Fill in the form below to unlock your ISO 27001 Lead Auditor Domain 3 Practice Questions: Planning the Audit.

We'll email your full results — with a detailed explanation for every question — as soon as you finish.

Full Name

Email Address

Phone

Question 1. (1 mark) Stage 1 of an initial certification audit has been completed. Which set of outputs should it have produced?

A. A list of nonconformities raised against the documented information, a corrective action plan agreed with the auditee, and a firm date for Stage 2

B. A documented conclusion with areas of concern, confirmation or revision of the Stage 2 scope and timing, a readiness decision, and input to the Stage 2 plan

C. A draft audit report, a recommendation for certification, and the Statement of Applicability formally signed off by the audit team leader

D. A gap analysis against each of the Annex A controls, and a schedule of the controls the organisation must implement before Stage 2 can proceed

None

Question 2. (1 mark) Which of these would not be a legitimate audit criterion for a certification audit?

A. The requirements of ISO/IEC 27001:2022

B. The organisation's own documented ISMS policies and procedures

C. The lead auditor's view of what represents good industry practice

D. The information security requirements the organisation has accepted in its client contracts

None

Question 3. (2 marks) Which statements about the scope of an ISMS and the scope of an audit are correct? Choose the best three.

A. The ISMS scope is determined by the organisation itself, not by the certification body

B. The audit scope is determined by the auditee before the audit begins

C. The audit scope may be narrower than the ISMS scope for a surveillance audit

D. The ISMS scope and the audit scope are necessarily identical in a certification audit

E. An ISMS scope that leaves part of the organisation out must still account for the interfaces with it

Question 4. (1 mark) A payroll bureau runs 300 client organisations on one shared platform. Two auditors disagree about how to select client tenants for the certification audit: one wants a statistically random draw so that nobody can call the sample biased, the other wants to choose them. Which position is right, and why?

A. The second, because a certification audit samples on judgement guided by risk, and a defensible sample is one whose basis is recorded rather than one drawn at random

B. The second, because statistical methods have no place in a management-system audit and a random draw would not be accepted by the certification body

C. The first, because a randomly drawn sample removes auditor bias and is therefore the more defensible of the two approaches

D. Neither, because with 300 tenants on one platform the only sound approach is to test them all rather than sample at all

None

Question 5. (2 marks) The audit plan has been sent to the auditee in advance. On the second morning, evidence in one area suggests a problem in an area not scheduled until day three. What should the audit team do?

A. Keep to the plan, and raise the concern at the closing meeting

B. Abandon the plan and follow the evidence wherever it leads for the remainder of the audit

C. Ask the auditee's permission to depart from the agreed plan before proceeding

D. Follow the trail now, adjust the schedule, and tell the auditee what has changed and why

None

Question 6. (1 mark) Besides the audit checklist, which working documents would you expect the team to prepare before a Stage 2 audit?

A. The nonconformity reports, drafted in advance from the Stage 1 areas of concern

B. The audit report, with the findings section left blank

C. A sampling plan, and forms for recording evidence and raising nonconformities

D. The certification recommendation, to be confirmed or withdrawn after the audit

None

Time's up

Where do marks actually go in Domain 3 of the ISO 27001 Lead Auditor exam?

Four errors account for most of them.

• Treating Stage 1 as a formality. It is a genuine checkpoint with defined outputs, and the one candidates forget is the decision it exists to take. A significant gap found there can delay or stop Stage 2.
• Treating Stage 1 as a small Stage 2. Stage 1 reviews documented information. Stage 2 tests whether the system works in practice. Options that put live evidence-gathering into Stage 1 are wrong for that reason.
• Basing audit time on the wrong thing. Audit time is driven by the effective number of personnel in scope, together with scope, complexity and sites, then adjusted for risk. It is not driven by the number of controls, documents or incidents.
• Writing a flat plan. A risk-based Stage 2 plan does not give every area the same time, and a checklist earns its place by asking something that can actually be tested, rather than by repeating the heading of the clause it came from.

There is a fifth that is really a Domain 2 principle showing up here: an auditor who helps the auditee fix a gap has crossed into consultancy, and a certification body must not provide consultancy to an organisation it certifies.

Domain 3 questions almost always resolve to one question: is this a Stage 1 activity or a Stage 2 activity? Get that boundary clear and most of the domain follows.

The other habit worth building is asking what a plan is for. It schedules the work; it does not confine the audit. You still follow audit trails wherever the evidence leads.

Frequently asked questions about ISO 27001 Lead Auditor Domain 3 practice questions

Where to go next: more ISO 27001 Lead Auditor exam preparation

Planning is the last of the three small domains. Next is the one that decides most results:

• Domain 1 practice questions — concepts and principles, 6 questions, 8 marks.
• Domain 2 practice questions — audit concepts and auditor responsibilities, 6 questions, 8 marks.
• Domain 4 practice questions — conducting the audit, 14 scenario questions, 36 marks.
• The sample exam questions and answers — ten questions weighted across all five domains, if you want a spread rather than a domain.

The complete CQI IRCA ISO 27001 Lead Auditor exam guide covers the format, the timing and how the sitting itself works.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.