[Oct 29, 2026] Valid ISO-IEC-27001-Lead-Auditor Test Answers Full-length Practice Certification Exams [Q229-Q247]

Rate this post

[Oct 29, 2026] Valid ISO-IEC-27001-Lead-Auditor Test Answers Full-length Practice Certification Exams

Accurate & Verified 2026 New ISO-IEC-27001-Lead-Auditor Answers As Experienced in the Actual Test!

PECB ISO-IEC-27001-Lead-Auditor Exam Syllabus Topics:

Section	Weight	Objectives
Fundamental Concepts of Information Security	15%	– Overview of ISO/IEC 27000 family of standards 1. Relationship between ISO/IEC 27001 and other standards 2. Structure and scope of ISO/IEC 27000 series – Information security principles and definitions 1. Risk management fundamentals 2. Confidentiality, integrity, availability
Auditing Principles and Practices	30%	– Audit reporting and follow-up 1. Structure and content of audit report 2. Corrective action verification and closure – Audit preparation and planning 1. Defining audit scope, criteria and methodology 2. Development of audit plan and checklist – Audit concepts and principles 1. Independence, objectivity and evidence-based approach 2. Audit types and objectives – Audit execution 1. Conducting interviews and document reviews 2. Identifying nonconformities and opportunities for improvement 3. Collecting and verifying audit evidence
Requirements of ISO/IEC 27001:2022	30%	– General requirements and ISMS scope definition 1. Understanding the organization and its context 2. Determining ISMS boundaries and applicability – Leadership and planning 1. Management commitment and policy establishment 2. Information security objectives and risk treatment planning – Support, operation, performance evaluation and improvement 1. Internal audit and management review 2. Resource management and competence 3. Corrective action and continual improvement
Information Security Controls (ISO/IEC 27002:2022)	25%	– Control categories and implementation guidance 1. Technological controls 2. Physical controls 3. People controls 4. Organizational controls

NO.229 You are conducting an ISMS audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices. Parcels typically contain pharmaceutical products, biological samples, and documents such as passports and driving licences. You note that the company records show a very large number of returned items with causes including misaddressed labels and, in 15% of cases, two or more labels for different addresses for the one package. You are interviewing the Shipping Manager (SM).
You: Are items checked before being dispatched?
SM: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process.
You: What action is taken when items are returned?
SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.
You raise a nonconformity against ISO 27001:2022 based on the lack of control of the labelling process.
At the closing meeting, the Shipping Manager issues an apology to you that his comments may have been misunderstood. He says that he did not realise that there is a background IT process that automatically checks that the right label goes onto the right parcel otherwise the parcel is ejected at labelling. He asks that you withdraw your nonconformity.
Select three options of the correct responses that you as the audit team leader would make to the request of the Shipping Manager.

Advise the Shipping Manager that his request will be included in the audit report

Advise management that the new information provided will be discussed when the auditors have more time

Inform the Shipping Manager that the nonconformity is minor and should be quickly corrected

Ask the audit team members to state what they think should happen

Inform him of your understanding and withdraw the nonconformity

Thank the Shipping Manager for his honesty but advise that withdrawing the nonconformity is not the right way to proceed

Advise the Shipping Manager that the nonconformity must stand since the evidence obtained for it was dear

Indicate that the nonconformity is evidence of a deeper system failure that needs to be rectified

NO.230 You are conducting an ISMS audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices. Parcels typically contain pharmaceutical products, biological samples, and documents such as passports and driving licences. You note that the company records show a very large number of returned items with causes including misaddressed labels and, in 15% of cases, two or more labels for different addresses for the one package. You are interviewing the Shipping Manager (SM).
You: Are items checked before being dispatched?
SM: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process.
You: What action is taken when items are returned?
SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.
You raise a nonconformity. Referencing the scenario, which three of the following Annex A controls would you expect the auditee to have implemented when you conduct the follow-up audit?

5.11 Return of assets

5.13 Labelling of information

5.3 Segregation of duties

5.32 Intellectual property rights

5.34 Privacy and protection of personal identifiable information (PII)

5.6 Contact with special interest groups

6.3 Information security awareness, education, and training

6.4 Disciplinary process

The three Annex A controls that you would expect the auditee to have implemented when you conduct the follow-up audit are:
B . 5.13 Labelling of information
E . 5.34 Privacy and protection of personal identifiable information (PII) G . 6.3 Information security awareness, education, and training B . This control requires the organisation to label information assets in accordance with the information classification scheme, and to handle them accordingly12. This control is relevant for the auditee because it could help them to avoid misaddressing labels and sending parcels to wrong destinations, which could compromise the confidentiality, integrity, and availability of the information assets. By labelling the information assets correctly, the auditee could also ensure that they are delivered to the intended recipients and that they are protected from unauthorized access, use, or disclosure.
E . This control requires the organisation to protect the privacy and the rights of individuals whose personal identifiable information (PII) is processed by the organisation, and to comply with the applicable legal and contractual obligations13. This control is relevant for the auditee because it could help them to prevent the unauthorized use of residents’ personal data by a supplier, which could violate the privacy and the rights of the residents and their family members, and expose the auditee to legal and reputational risks. By protecting the PII of the residents and their family members, the auditee could also enhance their trust and satisfaction, and avoid complaints and disputes.
G . This control requires the organisation to ensure that all employees and contractors are aware of the information security policy, their roles and responsibilities, and the relevant information security procedures and controls14. This control is relevant for the auditee because it could help them to improve the information security culture and behaviour of their staff, and to reduce the human errors and negligence that could lead to information security incidents. By providing information security awareness, education, and training to their staff, the auditee could also increase their competence and performance, and ensure the effectiveness and efficiency of the information security processes and controls.
Reference:
1: ISO/IEC 27001:2022 – Information technology – Security techniques – Information security management systems – Requirements, Annex A 2: ISO/IEC 27002:2022 – Information technology – Security techniques – Code of practice for information security controls, clause 8.2.1 3: ISO/IEC 27002:2022 – Information technology – Security techniques – Code of practice for information security controls, clause 18.1.4 4: ISO/IEC 27002:2022 – Information technology – Security techniques – Code of practice for information security controls, clause 7.2.2

NO.231 Which department maintain’s contacts with law enforcement authorities, regulatory bodies, information service providers and telecommunications service providers depending on the service required.

COO

CISO

CSM

MRO

NO.232 What is the security management term for establishing whether someone’s identity is correct?

Identification

Authentication

Authorisation

Verification

NO.233 You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security incident management process. The IT Security Manager presents the information security incident management procedure and explains that the process is based on ISO/IEC 27035-1:2016.
You review the document and notice a statement “any information security weakness, event, and incident should be reported to the Point of Contact (PoC) within 1 hour after identification”. When interviewing staff, you found that there were differences in the understanding of the meaning of “weakness, event, and incident”.
You sample incident report records from the event tracking system for the last 6 months with summarized results in the following table.

You would like to further investigate other areas to collect more audit evidence. Select two options that will not be in your audit trail.

Collect more evidence on how and when the Human Resources manager pays the ransom fee to unlock personal mobile data, i.e., credit card, and bank transfer. (Relevant to control A.5.26)

Collect more evidence on what the service requirements of healthcare monitoring are. (Relevant to clause 4.2)

Collect more evidence on how the organization determined no further action was needed after the incident. (Relevant to control A.5.26)

Collect more evidence on how the organisation determined the incident recovery time. (Relevant to control A.5.27)

Collect more evidence on the incident recovery procedures. (Relevant to control A.5.26)

Collect more evidence by interviewing more staff about their understanding of the reporting process.
(Relevant to control A.6.8)

Collect more evidence on how and when the company pays the ransom fee to unlock the company’s mobile phone and data, i.e., credit card, and bank transfer. (Relevant to control A.5.26)

NO.234 You are an experienced ISMS audit team leader providing guidance to an ISMS auditor in training. They have been asked to carry out an assessment of external providers and have prepared a checklist containing the following activities. They have asked you to review their checklist to confirm that the actions they are proposing are appropriate.
The audit they have been invited to participate in is a third-party surveillance audit of a data centre . The data centre agent is part of a wider telecommunication group. Each data centre within the group operates its own ISMS and holds its own certificate.
Select three options that relate to ISO/IEC 27001:2022’s requirements regarding external providers.

I will check the other data centres are treated as external providers, even though they are part of the same telecommunication group

I will ensure external providers have a documented process in place to notify the organisation of any risks arising from the use of its products or services

I will ensure that the organisation has a reserve external provider for each process it has identified as critical to preservation of the confidentiality, integrity and accessibility of its information

I will limit my audit activity to externally provided processes as there is no need to audit externally provided products of services

I will ensure the organization is regularly monitoring, reviewing and evaluating external provider performance

I will ensure the organization is has determined the need to communicate with external providers regarding the ISMS

I will ensure that top management have assigned roles and responsibilities for those providing external ISMS processes as well as internal ISMS processes

I will ensure that the organisation ranks its external providers and allocates the majority of its work to those providers who are rated the highest

Explanation
A: I will check the other data centres are treated as external providers, even though they are part of the same telecommunication group. This is appropriate because clause 8.1.4 of ISO 27001:2022 requires the organisation to ensure that externally provided processes, products or services that are relevant to the information security management system are controlled. Externally provided processes, products or services are those that are provided by any external party, regardless of the degree of its relationship with the organisation. Therefore, the other data centres within the same telecommunication group should be treated as external providers and subject to the same controls as any other external provider12 B: I will ensure external providers have a documented process in place to notify the organisation of any risks arising from the use of its products or services. This is appropriate because clause 8.1.4 of ISO
27001:2022 requires the organisation to implement appropriate contractual requirements related to information security with external providers. One of the contractual requirements could be the obligation of the external provider to notify the organisation of any risks arising from the use of its products or services, such as security incidents, vulnerabilities, or changes that could affect the information security of the organisation. The external provider should have a documented process in place to ensure that such notification is timely, accurate, and complete12 E: I will ensure the organisation is regularly monitoring, reviewing and evaluating external provider performance. This is appropriate because clause 8.1.4 of ISO 27001:2022 requires the organisation to monitor, review and evaluate the performance and effectiveness of the externally provided processes, products or services. The organisation should have a process in place to measure and verify the conformity and suitability of the external provider’s deliverables and activities, and to provide feedback and improvement actions as necessary. The organisation should also maintain records of the monitoring, review and evaluation results12 F: I will ensure the organisation has determined the need to communicate with external providers regarding the ISMS. This is appropriate because clause 7.4.2 of ISO 27001:2022 requires the organisation to determine the need for internal and external communications relevant to the information security management system, including the communication with external providers. The organisation should define the purpose, content, frequency, methods, and responsibilities for such communication, and ensure that it is consistent with the information security policy and objectives. The organisation should also retain documented information of the communication as evidence of its implementation12 The following activities are not appropriate for the assessment of external providers according to ISO
27001:2022:
C: I will ensure that the organisation has a reserve external provider for each process it has identified as critical to preservation of the confidentiality, integrity and accessibility of its information. This is not appropriate because ISO 27001:2022 does not require the organisation to have a reserve external provider for each critical process. The organisation may choose to have a contingency plan or a backup solution in case of failure or disruption of the external provider, but this is not a mandatory requirement. The organisation should assess the risks and opportunities associated with the external provider and determine the appropriate treatment options, which may or may not include having a reserve external provider12 D: I will limit my audit activity to externally provided processes as there is no need to audit externally provided products or services. This is not appropriate because clause 8.1.4 of ISO 27001:2022 requires the organisation to control the externally provided processes, products or services that are relevant to the information security management system. Externally provided products or services may include software, hardware, data, or cloud services that could affect the information security of the organisation. Therefore, the audit activity should cover both externally provided processes and products or services, as applicable12 G: I will ensure that top management have assigned roles and responsibilities for those providing external ISMS processes as well as internal ISMS processes. This is not appropriate because clause 5.3 of ISO 27001:2022 requires the top management to assign the roles and responsibilities for the information security management system within the organisation, not for the external providers. The external providers are responsible for assigning their own roles and responsibilities for the processes, products or services they provide to the organisation. The organisation should ensure that the external providers have adequate competence and awareness for their roles and responsibilities, and that they are contractually bound to comply with the information security requirements of the organisation12 H: I will ensure that the organisation ranks its external providers and allocates the majority of its work to those providers who are rated the highest. This is not appropriate because ISO 27001:2022 does not require the organisation to rank its external providers or to allocate its work based on such ranking. The organisation may choose to evaluate and compare the performance and effectiveness of its external providers, but this is not a mandatory requirement. The organisation should select and use its external providers based on the information security criteria and objectives that are relevant to the organisation12 References:
1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2

NO.235 A well-executed risk analysis provides a great deal of useful information. A risk analysis has four main objectives.
What is not one of the four main objectives of a risk analysis?

Identifying assets and their value

Implementing counter measures

Establishing a balance between the costs of an incident and the costs of a security measure

Determining relevant vulnerabilities and threats

NO.236 The scope of an organization certified against ISO/IEC 27001 states that they provide editing and web hosting services. However, due to some changes in the organization, the technical support related to the web hosting services has been outsourced. Should a change in the scope be initiated in this case?

Yes, because any change in the external environment initiates a change in the scope

No, because the change does not require implementation of new security controls

No, because the organization is already certified for its editing and web hosting services

NO.237 You are conducting an ISMS audit. The next step in your audit plan is to verify that the organisation’s information security risk treatment plan has been established and implemented properly. You decide to interview the IT security manager.
You: Can you please explain how the organisation performs its information security risk assessment and treatment process?
IT Security Manager: We follow the information security risk management procedure which generates a risk treatment plan.
Narrator: You review risk treatment plan No. 123 relating to the planned installation of an electronic (invisible) fence to improve the physical security of the nursing home. You found the risk treatment plan was approved by IT Security Manager.
You: Who is responsible for physical security risks?
IT Security Manager: The Facility Manager is responsible for the physical security risk. The IT department helps them to monitor the alarm. The Facility Manager is authorized to approve the budget for risk treatment plan No. 123.
You: What residual information security risks exist after risk treatment plan No. 123 was implemented?
IT Security Manager: There is no information for the acceptance of residual information security risks as far as I know.
You prepare your audit findings. Select three options for findings that are justified in the scenario.

Nonconformity (NC) – The information for the acceptance of residual information security risks should be updated after the risk treatment is implemented. Clause 6.1.3.f

There is an opportunity for improvement (OI) to conduct security checks on the perimetre fence

There is an opportunity for improvement (OI) once the Electronic (invisible) fence is installed. Residents’ physical security is improved

Nonconformity (NC) – Top management must ensure that the resources needed for the ISMS are available. Clause 5.1.c

Nonconformity (NC) – The IT security manager should be aware of and understand his authority and area of responsibility. Clause 7.3

Nonconformity (NC) – The organization should provide the resources needed for the continual improvement of the ISMS. Clause 7.1

Nonconformity (NC) – The risk treatment plan No. 123 should be approved by the risk owner, the Facility Manager in this case. Clause 6.1.3.f

It is good practice to adopt state-of-the-art technology as part of the continual improvement process

The three options for findings that are justified in the scenario are:
* Nonconformity (NC) – The information for the acceptance of residual information security risks should be updated after the risk treatment is implemented. Clause 6.1.3.f
* Nonconformity (NC) – The IT security manager should be aware of and understand his authority and area of responsibility. Clause 7.3
* Nonconformity (NC) – The risk treatment plan No. 123 should be approved by the risk owner, the Facility Manager in this case. Clause 6.1.3.f According to ISO/IEC 27001:2022, clause 6.1.3.f, the organisation must retain documented information that includes the information for the acceptance of residual information security risks, and the approval of the risk treatment plan by the risk owner1. Therefore, option A and G are justified as nonconformities, because the organisation failed to update the information for the acceptance of residual risks, and the risk treatment plan was approved by the IT security manager, who is not the risk owner.
According to ISO/IEC 27001:2022, clause 7.3, the organisation must ensure that the persons assigned to perform the roles and responsibilities for the ISMS are competent, and are aware of the consequences of not conforming to the ISMS requirements2. Therefore, option E is justified as a nonconformity, because the IT security manager, who is responsible for the information security risk management process, was not aware of his authority and area of responsibility.
The other options are not justified as findings, because they are either irrelevant or incorrect. For example:
* Option B is irrelevant, because it is not related to the information security risk treatment plan No. 123, which is the focus of the audit.
* Option C is incorrect, because it is not an opportunity for improvement, but rather a benefit of the risk treatment plan No. 123, which is already implemented.
* Option D is incorrect, because it is not a nonconformity, but rather a requirement for the organisation to provide the resources needed for the ISMS, which is not the same as the resources needed for the risk treatment plan No. 123.
* Option F is incorrect, because it is not a nonconformity, but rather a requirement for the organisation to provide the resources needed for the continual improvement of the ISMS, which is not the same as the resources needed for the risk treatment plan No. 123.
* Option H is irrelevant, because it is not a finding, but rather a good practice, which is not the objective of the audit.

NO.238 Who are allowed to access highly confidential files?

Employees with a business need-to-know

Contractors with a business need-to-know

Employees with signed NDA have a business need-to-know

Non-employees designated with approved access and have signed NDA

NO.239 Scenario 5: Cobt. an insurance company in London, offers various commercial, industrial, and life insurance solutions. In recent years, the number of Cobt’s clients has increased enormously. Having a huge amount of data to process, the company decided that certifying against ISO/IEC 27001 would bring many benefits to securing information and show its commitment to continual improvement. While the company was well- versed in conducting regular risk assessments, implementing an ISMS brought major changes to its daily operations. During the risk assessment process, a risk was identified where significant defects occurred without being detected or prevented by the organizations internal control mechanisms.
The company followed a methodology to implement the ISMS and had an operational ISMS in place after only a few months After successfully implementing the ISMS, Cobt applied for ISO/IEC 27001 certification Sarah, an experienced auditor, was assigned to the audit Upon thoroughly analyzing the audit offer, Sarah accepted her responsibilities as an audit team leader and immediately started to obtain general information about Cobt She established the audit criteria and objective, planned the audit, and assigned the audit team members’ responsibilities.
Sarah acknowledged that although Cobt has expanded significantly by offering diverse commercial and insurance solutions, it still relies on some manual processes Therefore, her initial focus was to gather information on how the company manages its information security risks Sarah contacted Cobt’s representatives to request access to information related to risk management for the off-site review, as initially agreed upon for part of the audit However, Cobt later refused, claiming that such information is too sensitive to be accessed outside of the company This refusal raised concerns about the audit’s feasibility, particularly regarding the availability and cooperation of the auditee and access to evidence Moreover, Cobt raised concerns about the audit schedule, stating that it does not properly reflect the recent changes the company made It pointed out that the actions to be performed during the audit apply only to the initial scope and do not encompass the latest changes made in the audit scope Sarah also evaluated the materiality of the situation, considering the significance of the information denied for the audit objectives. In this case, the refusal by Cobt raised questions about the completeness of the audit and its ability to provide reasonable assurance. Following these situations, Sarah decided to withdraw from the audit before a certification agreement was signed and communicated her decision to Cobt and the certification body. This decision was made to ensure adherence to audit principles and maintain transparency, highlighting her commitment to consistently upholding these principles.
Based on the scenario above, answer the following question:
Question:
Based on the role of Sarah described in Scenario 5, which of the following should NOT be part of her responsibilities?

Assigning responsibilities to the audit team members

Defining the audit criteria and objectives

Planning the audit

NO.240 Which of the following factors does NOT contribute to the value of data for an organisation?

The correctness of data

The indispensability of data

The importance of data for processes

The content of data

NO.241 Below is Purpose of “Integrity”, which is one of the Basic Components of Information Security

the property that information is not made available or disclosed to unauthorized individuals

the property of safeguarding the accuracy and completeness of assets.

the property that information is not made available or disclosed to unauthorized individuals

the property of being accessible and usable upon demand by an authorized entity.

NO.242 You are an experienced ISMS audit team leader conducting a third-party surveillance audit of an internet services provider. You are reviewing the organization’s risk assessment processes for conformity with ISO/IEC 27001:2022.
Which three of the following audit findings would prompt you to raise a nonconformity report?

Both systems contain additional information security risks which are not associated with preserving the confidentiality, integrity and accessibility of information

The organisation is treating information security risks in the order in which they are identified

The organisation’s information security risk assessment process suggests each risk is allocated a risk owner

The organisation has not used RAG (Red, Amber, Green) to classify its’ information security risks. Instead, it has used a smiling emoji, a neutral face emoji and a sad face emoji

The organisation’s risk assessment criteria have not been reviewed and approved by top management

The organisation’s information security risk assessment process is based solely on an assessment of the impact of each risk

The organisation has assessed the probability of all of its information security risks as either 0%, 25%, 50%, 75% or 100%

There is a different system in place for assessing operational information security risks and for assessing strategic information security risks

The three audit findings that would prompt you to raise a nonconformity report are:
* The organisation is treating information security risks in the order in which they are identified
* The organisation’s risk assessment criteria have not been reviewed and approved by top management
* The organisation’s information security risk assessment process is based solely on an assessment of the impact of each risk According to ISO/IEC 27001:2022, clause 6.1.2, the organisation must establish and maintain an information security risk management process that is consistent with the organisation’s context and aligned with its overall risk management approach1. This process must include the following steps:
* Establishing the risk assessment criteria, which must be approved by top management and reflect the organisation’s risk appetite and objectives2
* Identifying the information security risks, which must consider the assets, threats, vulnerabilities, impacts, and likelihoods3
* Analysing the information security risks, which must determine the levels of risk and compare them with the risk criteria4
* Evaluating the information security risks, which must prioritise the risks and decide whether they need treatment or not5 Therefore, the audit findings B, E, and F indicate that the organisation is not following the required steps of the information security risk management process, and thus are nonconformities with the standard.
The other audit findings are not necessarily nonconformities, as they may be acceptable depending on the organisation’s context and justification. For example:
* Audit finding A may be acceptable if the organisation has identified and treated the additional information security risks that are relevant to its scope and objectives, and has documented the rationale for doing so6
* Audit finding C may be acceptable if the organisation has assigned clear roles and responsibilities for the information security risk management process, and has ensured that the risk owners have the authority and competence to manage the risks7
* Audit finding D may be acceptable if the organisation has defined and communicated the meaning and implications of the emoji-based risk classification, and has ensured that it is consistent with the risk criteria and the risk treatment process8
* Audit finding G may be acceptable if the organisation has justified the use of discrete values for the probability of the information security risks, and has ensured that they are realistic and consistent with the risk criteria and the risk analysis method9
* Audit finding H may be acceptable if the organisation has established and maintained different systems for assessing operational and strategic information security risks, and has ensured that they are integrated and aligned with the overall risk management approach and the ISMS objectives10

NO.243 The following are the guidelines to protect your password, except:

Don’t use the same password for various company system security access

Do not share passwords with anyone

For easy recall, use the same password for company and personal accounts

Change a temporary password on first log-on

NO.244 Which reliability aspect of information is compromised when a staff member denies having sent a message?

Confidentiality

Integrity

Availability

Correctness

NO.245 Auditor competence is a combination of knowledge and skills. Which two of the following activities are predominately related to “knowledge”?

Understanding how to identify findings

Designing a checklist

Follow an audit trail deviating from the prepared checklist

Communicate with the auditee

Determining how to seek evidence from the auditee

Determining what evidence to gather

NO.246 A fire breaks out in a branch office of a health insurance company. The personnel are transferred to neighboring branches to continue their work.
Where in the incident cycle is moving to a stand-by arrangements found?

between threat and incident

between recovery and threat

between damage and recovery

between incident and damage

NO.247 Scenario 9: UpNet, a networking company, has been certified against ISO/IEC 27001. It provides network security, virtualization, cloud computing, network hardware, network management software, and networking technologies.
The company’s recognition has increased drastically since gaining ISO/IEC 27001 certification. The certification confirmed the maturity of UpNefs operations and its compliance with a widely recognized and accepted standard.
But not everything ended after the certification. UpNet continually reviewed and enhanced its security controls and the overall effectiveness and efficiency of the ISMS by conducting internal audits. The top management was not willing to employ a full-time team of internal auditors, so they decided to outsource the internal audit function. This form of internal audits ensured independence, objectivity, and that they had an advisory role about the continual improvement of the ISMS.
Not long after the initial certification audit, the company created a new department specialized in data and storage products. They offered routers and switches optimized for data centers and software-based networking devices, such as network virtualization and network security appliances. This caused changes to the operations of the other departments already covered in the ISMS certification scope.
Therefore. UpNet initiated a risk assessment process and an internal audit. Following the internal audit result, the company confirmed the effectiveness and efficiency of the existing and new processes and controls.
The top management decided to include the new department in the certification scope since it complies with ISO/IEC 27001 requirements. UpNet announced that it is ISO/IEC 27001 certified and the certification scope encompasses the whole company.
One year after the initial certification audit, the certification body conducted another audit of UpNefs ISMS. This audit aimed to determine the UpNefs ISMS fulfillment of specified ISO/IEC 27001 requirements and ensure that the ISMS is being continually improved. The audit team confirmed that the certified ISMS continues to fulfill the requirements of the standard. Nonetheless, the new department caused a significant impact on governing the management system. Moreover, the certification body was not informed about any changes. Thus, the UpNefs certification was suspended.
Based on the scenario above, answer the following question:
UpNet ensured independence, objectivity, and advisory activities from the internal audit. Is this action acceptable?

Yes, because internal audits have an advisory role

No, because internal audits should be independent of the audited activities

No, because the internal audit function was outsourced