This Lead Auditor sample turns the payroll case into audit work: selecting criteria, corroborating evidence and evaluating whether security processes operate as described. Reveal each answer to see the reasoning and why the other options fail.
What this exact sample covers
ISMS evidence, sampling and findings
Objective evidence
Risk-based sampling
Criteria and findings
Question 01Domain 1 · recall
Which audit response best evaluates confidentiality, integrity and availability in the payroll incident?
ASet suitable criteria, obtain sufficient appropriate evidence and document the conclusion for confidentiality, integrity and availability.
BAccept management explanation without corroborating evidence when reviewing confidentiality, integrity and availability.
CTake ownership of the auditee process and design the corrective action on management behalf.
the answer and reasoning
Correct answerA. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for confidentiality, integrity and availability.
The stronger response connects confidentiality, integrity and availability to a defined purpose, accountable action and usable evidence. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for confidentiality, integrity and availability. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response best tests asset ownership rather than accepting the asset register alone?
AAccept management explanation without corroborating evidence when reviewing information assets and asset ownership.
BSet suitable criteria, obtain sufficient appropriate evidence and document the conclusion for information assets and asset ownership.
CTake ownership of the auditee process and design the corrective action on management behalf.
the answer and reasoning
Correct answerB. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for information assets and asset ownership.
The stronger response connects information assets and asset ownership to a defined purpose, accountable action and usable evidence. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for information assets and asset ownership. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response best corroborates evidence about threats, vulnerabilities and consequences?
AAccept management explanation without corroborating evidence when reviewing threats, vulnerabilities and consequences.
BTake ownership of the auditee process and design the corrective action on management behalf.
CSet suitable criteria, obtain sufficient appropriate evidence and document the conclusion for threats, vulnerabilities and consequences.
the answer and reasoning
Correct answerC. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for threats, vulnerabilities and consequences.
The stronger response connects threats, vulnerabilities and consequences to a defined purpose, accountable action and usable evidence. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for threats, vulnerabilities and consequences. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
Which response best evaluates whether information-security risk is assessed consistently?
ASet suitable criteria, obtain sufficient appropriate evidence and document the conclusion for information-security risk.
BAccept management explanation without corroborating evidence when reviewing information-security risk.
CTake ownership of the auditee process and design the corrective action on management behalf.
the answer and reasoning
Correct answerA. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for information-security risk.
The stronger response connects information-security risk to a defined purpose, accountable action and usable evidence. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for information-security risk. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response best audits the operation of preventive, detective and corrective controls?
AAccept management explanation without corroborating evidence when reviewing preventive, detective and corrective controls.
BSet suitable criteria, obtain sufficient appropriate evidence and document the conclusion for preventive, detective and corrective controls.
CTake ownership of the auditee process and design the corrective action on management behalf.
the answer and reasoning
Correct answerB. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for preventive, detective and corrective controls.
The stronger response connects preventive, detective and corrective controls to a defined purpose, accountable action and usable evidence. Set suitable criteria, obtain sufficient appropriate evidence and document the conclusion for preventive, detective and corrective controls. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Casual mode shows feedback as you answer. Full access adds the complete weighted bank, exam mode, saved results and domain-level analysis for this exact qualification.
