PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

The correct answer is Option C, as it best upholds objectivity and impartiality while allowing the internal audit to proceed effectively.

ISO/IEC 27001:2022 Clause 9.2 – Internal audit requires that audits be conducted in a manner that ensures objectivity and impartiality. This requirement is further reinforced by ISO 19011, which states that auditors should not audit their own work and should avoid conflicts of interest.

In this scenario, the auditor:

Held daily operational responsibilities in the IT Department just three months ago.

Is now asked to audit the same department.

Although job descriptions clearly distinguish past and present roles, the risk of perceived or actual bias remains high due to the short time elapsed. A common best practice is a cooling-off period (often around one year), but ISO standards do not mandate a fixed duration.

Option A is incorrect because clear job descriptions alone do not eliminate bias risk.

Option B is too rigid; ISO/IEC 27001 does not mandate a one-year cooling-off period.

By conducting the audit jointly with a colleague from another department, the organization:

Preserves audit independence,

Introduces an objective perspective,

Mitigates conflict-of-interest concerns,

Remains compliant with Clause 9.2 and ISO 19011 guidance

ISO/IEC 27001:2022 is the certifiable standard for Information Security Management Systems (ISMS). While ISO/IEC 27002 provides guidelines and best practices to help organizations implement the controls listed in Annex A of ISO/IEC 27001, it is not mandatory to follow ISO/IEC 27002 to achieve ISO/IEC 27001 certification. Instead, organizations must select and implement appropriate controls from Annex A, or other controls as necessary, based on their risk assessment. ISO/IEC 27002 serves as guidance but is not itself an auditable or certifiable requirement.

"The controls listed in Annex A are not exhaustive and additional controls may be needed. ISO/IEC 27002 provides implementation guidance and is not mandatory for certification against ISO/IEC 27001."

— ISO/IEC 27001:2022, Introduction and Clause 6.1.3; ISO/IEC 27002:2022, Foreword