Academy learning group 3 · Academy module (not an ISO clause) M06 · Chapter 6 of 8
Measure performance and audit the system
About 6 minutes · ISO/IEC 27001:2022 with Amd 1:2024 context
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Audit compares evidence with criteria; a dashboard needs a denominator.
Explore the anchors
Define the claim and assessment basis.
Concept matching activity
Match this task or description to its concept:
Collect appropriate records and observations.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and distinctions
- Apply the process and collect evidence
- Evidence quality, findings and report review
Concepts and distinctions
Monitoring and measurement should support decisions about the ISMS. A percentage needs a defined population, period and collection method. “All controls passed” can describe two sampled items out of hundreds. Distinguish completion measures, such as training delivered, from evidence that the intended behavior or security outcome occurred.
Internal audit evaluates the management system against defined criteria using appropriate evidence. Auditors need competence and suitable impartiality in the assignment. A checklist helps organize work but cannot substitute for understanding the process, sample selection and evidence limitations. A missing record may reveal a control failure, an evidence-management problem or a scope misunderstanding; investigate before writing a conclusion.
Apply the process and collect evidence
Plan audit scope and methods around risk, significance, previous results and changes. Trace observations to the applicable criterion and describe both the condition and its consequence. Agree action ownership without letting the auditor silently become the process owner. Report sampling limitations and follow up on findings with evidence that changes were implemented and effective.
Evidence quality, findings and report review
Compare criteria, objective evidence and the observed gap before writing a finding. Suppose a policy requires quarterly privileged-access review, but the responsible owner cannot provide evidence for the last two periods. State the relevant criterion, the records and interviews examined, and the unsupported requirement. Avoid claiming that every account is compromised or that absence of one record proves an incident occurred. Corroborate evidence and disclose sampling limitations.
Distinguish a nonconformity from an improvement suggestion. Apply the agreed classification scheme and certification-body rules where relevant; severity is not an arbitrary personal label. Report scope, objectives, criteria, dates, evidence basis, findings, conclusions and limitations. Quality review checks traceability and consistency before release. Restrict access to workpapers, retain them under an agreed policy and protect confidential client information. A dashboard, monitoring log or test result supports a finding only when its provenance and relevance are established.
| Audit reasoning step | Worked example |
|---|---|
| Criterion | The approved access policy requires a quarterly review. |
| Evidence | No review records for two sampled periods; owner confirms omission. |
| Finding | The sampled review requirement was not fulfilled. |
| Limitation | This does not establish that every account was misused. |
Worked example
A review reports a 100% success rate after checking five low-risk accounts from a population of 400, while privileged identities were not sampled. The tested items may have passed, but the report must identify the sample and coverage limitations. Do not infer effectiveness for untested privileged accounts. Revisit the sampling approach and risk priorities before concluding that access control works across the population.
Check your understanding
What is the most accurate way to report five passing samples from 400 accounts?
Show explanation
State the sample outcome population selection method and coverage limits. The result supports only a conclusion justified by the evidence and sampling approach.
Source and study boundary
Official standard overview. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.