Academy module 6 · ISO/IEC 27001 · Lesson 6 of 8
Measure performance and audit the system
About 12 minutes · Introductory draft · Checked 2026-10-24
AI-authored and AI editorially reviewed; independent review pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Audit compares evidence with criteria; a dashboard needs a denominator.
Explore the anchors
Define the claim and assessment basis.
Concept matching activity
Match this task or description to its concept:
Collect appropriate records and observations.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What you will learn
- Define the claim and assessment basis.
- Collect appropriate records and observations.
- State findings coverage and limits.
Concepts and distinctions
Monitoring and measurement should support decisions about the ISMS. A percentage needs a defined population, period and collection method. “All controls passed” can describe two sampled items out of hundreds. Distinguish completion measures, such as training delivered, from evidence that the intended behavior or security outcome occurred.
Internal audit evaluates the management system against defined criteria using appropriate evidence. Auditors need competence and suitable impartiality in the assignment. A checklist helps organize work but cannot substitute for understanding the process, sample selection and evidence limitations. A missing record may reveal a control failure, an evidence-management problem or a scope misunderstanding; investigate before writing a conclusion.
Apply the process and collect evidence
Plan audit scope and methods around risk, significance, previous results and changes. Trace observations to the applicable criterion and describe both the condition and its consequence. Agree action ownership without letting the auditor silently become the process owner. Report sampling limitations and follow up on findings with evidence that changes were implemented and effective.
Evidence quality, findings and report review
Compare criteria, objective evidence and the observed gap before writing a finding. Suppose a policy requires quarterly privileged-access review, but the responsible owner cannot provide evidence for the last two periods. State the relevant criterion, the records and interviews examined, and the unsupported requirement. Avoid claiming that every account is compromised or that absence of one record proves an incident occurred. Corroborate evidence and disclose sampling limitations.
Distinguish a nonconformity from an improvement suggestion. Apply the agreed classification scheme and certification-body rules where relevant; severity is not an arbitrary personal label. Report scope, objectives, criteria, dates, evidence basis, findings, conclusions and limitations. Quality review checks traceability and consistency before release. Restrict access to workpapers, retain them under an agreed policy and protect confidential client information. A dashboard, monitoring log or test result supports a finding only when its provenance and relevance are established.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
A review reports a 100% success rate after checking five low-risk accounts from a population of 400, while privileged identities were not sampled.
Compare your reasoning
The tested items may have passed, but the report must identify the sample and coverage limitations. Do not infer effectiveness for untested privileged accounts. Revisit the sampling approach and risk priorities before concluding that access control works across the population.
Remember
- Audit compares evidence with criteria; a dashboard needs a denominator.
- Define the claim and assessment basis.
- State findings coverage and limits.
Orientation and further reading
- ISO: ISO/IEC 27001:2022 with Amd 1:2024 context
- ISO: guidance for auditing management systems (public overview)
Original examples and explanations. Background references do not establish complete exam coverage.
Try ISO/IEC 27001 practice questions · Report a content correction