ISO 27001 LA Domain 5: Conducting an ISO/IEC 27001 Audit (22.5%)

Overview

Domain 5 covers the audit from the opening meeting to the point where findings are drafted. Its 17 knowledge statements include the opening meeting, Stage 1 and Stage 2 differences and activities, criteria for evaluating documented information, communication, guides and observers, conflict resolution, evidence collection and analysis, checklists, sampling methods, the audit plan in execution, working papers, test plans and the evaluation of evidence into findings.

Stage 1 evaluates the documented ISMS, scope, site conditions and readiness for Stage 2, while Stage 2 evaluates implementation and effectiveness, including risk treatment, controls, internal audit and management review. ISO 19011 clause 6.4 and ISO/IEC 17021-1 clause 9.3 describe these activities, and ISO/IEC 27007 adds ISMS-specific guidance. The domain expects you to collect enough reliable evidence, stay within the plan and the auditor's role, and handle people well.

Why it matters on the exam

This is the heaviest domain, with 18 of 80 questions, nearly a quarter of the exam. Most scenario-based items live here because conducting an audit is where theory meets awkward situations: an auditee who argues, a guide who answers for staff, a sample that turns up one exception, or a document that contradicts what people do. Candidates often lose marks by drawing conclusions too early, sampling only what the auditee offers, or treating Stage 1 as a full implementation audit. Knowing what belongs in Stage 1 versus Stage 2 alone answers several questions. Strong performance here also supports Domain 6, because findings that are poorly evidenced on site cannot be graded or reported well at closing.

How it's tested

Questions describe moments during fieldwork and ask what the auditor should do next or how to interpret evidence. Expect Stage 1 and Stage 2 distinctions, sampling choices, interview conduct and conflicts. The best option normally gathers or corroborates evidence, stays within the plan and treats the auditee fairly without giving advice.

Stage placement

An activity such as testing access reviews or confirming the scope statement must be placed in Stage 1 or Stage 2, or judged premature for the current stage.
Next evidence step

The auditor has partial or conflicting evidence and must choose the next action, usually corroboration, expanding a sample or tracing a record to its source.
People handling

A guide interferes, an interviewee becomes defensive or the auditee disputes a point; you choose the communication or conflict technique that keeps the audit objective.

Reasoning it through

In Stage 2 an auditor samples 25 user leavers and finds two accounts still active a month after departure. Options are to raise a major nonconformity, ignore it as minor, or investigate further. Reason: before grading, the auditor should understand extent and cause, perhaps by checking more leavers and the HR-to-IT process, then record a finding supported by the evidence against control 5.18 and the auditee's procedure.

Knowledge statements 17

Official knowledge statements from the PECB outline, in outline order.

5.1 Objectives and content of the opening meetingFormally starting the on-site audit.

What it means: The opening meeting, chaired by the team leader, confirms participants' agreement to the audit plan, introduces the team and roles, and ensures planned activities can be performed. Typical content covers objectives, scope, criteria, schedule, communication channels, confidentiality, safety, the reporting method, grading of findings and conditions for ending the audit early.
What to understand: Attendance is recorded and the auditee's management with responsibility for audited functions should take part. The meeting is also the auditee's chance to ask questions. Its formality depends on the audit; for small organizations it may be a short conversation, but the same points are covered.
How it shows up: Questions ask what is not typically part of the opening meeting, such as presenting preliminary findings, which belongs to closing.
Common confusion: Using the opening meeting to begin interviewing or reviewing records.

5.2 Difference between Stage 1 and Stage 2 auditsThe two-stage initial certification audit.

What it means: Stage 1 reviews the auditee's documented information, scope, understanding of requirements, key performance and risk areas, and whether internal audits and management review are planned or performed, to judge readiness. Stage 2 evaluates implementation and effectiveness of the ISMS, including controls, at the auditee's sites.
What to understand: Stage 1 findings that could be classified as nonconformities in Stage 2 are reported so the auditee can address them. The interval between stages allows resolution. Stage 2 cannot be planned properly without Stage 1 output. Under ISO/IEC 27006-1, part of Stage 1 is often on site.
How it shows up: A scenario has the Stage 1 auditor sampling firewall change tickets in detail; the question asks whether this fits Stage 1.
Common confusion: Treating Stage 1 as a pre-audit consultancy or as a full implementation test.

5.3 Requirements, steps and activities of a Stage 1 auditReadiness review and Stage 2 planning input.

What it means: Stage 1 activities include reviewing documented information such as scope, policy, risk methodology, risk assessment results, SoA and treatment plan, evaluating site-specific conditions, confirming the scope and legal requirements, reviewing resource allocation for Stage 2, and agreeing Stage 2 details.
What to understand: The output is a documented Stage 1 report identifying concerns that could be nonconformities at Stage 2 and confirming whether the auditee is ready. If serious gaps exist, such as no internal audit performed, Stage 2 may be postponed.
How it shows up: Questions ask what the auditor should do if Stage 1 shows no management review has occurred; the answer is to report it as an area of concern affecting Stage 2 readiness.
Common confusion: Issuing Stage 1 nonconformity reports that require formal corrective action plans before any Stage 2 is scheduled.

5.4 Criteria for evaluating documented information and the requirements of ISO/IEC 27001Reviewing documents for adequacy against requirements.

What it means: Documented information is evaluated for completeness, correctness, consistency and currency, and for conformity with ISO/IEC 27001. The auditor checks that mandatory documents exist, are approved, controlled under clause 7.5, and are consistent with each other.
What to understand: Review continues throughout the audit as documents are compared with practice. Inconsistencies, for example between the SoA and the risk treatment plan, are strong audit trails. Documentation volume is not a quality measure; small organizations may have little but adequate documentation.
How it shows up: An item gives a policy last reviewed three years ago with a stated annual review requirement; the auditor notes a conformity issue against the organization's own criteria.
Common confusion: Judging documents against the auditor's preferred style or length.

5.5 Requirements, steps and activities of a Stage 2 auditEvaluating implementation and effectiveness.

What it means: Stage 2 covers information and evidence about conformity with all requirements, performance monitoring against objectives, the management system's ability to meet legal and contractual requirements, operational control, internal audit, management review, management responsibility, and links between requirements, policy, objectives, performance and conclusions.
What to understand: For ISO/IEC 27001, Stage 2 tests the risk assessment and treatment in operation, the controls in the SoA on a sample basis, and the effectiveness of the ISMS in achieving objectives. Evidence must cover the full ISMS scope for initial certification.
How it shows up: Questions ask which activity best tests effectiveness, typically tracing incidents, measurement results or internal audit findings to actions taken.
Common confusion: Checking only that documents exist during Stage 2.

5.6 Best practices for communication during an auditKeeping the auditee and team informed.

What it means: Communication within the team and with the auditee should be agreed in advance and maintained throughout. The team meets periodically to exchange information, assess progress and reassign work. The team leader informs the auditee of progress and concerns, and reports evidence of immediate risk without delay.
What to understand: Good auditors use open questions, active listening, neutral language and explain the purpose of requests. If evidence suggests audit objectives cannot be met, the team leader reports to the client and auditee to agree action.
How it shows up: A question asks what the team leader should do when evidence shows an immediate significant risk, such as exposed customer data; report it to the auditee promptly.
Common confusion: Withholding concerns until the closing meeting to avoid conflict.

5.7 Roles and responsibilities of guides and observersPeople who accompany the audit team.

What it means: Guides are appointed by the auditee to assist the team, for example by establishing contacts, arranging access and providing safety information. Observers, such as regulators, trainees or accreditation assessors, accompany the team but do not take part in the audit.
What to understand: Neither guides nor observers should influence or interfere with the audit. If they do, the team leader has the right to deny their participation in certain activities. The guide may witness interviews for the auditee but should not answer questions on behalf of interviewees.
How it shows up: A guide keeps answering for a system administrator; the correct response is to politely ask the guide to let the interviewee answer.
Common confusion: Treating an accreditation body observer as part of the audit team.

5.8 Conflict resolution techniquesHandling disagreements during the audit.

What it means: Conflicts arise over findings, access, scope or timing. Techniques include collaborating to find a solution, compromising on schedule matters, accommodating minor requests, avoiding unnecessary confrontation, and firmness where criteria are at stake.
What to understand: Auditors can negotiate logistics but never the evidence or the criteria. Disputes over findings are resolved by reviewing evidence together; unresolved divergent opinions are recorded in the report. Calm, factual communication and escalation to the team leader help prevent breakdown.
How it shows up: An auditee manager angrily rejects a finding; the best response is to review the evidence and criteria with them and record any unresolved disagreement.
Common confusion: Withdrawing a well-evidenced finding to keep the peace.

5.9 Evidence collection procedures and tools: interviews, review of documented information, observation, analysis, sampling and technical verificationThe methods used to gather audit evidence.

What it means: Auditors gather evidence by interviewing people at appropriate levels, reviewing documents and records, observing activities and the workplace, analyzing data, sampling populations and verifying technical configurations. ISO 19011 Annex A describes on-site and remote methods.
What to understand: Combining methods gives stronger evidence: an interview explains the process, records show it was followed, observation confirms practice, and technical checks prove configuration. Remote methods need secure tools and agreed access. Auditors view systems rather than operating them to avoid altering data.
How it shows up: A question asks the best way to confirm a clear desk policy is applied, which points to observation over interviews.
Common confusion: Relying on interviews alone because they are fastest.

5.10 Techniques for analyzing evidence through corroboration and evaluationTesting evidence before using it.

What it means: Corroboration confirms evidence from one source with evidence from another, such as matching an interview account against logs. Evaluation judges whether evidence is relevant, sufficient and reliable for the criterion it supports.
What to understand: Contradictions are audit trails, not reasons to stop. When evidence is insufficient to support a conclusion, auditors collect more or report the limitation. Evidence should be traceable in working papers so another auditor could reach the same conclusion.
How it shows up: An interviewee says incidents are reviewed weekly but the tracking system shows no reviews for two months; the next step is to investigate the discrepancy.
Common confusion: Picking the more convenient source rather than resolving the conflict.

5.11 Main concepts, principles and procedures for collecting evidence in an auditThe logic of information flow from source to conclusion.

What it means: ISO 19011 describes a flow: sources of information, collection by appropriate sampling and verification, audit evidence, evaluation against criteria, audit findings, review, and audit conclusions. Only verifiable information becomes audit evidence.
What to understand: Evidence collection follows the plan but adapts to what is found. Auditors record evidence precisely, with dates, identifiers and people, in working papers. Following audit trails across processes, such as from a risk to a control to an incident record, tests the system rather than isolated items.
How it shows up: Questions show the flow diagram steps out of order and ask which comes between evidence and findings, which is evaluation against criteria.
Common confusion: Thinking all collected information automatically becomes audit evidence.

5.12 Advantages and disadvantages of using audit checklistsChecklists as working documents.

What it means: Checklists help organize the audit, ensure coverage of criteria, record evidence consistently and share work across the team. They can be built from the standard, the auditee's documents and risk.
What to understand: Disadvantages include rigid questioning, missing issues outside the list, encouraging yes or no questions and becoming a tick-box exercise. ISO 19011 notes that working documents should not restrict audit activities, which can change based on information collected.
How it shows up: Expect a question where an auditor finds an issue not on the checklist and must decide whether to pursue it; the answer is yes, if within audit scope.
Common confusion: Thinking checklist use is mandatory or that leaving it is a deviation.

5.13 Main sampling methods and their characteristicsJudgment-based and statistical sampling.

What it means: Judgment-based sampling relies on auditor knowledge and experience to choose items, often targeting higher-risk areas. Statistical sampling uses random selection and probability theory so results can be extrapolated with a stated confidence. Methods include random, systematic, stratified and block selection.
What to understand: The auditor, not the auditee, selects samples. Sample size depends on population, risk and required confidence. Judgment samples cannot be statistically extrapolated, and both approaches leave sampling risk, consistent with reasonable assurance.
How it shows up: A scenario has the auditee choosing which change tickets to show; the problem is sample selection bias.
Common confusion: Claiming statistical confidence from a judgment-based sample.

5.14 Procedure for preparing an audit planApplying and adapting the plan during fieldwork.

What it means: This statement appears in both Domains 4 and 5 of the handbook. In the conducting context, it concerns how the plan prepared before the audit, especially the Stage 2 plan built from Stage 1 output, is applied, monitored and revised as fieldwork progresses.
What to understand: Revisions during the audit, such as adding time to a problem area or changing interview times, are agreed with the auditee and recorded. Changes to objectives or scope need client agreement. Daily team meetings check progress against the plan.
How it shows up: Questions ask what to do when a scheduled interviewee is unavailable; adjust the plan with the auditee rather than skip the area.
Common confusion: Treating the audit plan as fixed once the audit has started.

5.15 Preparation and development of audit working papersRecords of audit work and evidence.

What it means: Working papers include checklists, sampling plans, interview notes, evidence references and records of meetings. They support the audit report, allow review and provide a record of the audit's basis.
What to understand: Working papers must be protected for confidentiality and retained according to the audit programme. They should be clear enough for the certification decision maker or a reviewer to understand how conclusions were reached.
How it shows up: Questions ask why detailed notes are needed when the report is short; the answer is traceability and review.
Common confusion: Thinking working papers can be discarded once the report is issued.

5.16 Best practices for creating audit test plansDetailed procedures for testing specific requirements or controls.

What it means: An audit test plan specifies, for a requirement or control, what will be tested, the evidence sought, the method, the sample and the expected result. PECB courses use test plans to make control testing systematic.
What to understand: Good test plans link to the criterion, combine methods, define sample size and selection, and test both design and operation. They are adapted to the auditee's risk profile rather than copied from generic lists.
How it shows up: A question asks which test best verifies backup control 8.13, such as observing or reviewing a restoration test result rather than reading the backup policy.
Common confusion: Writing test plans that only check whether a document exists.

5.17 Evidence evaluation process for developing audit findingsTurning evidence into findings.

What it means: Evidence is evaluated against audit criteria to generate findings of conformity, nonconformity or improvement opportunities. Nonconformities and their supporting evidence are recorded and reviewed with the auditee to confirm the evidence is accurate and the nonconformity understood.
What to understand: A well-formed nonconformity identifies the requirement, the evidence and the gap. The audit team reviews findings together at suitable stages. Confirming facts with the auditee does not mean they must agree with the grading.
How it shows up: An item offers several nonconformity statements and asks which is properly written with requirement, evidence and gap.
Common confusion: Writing findings as recommendations or opinions rather than evidence-based statements.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Stage 1 purpose

Review documented ISMS and readiness for Stage 2.

Remember
Output identifies concerns that could become Stage 2 nonconformities.

Tested as
Stage placement questions.

Trap
Doing full control testing in Stage 1.
Stage 2 purpose

Evaluate implementation and effectiveness of the ISMS.

Remember
Covers all requirements, controls on a sample basis and performance.

Tested as
Effectiveness test questions.

Trap
Accepting documents instead of operating evidence.
Opening meeting

Formal start confirming plan, roles, methods and logistics.

Remember
Chaired by the team leader with attendance recorded.

Tested as
Content questions.

Trap
Presenting findings at the opening.
Guide vs. observer

Guide assists for the auditee; observer accompanies without participating.

Remember
Neither may interfere; the team leader can restrict them.

Tested as
Interference scenarios.

Trap
Letting the guide answer for interviewees.
Audit trail

Following evidence across linked processes.

Remember
Tests the system, not isolated items.

Tested as
Next evidence step questions.

Trap
Stopping at the first document found.
Judgment vs. statistical sampling

Experience-based selection vs. random selection with probability theory.

Remember
Only statistical sampling supports quantified extrapolation.

Tested as
Sampling method questions.

Trap
Letting the auditee choose samples.
Corroboration

Confirming evidence from one source with another.

Remember
Contradictions must be investigated.

Tested as
Conflicting evidence scenarios.

Trap
Choosing the more convenient source.
Working papers

Records of audit work and evidence.

Remember
Kept confidential and retained per the programme.

Tested as
Traceability questions.

Trap
Discarding notes after the report.
Audit test plan

Detailed method for testing a specific control or requirement.

Remember
Defines evidence, method, sample and expected result.

Tested as
Best test selection questions.

Trap
Testing only document existence.
Nonconformity statement

Requirement, evidence and gap.

Remember
Facts are confirmed with the auditee.

Tested as
Finding quality questions.

Trap
Writing a recommendation instead of a finding.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Stage 1 vs. Stage 2

Concept	Meaning	Key difference	Common trap
Stage 1	Documented ISMS review, scope confirmation, readiness assessment	Is the ISMS ready to be audited for implementation?	Grading formal nonconformities as if implementation was tested
Stage 2	On-site evaluation of implementation and effectiveness	Does the ISMS work in practice?	Repeating Stage 1 document checks only

Evidence collection methods

Concept	Meaning	Key difference	Common trap
Interview	Questions to people at relevant levels	Explains process; needs corroboration	Leading or closed questions
Observation	Watching activities or the workplace	Shows actual practice at that moment	Generalizing from one observation
Document and record review	Examining documented information	Shows what is defined and what was done	Accepting a procedure as proof of operation
Technical verification	Viewing configurations and system outputs	Direct proof of control state	Auditor operating production systems

Judgment-based vs. statistical sampling

Concept	Meaning	Key difference	Common trap
Judgment-based	Items chosen by auditor knowledge and risk	Efficient and risk-focused; no quantified confidence	Extrapolating results statistically
Statistical	Random or systematic selection using probability	Supports extrapolation with stated confidence	Assuming it removes sampling risk

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Accept offered samples

What candidates pick
Review the five records the auditee prepared in advance.

Why it looks right
It saves time and seems cooperative.

Why it's wrong
Auditee-selected samples can be biased; the auditor selects samples to keep evidence objective.

Clue to watch for Records were prepared or chosen by the auditee.
Stop at the document

What candidates pick
Mark the control conformant because a procedure exists.

Why it looks right
Documents are easy to verify.

Why it's wrong
Stage 2 tests implementation and effectiveness, needing records, observation or technical evidence of operation.

Clue to watch for Question refers to Stage 2 or effectiveness.
Withdraw under pressure

What candidates pick
Drop the finding after the manager objects strongly.

Why it looks right
It avoids conflict and keeps the audit on schedule.

Why it's wrong
Findings rest on evidence; disagreements are reviewed with evidence and unresolved opinions are recorded, not erased.

Clue to watch for Objection offers no new evidence.
Ignore issues outside the checklist

What candidates pick
Note it as out of checklist and move on.

Why it looks right
Checklists define the work.

Why it's wrong
Working documents should not restrict the audit; issues within scope found during fieldwork must be followed.

Clue to watch for Issue is in scope but not on the checklist.
Auditor operates the system

What candidates pick
Log in as administrator to test the setting.

Why it looks right
Direct testing seems most reliable.

Why it's wrong
Auditors should view while auditee staff operate systems, avoiding changes to data and liability for disruptions.

Clue to watch for Option has the auditor making changes or using privileged access.
Stage 1 as consultancy

What candidates pick
Advise the auditee how to fix gaps before Stage 2.

Why it looks right
It helps the auditee succeed.

Why it's wrong
Stage 1 reports concerns; advising on solutions breaches impartiality required of certification bodies.

Clue to watch for Option includes recommending specific fixes.

Answer framework

For a fieldwork question, place yourself in the audit stage and ask what evidence is missing before any conclusion.

Identify whether the scenario sits in the opening meeting, Stage 1, Stage 2 or a team review, and discard options belonging to another stage.
Ask what criterion is being tested and whether current evidence is verifiable, sufficient and selected by the auditor rather than the auditee.
If evidence is single-source or contradictory, choose the option that corroborates through records, observation or technical verification.
Handle people issues by protecting interviewees' voices, restricting interfering guides or observers, and resolving disputes through evidence.
Only when evidence is adequate, record a finding stating the requirement, the evidence and the gap, and confirm the facts with the auditee.

Practice question

During Stage 2, an auditor asks a developer how code reviews are performed. The development manager, acting as guide, repeatedly answers instead of the developer. What should the auditor do?

Record the manager's answers as the evidence, since the manager is responsible End the interview and raise a nonconformity against clause 5.3 Politely ask the guide to let the developer answer and, if it continues, inform the team leader Ask the manager to leave the audit entirely

Show the answer

Answer C. Guides support the audit but must not interfere. The auditor needs the developer's own account to understand the actual practice, so the first step is a polite request, escalating to the team leader if needed, who may restrict the guide's participation. The manager's answers are not the interviewee's evidence, a nonconformity has no basis, and removing the guide outright is not the auditor's first move.

Want more like this? The ISO 27001 LA practice test has questions for every domain.

Study strategy

Give this domain the most time, since it carries 18 questions. Start with ISO 19011 clause 6.4 and ISO/IEC 17021-1 clause 9.3, and draw a timeline from the opening meeting through Stage 1, the gap between stages, and Stage 2 to the point of drafting findings. Under each step, write what the auditor does and what they must not do.

Next, build test plans for eight Annex A controls of your choice, for example 5.15 Access control, 5.24 incident management planning, 8.13 Information backup and 8.15 Logging. For each, define the criterion, evidence sought, method, sample and expected result. This exercise prepares you for questions about the best way to test a control.

Practice people scenarios aloud with a colleague: an interfering guide, a defensive interviewee, an auditee who offers pre-selected records, and a manager disputing a finding. Note the response that protects evidence and fairness. Finally, write ten nonconformity statements from short fictional facts and check each has a requirement, evidence and gap, then do timed practice questions focused on scenario items.

FAQ

How much of the exam is Domain 5, Conducting an ISO/IEC 27001 Audit?

This is the largest domain: 18 of the 80 questions, or 22.5% of the exam, according to the PECB candidate handbook.

Can nonconformities be raised at Stage 1?

Stage 1 identifies areas of concern that could be classified as nonconformities in Stage 2. Certification bodies document them in the Stage 1 report so the auditee can address them before Stage 2.

Who selects audit samples?

The auditor selects samples. The auditee provides the population, such as a list of all changes or leavers, so the auditor can choose without bias.

Are checklists required?

No. Checklists are useful working documents but optional, and they should never restrict the audit from following issues found within scope.

What should an auditor do if evidence shows an immediate significant risk?

The team leader should report it to the auditee and, as appropriate, the audit client without delay, rather than waiting for the closing meeting.

Why does the handbook list the audit plan in both Domain 4 and Domain 5?

In Domain 4 the focus is preparing the plan; in Domain 5 it is applying and revising the plan during fieldwork. Questions can come from either angle.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

Test your fieldwork judgment on Stage 1 and Stage 2 placement, sampling, interview handling and evidence corroboration in exam-style scenarios.

Take the ISO 27001 LA practice test Check your ISO 27001 LA readiness

Overview

How it's tested

Stage placement

Next evidence step

People handling

Knowledge statements 17

High-yield concepts

Stage 1 purpose

Stage 2 purpose

Opening meeting

Guide vs. observer

Audit trail

Judgment vs. statistical sampling

Corroboration

Working papers

Audit test plan

Nonconformity statement

Side by side

Stage 1 vs. Stage 2

Evidence collection methods

Judgment-based vs. statistical sampling

Exam traps

Accept offered samples

Stop at the document

Withdraw under pressure

Ignore issues outside the checklist

Auditor operates the system

Stage 1 as consultancy

Answer framework

Practice question

Checklist

Study strategy

FAQ

Related domains

Other Cybersecurity certifications

Test your Domain 5 knowledge

Keep going