IPA IP 2025 Question 59
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問59, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate description concerning internal audits in an ISMS?
Explanation
It checks conformity to both sets of requirements and also effectiveness — an ISMS internal audit asks whether the ISMS follows the rules and whether it works.
JIS Q 27001 is the Japanese edition of ISO/IEC 27001. Its internal audit clause requires audits at planned intervals that tell whether the ISMS conforms to the organisation’s own requirements and to the requirements of the standard, and whether it is effectively implemented and maintained. The audit programme sets the frequency, methods and responsibilities, and takes into account the importance of the processes and the results of previous audits.
Answer (a)
Why not others:
- •(b) — the audit criteria include the requirements of the standard as well as the organisation’s own, not one instead of the other
- •(c) — the programme must take the results of previous audits into account, for example to follow up nonconformities found last time
- •(d) — internal audits are conducted at planned intervals under the audit programme; surprise audits are not the principle
Key rule: An ISMS internal audit is planned, covers conformity to the organisation’s and the standard’s requirements plus effectiveness, and builds on previous audit results.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.