CISM Information Security Risk Management Practice Question

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Scope definition, then Planning, then Execution, then Documentation, then Reporting

Audits start with scope definition, planning, execution, documentation, and reporting.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Scope definition, then Planning, then Execution, then Documentation, then Reporting
Why this is correct
This is the correct order because ISO 27001 internal audits must start with defining the audit scope and objectives, followed by detailed planning, on-site execution, documentation of evidence and findings, and finally reporting results to management.
✗
Planning, then Scope definition, then Execution, then Documentation, then Reporting
Why it's wrong here
This is incorrect because planning cannot precede scope definition; the scope defines what the audit covers, and planning depends on that scope.
✗
Scope definition, then Planning, then Reporting, then Execution, then Documentation
Why it's wrong here
This is incorrect because reporting should occur after execution and documentation; reporting before execution would mean there is no audit evidence to report.
✗
Scope definition, then Execution, then Planning, then Documentation, then Reporting
Why it's wrong here
This is incorrect because execution must be guided by a plan; performing audit activities without a plan leads to inefficiency and missing key controls.

Go deeper