ISO 28000 LEAD AUDITOR COMPREHENSIVE
MOCK EXAM WITH QUESTIONS AND
VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. An organization has established an ISO 28000-based security
management system (SMS) for its international supply-chain
operations. During an audit, the lead auditor discovers that the
organization has documented security objectives but has not
established measurable criteria for determining whether those
objectives are being achieved. Senior management argues that
because the objectives are documented and communicated, the
requirement is satisfied. What is the most appropriate audit
conclusion?
A. The organization conforms because documentation and
communication are sufficient for security objectives.
B. The organization conforms if employees verbally understand the
objectives.
C. The organization has a nonconformity because objectives should be
capable of being evaluated for achievement.
D. The organization conforms because measurement is only required
during management review.
Answer: C.
Rationale: ISO 28000 requires security objectives to be established in a
manner that supports evaluation of their achievement. Merely
documenting and communicating objectives does not demonstrate that
the organization can determine whether those objectives are being met.
1
,The auditor should identify the absence of measurable or otherwise
evaluable criteria as a system deficiency and determine its significance
based on audit evidence and the organization's defined requirements.
2. During a certification audit, an auditor asks the organization's
security manager how security risks are identified. The manager
explains that risks are reviewed only after a security incident
occurs. There is no evidence of periodic or proactive risk
identification, and changes in routes, suppliers, threats, or
operating conditions are not systematically considered. What
should the auditor determine?
A. The approach is acceptable because incident-driven risk assessment is
the most practical method.
B. The organization has implemented a reactive process but lacks an
adequate systematic approach to identifying and assessing security risks.
C. The approach is acceptable if the organization has never experienced
a major security incident.
D. The issue is exclusively an operational problem and cannot affect the
SMS.
Answer: B.
Rationale: An effective ISO 28000 SMS must be based on systematic
identification and assessment of security risks rather than relying
solely on incidents to reveal vulnerabilities. Changes in threats,
processes, suppliers, infrastructure, routes, technology, and external
conditions can alter security risk before an incident occurs. The
auditor should seek objective evidence that risk assessment is
proactive, systematic, and maintained as conditions change.
2
, 3. An auditor is evaluating a company's supply-chain security risk
assessment. The organization has identified theft, unauthorized
access, cargo tampering, cyberattack, and insider threats. However,
every risk has been assigned the same risk rating without
documented criteria explaining likelihood, consequence,
vulnerability, or exposure. What is the auditor's strongest concern?
A. Risk assessments must always use numerical scoring from 1 to 100.
B. Risks cannot be assessed unless a quantitative financial-loss model is
used.
C. The risk assessment lacks demonstrated, consistent criteria for
determining the significance or priority of identified risks.
D. ISO 28000 prohibits organizations from using qualitative risk
assessment methods.
Answer: C.
Rationale: ISO 28000 does not require one universally prescribed
numerical scoring model. Organizations may use qualitative, semi-
quantitative, or quantitative methods appropriate to their
circumstances. However, the method must provide a consistent and
defensible basis for evaluating risks and determining priorities.
Assigning identical ratings without objective criteria undermines the
usefulness and reliability of the risk assessment process.
4. During an audit of a logistics company, the auditor observes that
security procedures are followed at the main warehouse but not at
temporary storage facilities. Management states that the temporary
facilities are operated by third parties and therefore fall outside the
SMS. What should the auditor do first?
A. Accept management's explanation because third-party facilities are
automatically excluded.
B. Determine whether the temporary facilities and related activities fall
3
, within the organization's defined SMS scope and whether relevant
outsourced processes are controlled.
C. Immediately issue a major nonconformity without examining the
scope.
D. Ignore the facilities because temporary operations are inherently low
risk.
Answer: B.
Rationale: The auditor must establish whether the activities, locations,
processes, and external providers are within the defined SMS scope
and how outsourced or externally provided processes are controlled.
Third-party operation does not automatically remove a process from
organizational responsibility when it can affect the SMS or security
performance. The audit conclusion should be based on the
documented scope, risk assessment, contractual controls, and objective
evidence.
5. A lead auditor is preparing an audit plan for an organization whose
supply chain includes procurement, warehousing, transportation,
customs clearance, information systems, and contracted security
services. Which approach would provide the strongest audit plan?
A. Allocate identical audit time to every department regardless of risk.
B. Audit only the security department because ISO 28000 is a security
standard.
C. Use the organization's processes, security risks, significant controls,
previous audit results, and operational complexity to determine audit
coverage and priorities.
D. Audit only those processes specifically mentioned in the
organization's security policy.
Answer: C.
4
MOCK EXAM WITH QUESTIONS AND
VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. An organization has established an ISO 28000-based security
management system (SMS) for its international supply-chain
operations. During an audit, the lead auditor discovers that the
organization has documented security objectives but has not
established measurable criteria for determining whether those
objectives are being achieved. Senior management argues that
because the objectives are documented and communicated, the
requirement is satisfied. What is the most appropriate audit
conclusion?
A. The organization conforms because documentation and
communication are sufficient for security objectives.
B. The organization conforms if employees verbally understand the
objectives.
C. The organization has a nonconformity because objectives should be
capable of being evaluated for achievement.
D. The organization conforms because measurement is only required
during management review.
Answer: C.
Rationale: ISO 28000 requires security objectives to be established in a
manner that supports evaluation of their achievement. Merely
documenting and communicating objectives does not demonstrate that
the organization can determine whether those objectives are being met.
1
,The auditor should identify the absence of measurable or otherwise
evaluable criteria as a system deficiency and determine its significance
based on audit evidence and the organization's defined requirements.
2. During a certification audit, an auditor asks the organization's
security manager how security risks are identified. The manager
explains that risks are reviewed only after a security incident
occurs. There is no evidence of periodic or proactive risk
identification, and changes in routes, suppliers, threats, or
operating conditions are not systematically considered. What
should the auditor determine?
A. The approach is acceptable because incident-driven risk assessment is
the most practical method.
B. The organization has implemented a reactive process but lacks an
adequate systematic approach to identifying and assessing security risks.
C. The approach is acceptable if the organization has never experienced
a major security incident.
D. The issue is exclusively an operational problem and cannot affect the
SMS.
Answer: B.
Rationale: An effective ISO 28000 SMS must be based on systematic
identification and assessment of security risks rather than relying
solely on incidents to reveal vulnerabilities. Changes in threats,
processes, suppliers, infrastructure, routes, technology, and external
conditions can alter security risk before an incident occurs. The
auditor should seek objective evidence that risk assessment is
proactive, systematic, and maintained as conditions change.
2
, 3. An auditor is evaluating a company's supply-chain security risk
assessment. The organization has identified theft, unauthorized
access, cargo tampering, cyberattack, and insider threats. However,
every risk has been assigned the same risk rating without
documented criteria explaining likelihood, consequence,
vulnerability, or exposure. What is the auditor's strongest concern?
A. Risk assessments must always use numerical scoring from 1 to 100.
B. Risks cannot be assessed unless a quantitative financial-loss model is
used.
C. The risk assessment lacks demonstrated, consistent criteria for
determining the significance or priority of identified risks.
D. ISO 28000 prohibits organizations from using qualitative risk
assessment methods.
Answer: C.
Rationale: ISO 28000 does not require one universally prescribed
numerical scoring model. Organizations may use qualitative, semi-
quantitative, or quantitative methods appropriate to their
circumstances. However, the method must provide a consistent and
defensible basis for evaluating risks and determining priorities.
Assigning identical ratings without objective criteria undermines the
usefulness and reliability of the risk assessment process.
4. During an audit of a logistics company, the auditor observes that
security procedures are followed at the main warehouse but not at
temporary storage facilities. Management states that the temporary
facilities are operated by third parties and therefore fall outside the
SMS. What should the auditor do first?
A. Accept management's explanation because third-party facilities are
automatically excluded.
B. Determine whether the temporary facilities and related activities fall
3
, within the organization's defined SMS scope and whether relevant
outsourced processes are controlled.
C. Immediately issue a major nonconformity without examining the
scope.
D. Ignore the facilities because temporary operations are inherently low
risk.
Answer: B.
Rationale: The auditor must establish whether the activities, locations,
processes, and external providers are within the defined SMS scope
and how outsourced or externally provided processes are controlled.
Third-party operation does not automatically remove a process from
organizational responsibility when it can affect the SMS or security
performance. The audit conclusion should be based on the
documented scope, risk assessment, contractual controls, and objective
evidence.
5. A lead auditor is preparing an audit plan for an organization whose
supply chain includes procurement, warehousing, transportation,
customs clearance, information systems, and contracted security
services. Which approach would provide the strongest audit plan?
A. Allocate identical audit time to every department regardless of risk.
B. Audit only the security department because ISO 28000 is a security
standard.
C. Use the organization's processes, security risks, significant controls,
previous audit results, and operational complexity to determine audit
coverage and priorities.
D. Audit only those processes specifically mentioned in the
organization's security policy.
Answer: C.
4
