Discuss PECB ISO-IEC-27001-Lead-Auditor Exam Topic 1 Question 68

According to ISO/IEC 27001, Clause 5.1 (Leadership and Commitment), which of the following is NOT a responsibility of top management?

AEnsuring the availability of resources for the ISMS and promoting continual improvement

BConducting regular internal audits to assess the effectiveness of the ISMS

CDirecting and supporting persons to contribute to the effectiveness of the ISMS

Suggested Answer: B

Comprehensive and Detailed In-Depth

ISO/IEC 27001 Clause 5.1 (Leadership and Commitment) defines top management's role in ensuring the effectiveness of the Information Security Management System (ISMS). It requires top management to:

Ensure the availability of resources for the ISMS (Correct Responsibility).

Promote continual improvement of the ISMS (Correct Responsibility).

Direct and support employees to contribute to ISMS effectiveness (Correct Responsibility).

B . Conducting regular internal audits -- Incorrect Responsibility:

Internal audits are not a direct responsibility of top management. Instead, Clause 9.2 (Internal Audit) requires audits to be conducted independently of management.

Top management is responsible for ensuring audits are conducted but does not need to conduct them personally.

Thus, top management is responsible for oversight and support but not for conducting internal audits themselves.

Relevant Standard Reference:

ISO/IEC 27001:2022 Clause 5.1 (Leadership and Commitment)

ISO/IEC 27001:2022 Clause 9.2 (Internal Audit)

Get Premium ISO-IEC-27001-Lead-Auditor Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

24 comments · newest first

Cheryl 2 days ago

But isn't it important for management to be involved?

Mauricio 7 days ago

Agreed! Internal audits are usually handled by specific teams.

Latanya 12 days ago

I think B is the answer. Not a top management task.

Vinnie 17 days ago

Exactly! Leadership should empower, not micromanage.

Hyun 23 days ago

B is definitely not their job. They oversee, not audit.

Theodora 28 days ago

Right! They should ensure resources and support the team.

Evette 1 month ago

I feel like top management should focus on A and C.

Celia 1 month ago

Agreed, B seems off. Audits are usually for teams.

Amalia 1 month ago

I think B is the answer. Not a top management task.

Tomas 2 months ago

Exactly! Leadership should empower, not micromanage.

Alease 2 months ago

B is definitely not their job. They oversee, not audit.

Vilma 2 months ago

Right! They should ensure resources and support the team.

Carmelina 2 months ago

I feel like top management should focus on A and C.

Estrella 2 months ago

Agreed, B seems off. Audits are usually for teams.

Steffanie 2 months ago

I think B is the answer. Not a top management task.

Rhea 3 months ago

They should be involved in audits, but it’s not their main role.

Anisha 3 months ago

I’m surprised that conducting audits isn’t their job. Sounds off.

Marica 3 months ago

Wait, are you sure? I thought they had to oversee audits too.

Alecia 3 months ago

Totally agree, top management should focus on resources and support.

Anjelica 3 months ago

B is definitely not a top management responsibility.

Marylin 4 months ago

I’m a bit confused; I thought all these options were related to management, but I guess B might be the odd one out since it sounds more like a task for the ISMS team.

Olga 5 months ago

I practiced a similar question where it was clear that directing and supporting staff is a leadership role, so I think C is definitely a responsibility.

Annelle 5 months ago

I’m not entirely sure, but I feel like conducting internal audits is more of an operational task rather than a top management responsibility.

Nettie 5 months ago

I think I remember that top management is responsible for resource allocation and promoting improvement, so A seems correct.

PECB ISO-IEC-27001-Lead-Auditor Exam - Topic 1 Question 68 Discussion