Scenario Based_Q4-ISO27001 LEAD AUDITOR

What should have you taken into consideration, in addition to the audit evidence, when determining the audit findings?

• Requirements of the audit client

• Submission of corrective actions

• Content of action plans

You have validated the action plans and the implemented corrective actions submitted by Company ABC. What type of audit have you conducted?

• Surveillance audit

• Audit follow-up

• Internal audit

Which of the following statements presents the best description of the observed nonconformity related to the first action plan submitted by Company ABC?

• The process used to grant or deny access to systems and services that process sensitive information is not documented

• There is no process in place to manage access to systems and services that process sensitive information

• In a sample of 30 user accounts belonging to former employees of Company ABC, only 5 of them followed the formal user de-registration process

The auditee has submitted the following action plan, “A formal user registration and de-registration process to grant or deny access

to systems and services that process sensitive information will be created.” Is this action plan acceptable?

• No, because it does not address the root cause of the detected nonconformity

• No, because a time frame for completing the action has not been included

• No, because the required resources for the implementation have not been included

What type of audit finding does the second action plan resolve?

• Anomaly

• Minor nonconformity

• Major nonconformity