Scenario Based Lead Auditor Day#3

According to the general principles for determining the sample size, did Tom and Ben select a valid sample size of 10 employees based on a fixed interval?

• No, the determined sample size is significantly low compared to DeeCorp’s population, as according to the general principles, for a population lower than 366 the minimum number of the sample size should be 25

• Yes, the determined sample size is on proportion with DeeCorp’s overall population

• No, the determined sample size is significantly low compared to DeeCorp’s population, as according to the general principles, for a population higher than 366, the minimum number of the sample size should be 25

Answer explanation

The sampling population in this case is higher than 400. According to the general principles for determining the sample size, for a population higher than 366, the minimum number of selections should be at least 25.

According to the scenario, Eva wanted an easy-to-use and statistically reliable sampling method. Which method fits that description?

• Random sampling

• Systematic sampling

• Block selection sampling

Answer explanation

Systematic sampling is the most statistically reliable and easy-to-use method. Additionally, the scenario states that the sample size is selected based on a fixed interval, which is also a characteristic of systematic sampling.

The scenario states that there is no need for a socializing event. Is “socializing” the main purpose of an audit opening meeting?

• No, the main purpose of an audit opening meeting is to gain a level of understanding of the team members’ background

• Yes, the main purpose of an audit opening meeting is to allow the audit members to socialize

• No, the main purpose of an audit opening meeting is to introduce and agree on the audit plan, audit team, and roles and responsibilities of each auditor

Answer explanation

According to ISO 19011, clause 6.4.3 Conducting opening meeting, the purpose of the opening meeting is to confirm the agreement of all participants (e.g. auditee, audit team) to the audit plan, introduce the audit team and their roles, and ensure that all planned audit activities can be performed.

What important information could Eva gather from the individual interviews that would be of help for her final audit report?

• Detailed information that helps her evaluate and determine if a set of policies for information security is defined, approved, published, and communicated to employees and external parties

• Detailed information on when the organization implemented the information security policies control and the persons responsible for its implementation and maintenance

• Detailed information on the expertise level of DeeCorp employees and their level of understanding and attitude to the organization’s policies

Answer explanation

Individual interviews can help Eva gain detailed information on whether the controls operate effectively and continuously and are error-free.

Eva’s team structured an audit test plan in order to:

• Test whether the controls are error-free

• Determine a nonconformity

• Validate conformity to requirements

Answer explanation

An audit test plan based on audit procedures used for evidence collection helps validate conformity to requirements.