Day#3 ISO 27001 Lead Auditor

It establishes that the organization must implement the risk treatment

process:

• Clause 6.1.2

• Clause 6.1.3

• Clause 8.3

• B and C are valid

These are risk management strategies except:

• Mitigate

• Transfer

• Assume

• Retain

• Control

Type of strategy where the implementation of a control to reduce the level of

risk is defined:

• Mitigate

• Transfer

• Assume

• Retain

The “Statement of Applicability” must contain:

• Controls necessary to reduce the level of risk.

• The justification for the inclusion of the controls considered necessary.

• Whether or not the necessary controls are implemented.

• Justification for exclusions from any of the controls in annex A.

• All are valid

According to ISO 19011:2018 audit is defined as a systematic, independent,

documented process for obtaining evidence and evaluating it objectively, in

order to determine the extent to which the audit criteria are met.

• True

• False

 ISO 19011:2018 establishes as methods for assessing auditors:

• Observation

• Examination

• Interview

• Telephone call

• All except D

During the audit, professional behavior by the auditor is desired, e.g., the

auditor is expected to be open-minded, i.e., willing to consider alternative ideas

or points of view.

• True

• False

Defining objectives, scope and criteria for each individual audit, selecting audit

methods, and defining and implementing the necessary operational controls

for the supervision of the audit program are part of the activities for:

•  Define the scope of the ISMS.

• Correctly create the ISMS policy.

• Define the audit program.

• None of above

They are responsible for assigning responsibilities to the audit team:

• The Lead Auditor.

• The person responsible for the management system.

• Senior management.

• The person(s) managing the audit program.

They should ensure that the following activities are carried out as part of the

management of the results of the audit program:

1. Evaluation of the achievement of the objectives for each audit within the audit program.

2. Review and approval of audit reports on compliance with the scope and objectives of the audit.

3. Reviewing the effectiveness of actions taken to address audit findings.

4. Distribution of audit reports to relevant stakeholders.

5. Determination of the need for any follow-up audits.

• Members of the audit team.

• Everyone in the organization.

• The person(s) managing the audit program.