Day#4A ISO 27001 Lead Auditor

The audit report must be distributed to:

• The recipients defined in the audit procedure or plan.

• The recipients defined by the audit team leader.

• The recipients defined by the board of directors of the audited organization.

• The recipients defined by the management representative of the audited organization.

An audit report must include, or refer to:

• A complete list of all employees of the audited organization.

• A complete list of all documents used during the audit.

• A complete and detailed description of the audit process.

• A summary of the audit findings.

The information accepted as audit evidence must be:

• Verifiable.

• Documented.

• Identified at least twice.

• Confirmed by the guide.

The auditor's working documents may include: 

• The auditor's code of conduct.

• Identification, including photograph.

• Checklists, plans and forms for collecting evidence.

• Instructions for the installation to be audited.

Which of the following factors would be taken into consideration to determine the viability of a

audit? (Select the best answer).

• Issues related to the audit report.

• Availability of sufficient information to plan the audit.

• Adequate cooperation of the audit team.

• Guidelines of the person in charge of admission.

The scope of an audit is always the same as the scope of the management system.

• True

• False

Audit objectives may include:

• Evaluation of the effectiveness of the management system.

• Maintenance of audit records.

• Selection of a team leader.

• Offering certification for a standard.

When establishing an audit program for a management system, the organization should

prioritize audit resources to address:

• Business Needs.

• Risks.

• Market opportunities.

• Integration to business continuity plans.

A person or organization requesting an audit is referred to as:

• Auditor

• Audited

• Audit Client

• Audit Team

Which control could be selected to mitigate the risk associated with updating software in

enterprise servers?

• A.14.2.2 – Systems change control procedure.

• A.12.7.1 – Information systems audit controls.

• A.12.1.2 – Change Management.

• A.9.4.5 – Access control to the source code of the programs.