Day#4 ISO 27001 Lead Auditor

Which of the following is an example of a minor nonconformity?

• The organization has not established an information security policy

• The organizations’ personnel are not aware of the established disciplinary process in case they commit an information security breach

• The organization has conducted management reviews; however, it has not retained documented information on the results of those reviews

What is an anomaly?

• A deviation from a requirement or from the targets set by the organization, but still remains within the organization’s established and acceptable levels

• An element observed during the audit that may be subject to improvement without necessarily being a nonconformity

• The nonfulfillment of a requirement specified by the organization or by a management system standard

What should be included in a nonconformity report?

• Description of the requirements for which the nonconformity was detected

• Corrective actions to be taken by the auditee

• Long-term recommendations that the auditee should consider

The audit team leader should raise a nonconformity when they doubt that the auditee has not fulfilled a requirement of the standard although they may not have evidence of the nonconformity.

• True

• False

Which of the following documents typically include anomalies observed during the audit process?

• The audit report

• The auditor's work papers

• Both A and B

Should observations impact audit conclusions?

• Yes, as they identify weaknesses within the system

• Yes, as they necessitate corrective actions to be taken by the auditee

• No, audit conclusions should be independent of observations

Why should an auditor create and keep work documents?

• To support audit conclusions

• To ensure compliance with the requirements of the management system standard

• To develop a quality review procedure

Management system-related documents in the auditor’s possession must always be destroyed after the audit.

• True

• False

Who is responsible for ensuring the protection of the auditee’s confidential information included in the audit records?

• Auditee’s employees

• Audit team members

• Only the audit team leader

Why is the review of audit work documents necessary?

• To ensure that the audit procedures were appropriate and reliable and used properly

• To ensure that the audit team members make the right certification decision based on the evaluation of the results

• To ensure that the auditee’s processes and procedures are in compliance with requirements of the standard