Tambahan Scenario Based Day#4

The top management assigned Lisa the responsibility for determining the resources needed for the audit program. Is this in accordance with best practices?

• No, determining the resources for the audit program is the responsibility of the Financial Department

• No, determining the resources for the audit program is solely the responsibility of the top management

• Yes, the individual managing the audit program can determine resources for the audit program

After establishing the audit program objectives, Lisa decided not to determine and evaluate the audit program risks and opportunities as she believed that the company operates in a low-risk environment with minimal changes in its processes or regulation. Is this in alignment with best practices?

• No, after establishing audit program objectives, audit program risks and opportunities should be determined and evaluated

• Yes, it is not necessary to evaluate audit program risks and opportunities if the organization operates in a low-risk environment with minimal changes

• No, the internal auditor must not establish audit program objectives as this responsibility is within the authority of the top management

To ensure a comprehensive assessment of the ISMS, Lisa carefully planned the main activities in accordance with the objectives of the audit program. Which of the following activities is considered as part of the main activities that Lisa should have planned to undertake during the audit?

• Reviewing the allocation and utilization of resources within the company

• Investigating customer complaints

• Examining the company’s supply chain management

After receiving the nonconformity report, Markt initially analyzed the root cause of the identified nonconformities, and then selected appropriate corrective actions to address them. Is this in compliance with best practices?

• No, organizations should conduct a situation analysis before addressing a nonconformity

• No, organizations should analyze one or more possible solutions for addressing the nonconformities before analyzing their root causes

• Yes, organizations should analyze the root causes of nonconformities before determining the adequate corrective actions

Did Lisa issue the audit conclusions in alignment with best practices?

• Yes, Lisa issued the conclusions after reviewing the audit findings, taking into consideration the audit objectives

• No, Lisa should have reviewed the audit findings in collaboration with the ISMS project manager of the company, and then issued the audit conclusions

• No, Lisa should have submitted the audit findings to the top management, who then can issue the audit conclusions