Which one of the following conclusions in the audit report is not required by the certification body when deciding to grant certification?

Question

Options

• AThe corrections taken by the organisation related to major nonconformities have been accepted.
• BThe organisation fully complies with all legal and other requirements applicable to the Information
• CThe plans to address corrective actions related to minor nonconformities have been accepted
• DThe scope of certification has been fulfilled

• A
  2% (1)
• B
  83% (38)
• C
  11% (5)
• D
  4% (2)

Explanation

The conclusion in the audit report that is not required by the certification body when deciding to grant certification is that the organisation fully complies with all legal and other requirements applicable to the ISMS. This is because the certification body does not have the authority or the responsibility to verify the legal compliance of the organisation, as this is outside the scope of ISO/IEC 27001:2022. The certification body only evaluates the conformity of the organisation's ISMS with the requirements of the standard, which include the establishment of a process to identify and evaluate the legal and other requirements that are relevant to the ISMS. The organisation is responsible for ensuring its own legal compliance and for providing evidence of such compliance to the certification body if requested.

No community discussion yet for this question.