The data centre at which you work is currently seeking ISO/IEC27001:2022 certification. In preparation for your initial certification visit, several internal audits have been carried out by a colleague working at another data centre within your Group. They secured their own ISO/IEC 27001:2022 certificate earlier in the year. You have just qualified as an Internal ISMS auditor and your manager has asked you to review the audit process and audit findings as a final check before the external Certification Body arrives. Which four of the following would cause you concern in respect of conformity to ISO/IEC 27001:2022 requirements?

Question

Accepted Answer

A. Although the scope for each internal audit has been defined, there are no audit criteria defined for D. The audit programme does not reference audit methods or audit responsibilities. E. The audit programme does not take into account the relative importance of information security F. The audit programme does not take into account the results of previous audits.

Answer

B. Audit reports are not held in hardcopy (i.e. on paper). They are only stored as *. PDF documents

Answer

C. The audit process states the results of audits will be made available to 'relevant' managers, not top

Answer

G. The audit programme has not been signed as 'approved by Top Management.

Answer

H. The audit programme shows management reviews taking place at irregular intervals during the

The data centre at which you work is currently seeking ISO/IEC27001:2022 certification. In preparation for your initial certification visit, several internal audits have been carried out by a…

Question

Options

How the community answered

Explanation

Topics

Community Discussion