Select the option which best describes how Information Security Management System audits should be conducted:

Question

Options

• AAudit criteria should be used to assess circumstantial evidence in order to generate audit
• BAudit criteria should be used to assess objective evidence in order to generate audit outcomes.
• CAudit methods should be used to assess audit evidence in order to generate audit
• DAudit methods should be used to assess objective evidence in order to generate audit findings.
• EAudit objectives should be used to assess audit evidence in order to generate audit conclusions.
• FAudit objectives should be used to assess objective evidence in order to generate audit

• A
  2% (1)
• D
  94% (46)
• E
  4% (2)

Explanation

Audit methods should be used to assess objective evidence in order to generate audit findings. Then, the audit conclusion should be created and presented to the auditee at the closing meeting. This option accurately reflects the audit process, emphasizing the use of systematic audit methods to assess objective evidence, which is crucial for impartiality and accuracy in auditing. Audit findings are the results derived from evaluating the objective evidence against the audit criteria. The conclusion, based on the audit findings, provides a comprehensive summary of the audit's outcomes, indicating whether the audited ISMS meets the established criteria. Presenting these conclusions to the auditee during the closing meeting ensures transparency and provides an opportunity for immediate clarification and discussion of the results and potential next steps.

No community discussion yet for this question.