You are the audit team leader conducting a third-party audit of an online insurance company. During Stage 1, you found that the organization took a very cautious risk approach and included all the information security controls in ISO/IEC 27001:2022 Appendix A in their Statement of Applicability. During the Stage 2 audit, your audit team found that there was no evidence of a risk treatment plan for the implementation of the three controls (5.3 Segregation of duties, 6.1 Screening, 7.12 Cabling security). You raise a nonconformity against clause 6.1.3.e of ISO 27001:2022. At the closing meeting, the Technical Director issues an extract from an amended Statement of Applicability (as shown) and asks for the nonconformity to be withdrawn. Select three options of the correct responses of an audit team leader to the request of the Technical Director.

Question

Accepted Answer

B. Advise the Technical Director that his request will be included in the audit report. D. Advise the Technical Director that the nonconformity must stand since the evidence obtained for it H. State that a follow up audit will be necessary to review the evidence for the updated Statement of

Answer

A. Advise management that the information provided will be reviewed when the auditors have more

Answer

C. Advise the Technical Director that once a nonconformity is raised it cannot be withdrawn.

Answer

E. Ask the auditor who raised the issue for their opinion on how you should respond to the request.

Answer

F. Inform the Technical Director that the nonconformity will be changed to an Opportunity for

Answer

G. Review the documentation produced and withdraw the nonconformity.

You are the audit team leader conducting a third-party audit of an online insurance company. During Stage 1, you found that the organization took a very cautious risk approach and included all the inf

Question

Exhibit

Options

How the community answered

Explanation

Topics

Community Discussion