Câu 25: Lead Auditor: ISO/IEC 27001 Lead Auditor

The data center at which you work is currently seeking ISO/IEC 27001:2022 certification. In preparation for your initial certification visit, several internal audits have been carried out by a colleague working at another data center within your Group. They secured their own ISO/IEC 27001:2022 certificate earlier in the year. You have just qualified as an Internal ISMS auditor and your manager has asked you to review the audit process and audit findings as a final check before the external Certification Body arrives. Which four of the following would cause you concern in respect of conformity to ISO/IEC 27001:2022 requirements? (Choose four.)

1. A. Although the scope for each internal audit has been defined, there are no audit criteria defined for the audits carried out to date. — đáp án hiện tại
2. B. Audit reports are not held in hardcopy (i.e. on paper). They are only stored as *.PDF documents on the organization's intranet.
3. C. The audit process states the results of audits will be made available to 'relevant' managers, not top management.
4. D. The audit programme does not reference audit methods or audit responsibilities. — đáp án hiện tại
5. E. The audit programme does not take into account the relative importance of information security processes. — đáp án hiện tại
6. F. The audit programme does not take into account the results of previous audits. — đáp án hiện tại
7. G. The audit programme has not been signed as 'approved' by Top Management.
8. H. The audit programme shows management reviews taking place at irregular intervals during the year.