Day#4 ISO 27001 Lead Auditor

What is the definition of an anomaly?

• A deviation from a requirement or from the targets set by the organization

• An element observed during the implementation that may be subject to improvement

• A fulfilment of a requirement specified by the organization

Answer explanation

An anomaly is a deviation from a requirement or from the targets set by the organization but one that still remains within the organization’s established and acceptable levels.

An observation is a situation observed during the audit that influences audit conclusions.

• True

• False

Answer explanation

An observation is a situation observed during the audit that may be subject to improvement but must not influence audit conclusions

What is the purpose of creating and keeping work documents?

• To support audit evidence

• To ensure compliance with the standard requirements

• To develop a quality review procedure

Answer explanation

An auditor must create and keep work documents that can serve as support to audit evidence, as reference for future audits, or as proof of the audit quality.

Management system-related documents in the auditor’s possession should be destroyed after the audit.

• True

• False

Answer explanation

Documents related to the management system in the auditor’s possession can be either destroyed, returned to the auditee, or archived after the audit, depending on the audit agreement

Who is responsible for ensuring the protection of the auditee’s confidential information included in the audit records?

• Auditee’s employees

• Audit team members

• Only the audit team leader

Answer explanation

All audit team members are responsible for ensuring the adequate protection of the auditee’s confidential information included in the audit records.

Why should the audit team leader review other audit team member’s work documents?

• To ensure that the auditors have collected sufficient information to support their conclusion

• To ensure that the audit team members make the adequate certification decision based on the evaluation of the results

• To ensure that the auditee’s processes and procedures are in compliance with standard requirements

Answer explanation

Each auditor’s work documents must be reviewed by the audit team leader to ensure that the auditors have collected sufficient information to support their conclusions, the audit findings and conclusions are logical, and that the audit procedures were appropriate and reliable

Which of the following is NOT included in audit records?

• Audit test plans

• Interview notes

• Proposed action plans

Answer explanation

Audit records usually contain, among other things, audit test plans or interview and observation notes, while the third option is not included.

When does the audit team formally present the audit conclusions and the certification recommendation?

• During the closing meeting

• During the surveillance audit

• During the audit follow-up

Answer explanation

The audit team formally presents the audit conclusions and certification recommendation at the closing meeting and files the stage 2 audit report.

Why should audit findings be discussed with the auditee’s management prior to the closing meeting?

• To negotiate the conclusions with competent employees

• To initiate the implementation of corrective actions

• To present the audit conclusions

Answer explanation

It is important that the audit team discusses the audit findings with the auditee’s management so that the implementation of corrective actions is encouraged as soon as possible

After finding out that the auditee does not have a backup policy, the auditor provided the auditee with a backup policy template to help them treat the detected nonconformity. Is this acceptable?

• Yes, because auditors should help the auditee resolve the detected nonconformities

• Yes, because auditors should provide the necessary resources to the auditee in order to resolve the nonconformities

• No, because auditors cannot suggest specific solutions to resolve nonconformities

Answer explanation

This is unacceptable; an auditor can provide explanation on how the situation does not conform to the standard, but cannot recommend specific solutions to the auditee.