Trial CertiProf Lead Auditor#2

The results of the audit:

a) Are the evaluation results of the audit evidence gathered against the audit criteria.

b) They are considered findings and can be classified as conformity or nonconformity.

c) It is an audit method to reach reliable conclusions.

d) If the audit criteria are selected from legal requirements or regulatory requirements, the audit finding is referred to as compliance or noncompliance.

• B and C only

• A and C only

• All of the above

It establishes that the organization must define a risk assessment process:

• Clause 6.1.1

• Clause 6.1.2

• Clause 8.1

• B and C are valid

It establishes that the organization must implement the risk treatment

process:

• Clause 6.1.2

• Clause 6.1.3

• Clause 8.3

• B and C are valid

These are risk management strategies except:

• Mitigate

• Transfer

• Assume

• Retain

• Control

Type of strategy where the implementation of a control to reduce the level of risk is defined:

• Mitigate

• Transfer

• Assume

• Retain

The “Statement of Applicability” must contain:

• Controls necessary to reduce the level of risk.

• The justification for the inclusion of the controls considered necessary.

• Whether or not the necessary controls are implemented.

• Justification for exclusions from any of the controls in annex A.

• All are valid

According to ISO 19011:2018 audit is defined as a systematic, independent, documented process for obtaining evidence and evaluating it objectively, in order to determine the extent to which the audit criteria are met.

• True

• False

ISO 19011:2018 establishes as methods for assessing auditors:

• A. Observation

• B. Examination

• C. Interview

• D. Telephone call

• E. All except D

During the audit, professional behavior by the auditor is desired, e.g., the auditor is expected to be open-minded, i.e., willing to consider alternative ideas or points of view.

• True

• False

 Defining objectives, scope and criteria for each individual audit, Selecting audit methods, and Defining and implementing the necessary operational controls for the supervision of the audit program are part of the activities for:

• Define the scope of the ISMS.

• Correctly create the ISMS policy.

• Define the audit program.