Question
During an ISO/IEC 27001 certification audit, the audit team leader failed to follow established best practices for conducting the audit. In addition, they lacked the necessary expertise to assess some of the complex areas of the ISMS, leading to suboptimal results. While the audit findings were still reported, some areas of the audit are considered weak and the audit does not fully adhere to the required procedures.
Which level of responsibility does this scenario represent in the case of tortious acts?

• A. Ordinary negligence
• B. No negligence
• C. Gross negligence

Scenario 3: Rebuildy is a construction company located in Bangkok.. Thailand, that specializes in designing, building, and maintaining residential buildings. To ensure the security of sensitive project data and client information, Rebuildy decided to implement an ISMS based on ISO/IEC 27001. This included a comprehensive understanding of information security risks, a defined continual improvement approach, and robust business solutions.
The ISMS implementation outcomes are presented below
*Information security is achieved by applying a set of security controls and establishing policies, processes, and procedures.
*Security controls are implemented based on risk assessment and aim to eliminate or reduce risks to an acceptable level.
*All processes ensure the continual improvement of the ISMS based on the plan-do-check-act (PDCA) model.
*The information security policy is part of a security manual drafted based on best security practices Therefore, it is not a stand-alone document.
*Information security roles and responsibilities have been clearly stated in every employees job description
*Management reviews of the ISMS are conducted at planned intervals.
Rebuildy applied for certification after two midterm management reviews and one annual internal audit Before the certification audit one of Rebuildy's former employees approached one of the audit team members to tell them that Rebuildy has several security problems that the company is trying to conceal. The former employee presented the documented evidence to the audit team member Electra, a key client of Rebuildy, also submitted evidence on the same issues, and the auditor determined to retain this evidence instead of the former employee's. The audit team member remained in contact with Electra until the audit was completed, discussing the nonconformities found during the audit. Electra provided additional evidence to support these findings.
At the beginning of the audit, the audit team interviewed the company's top management They discussed, among other things, the top management's commitment to the ISMS implementation. The evidence obtained from these discussions was documented in written confirmation, which was used to determine Rebuildy's conformity to several clauses of ISO/IEC 27001 The documented evidence obtained from Electra was attached to the audit report, along with the nonconformities report. Among others, the following nonconformities were detected:
*An instance of improper user access control settings was detected within the company's financial reporting system.
*A stand-alone information security policy has not been established. Instead, the company uses a security manual drafted based on best security practices.
After receiving these documents from the audit team, the team leader met Rebuildy's top management to present the audit findings. The audit team reported the findings related to the financial reporting system and the lack of a stand-alone information security policy. The top management expressed dissatisfaction with the findings and suggested that the audit team leader's conduct was unprofessional, implying they might request a replacement. Under pressure, the audit team leader decided to cooperate with top management to downplay the significance of the detected nonconformities. Consequently, the audit team leader adjusted the report to present a more favorable view, thus misrepresenting the true extent of Rebuildy's compliance issues.
Based on the scenario above, answer the following question:
Question:
Is it acceptable for the auditor to prioritize keeping the evidence provided by Electra over the evidence provided by the former employee?

• A. No, both sources of evidence should be retained and evaluated equally
• B. Yes, because evidence from a client is considered more reliable due to their independent status
• C. No, because evidence from a former employee is always more reliable than that from a client

You are an experienced ISMS audit team leader. During the conducting of a third-party surveillance audit, you decide to test your auditee's knowledge of ISO/IEC 27001's risk management requirements.
You ask her a series of questions to which the answer is either 'that is true' or 'that is false'. Which four of the following should she answer 'that is true'?

• A. Risk identification is used to determine the severity of an information security risk
• B. Risk assessments should be undertaken following significant changes
• C. The initial phase in an organisation's risk management process should be information security risk assessment
• D. The organisation must produce a risk treatment plan for every business risk identified
• E. ISO/IEC 27001 provides an outline approach for the management of risk
• F. The organisation must operate a risk treatment process to eliminate it's information security risks
• G. Risks assessments should be undertaken at monthly intervals
• H. The results of risk assessments must be maintained

You are an ISMS auditor conducting a third-party surveillance audit of a telecom's provider. You are in the equipment staging room where network switches are pre-programmed before being despatched to clients. You note that recently there has been a significant increase in the number of switches failing their initial configuration test and being returned for reprogramming.
You ask the Chief Tester why and she says, 'It's a result of the recent ISMS upgrade'. Before the upgrade each technician had their own hard copy work instructions. Now, the eight members of my team have to share two laptops to access the clients' configuration instructions online. These delays put pressure on the technicians, resulting in more mistakes being made'.
Based solely on the information above, which clause of ISO/IEC 27001:2022 would be the most appropriate to raise a nonconformity against? Select one.

• A. Clause 7.5 - Documented information
• B. Clause 8.1 - Operational planning and control
• C. Clause 10.2 - Nonconformity and corrective action
• D. Clause 7.2 - Competence

Question:
Which of the following can be considered a minor nonconformity?

• A. The information security policy lacks reference to continual ISMS improvement
• B. Lack of multi-factor authentication leaves accounts vulnerable to unauthorized access
• C. Employees lack training to recognize phishing attempts, increasing malware risks