ITPEC FE Morning April 2020 Question 58
Among situations that are identified as results of performing an ISMS internal audit on the basis of ISO/IEC 27001:2013 (Information security management systems—Requirements), which of the following is a situation that the auditor should record in the audit report as a finding?
Explanation
Risk acceptance criteria were determined after the risk assessment — ISO/IEC 27001 requires the criteria to exist before risks are assessed, so this is a nonconformity.
Clause 6.1.2 of ISO/IEC 27001:2013 requires the organization to establish information security risk criteria, including risk acceptance criteria, and then to perform assessments that produce consistent, valid and comparable results. Setting the acceptance criteria only after seeing the results lets them be fitted to the outcome, so the auditor records it as a finding.
Answer (a)
Why not others:
- •(b) — reporting an incident to the competent authority by specified procedures is incident management working as designed
- •(c) — detecting spyware with a malware scan and removing it shows the malware control is effective
- •(d) — permitting USB memory under defined procedures is a controlled exception, which is exactly what a procedure is for
Key rule: An audit finding is a gap between the requirement and practice; an incident handled by the prescribed procedure is evidence that controls work, not a finding.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.