MENU
As an auditor, you have noticed that ABC Inc. has established a procedure to manage the removable storage medi
a. The procedure is based on the classification scheme adopted by ABC Inc. Thus, if the information stored is classified as "confidential," the procedure applies. On the other hand, the information that is classified as "public," does not have confidentiality requirements: thus, only a procedure for ensuring its integrity and availability applies. What type of audit finding is this?
Suggested Answer: C
Get Premium ISO-IEC-27001-Lead-Auditor Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
This scenario represents a conformity because ABC Inc. has implemented procedures for managing removable storage media that align with the classification scheme of the information stored. When information is classified as 'confidential,' more stringent procedures apply, whereas for 'public' information, the procedures focus only on integrity and availability, following the organization's defined information classification policy.
32 comments · newest first
JU
Junita
10 months ago
This seems off, I doubt that’s the right classification approach.
CO
Colette
11 months ago
Totally agree, it should be a nonconformity!
AN
Angelica
11 months ago
Wait, are they really classifying public info like that?
SH
Shalon
11 months ago
I think it's more of an anomaly.
BR
Brandon
11 months ago
Sounds like a nonconformity to me.
RO
Rosenda
12 months ago
I practiced a question similar to this, and I think it was about nonconformities too. If the procedure doesn't cover all data types properly, it could definitely be a nonconformity.
MA
Mammie
12 months ago
I feel like this is a conformity issue because they have procedures in place, but I guess it depends on whether those procedures are adequate for all classifications.
RA
Raina
12 months ago
I'm not entirely sure, but I think an anomaly might be when something unusual occurs, and this seems more like a standard procedure issue.
BL
Blondell
1 year ago
I remember discussing how a nonconformity indicates a failure to meet established requirements, so I think this might be a nonconformity since the procedure doesn't apply uniformly.
MI
Mirta
1 year ago
I'm pretty confident this is a nonconformity. The company has established a specific procedure for confidential information, but not for public information, which doesn't align with their own classification scheme. I'll make sure to explain that clearly in my answer.
LE
Lemuel
1 year ago
Okay, I think I've got this. The key is that the company has a defined procedure for managing confidential information, but not for public information. So the audit finding would be a nonconformity, since the procedure is not being applied consistently.
TE
Telma
1 year ago
Hmm, I'm a bit confused by the wording here. Is the issue that the company has different procedures for confidential vs. public information? I'll need to think through the implications of that to figure out the right audit finding.
SE
Selene
1 year ago
This seems like a straightforward question about audit findings. I'll need to carefully review the details about the company's classification scheme and procedures to determine the appropriate audit finding.
CA
Carmen
1 year ago
Hmm, I'm not sure if that's the best approach. Wouldn't it be better to just ask the customer's age directly and then use that to determine the age group? That way we don't have to worry about the synonyms and can be more accurate.
JA
Jamika
2 years ago
I believe it could also be considered a nonconformity finding, as there may be a lack of confidentiality requirements for certain information.
SA
Sage
2 years ago
What kind of company has 'public' information that doesn't need to be managed? Sounds like they're asking for trouble. I'd go with nonconformity on this one.
CA
Carlene
2 years ago
Hmm, I'm not so sure. If the company doesn't have any requirements for public information, then maybe this is just an anomaly rather than a nonconformity. It depends on the specific policies and procedures.
LA
Lawanda
2 years ago
I agree with Bulah, it seems to be a conformity finding based on the procedure matching the classification scheme.
MO
Mozell
2 years ago
I agree, this is definitely a nonconformity. The company's own classification scheme is not being consistently applied, which is a control issue.
RE
Ressie
2 years ago
Anomaly
TA
Tamekia
2 years ago
Nonconformity
CE
Cecily
2 years ago
The company's own classification scheme is not being consistently applied, which is a control issue.
LA
Lashawna
2 years ago
I agree, this is definitely a nonconformity.
MU
Murray
2 years ago
This seems like a clear case of a nonconformity. The company has established a procedure for managing confidential information, but it doesn't apply to public information. That's a gap in their policy.
ZE
Zena
2 years ago
Makeda: They should address this gap in their policy to ensure compliance.
KA
Kathrine
2 years ago
B) Anomaly
PE
Peggie
2 years ago
It's important for them to have consistent procedures in place.
MA
Makeda
2 years ago
I agree, they need to ensure all information is managed properly.
KI
Kirk
2 years ago
I agree, it definitely seems like a nonconformity. They need to ensure their procedure covers all types of information.
LE
Leanna
2 years ago
A) Nonconformity
CA
Cassi
2 years ago
This is definitely a nonconformity.
BU
Bulah
2 years ago
I think this is a conformity finding.