Discuss PECB ISO-IEC-27001-Lead-Auditor Exam Topic 3 Question 36

You are an experienced ISMS audit team leader guiding an auditor in training. You are testing her understanding of follow-up audits by asking her a series of questions to which the answer is either "true* or 'false'. Which four of the following questions should the answer be true"'

AA follow-up audit may be carried out where nonconformities are major

BA follow-up audit may be carried out where nonconformities are minor

CThe outcomes of a follow-up audit should be reported to top management and the audit team leader who carried out the audit where the nonconformities were initially identified

DThe outcome of a follow-up audit could lower a major nonconformity to minor status

EThe outcome of a follow-up audit could be a recommendabon to suspend the client's certification

FThe outcomes of a follow-up audit should be reported to the individual managing the audit programme and the audit client

GA follow-up audit is required in all instances where nonconformities have been identified

HA follow-up audit is required only in instances where a major nonconformity has been identified

Suggested Answer: A, B, C, F

A follow-up audit may be carried out where nonconformities are major. This is true because a major nonconformity is a situation that raises significant doubt about the ability of the organization's management system to achieve its intended results, and therefore requires immediate corrective action.A follow-up audit is necessary to verify the effectiveness of the corrective action and the conformity of the management system12.

A follow-up audit may be carried out where nonconformities are minor. This is true because a minor nonconformity is a situation that does not affect the capability of the management system to achieve its intended results, but represents a deviation from the specified requirements.A follow-up audit may be conducted to check the implementation of the corrective action and the improvement of the management system12.

The outcomes of a follow-up audit should be reported to top management and the audit team leader who carried out the audit where the nonconformities were initially identified. This is true because the top management is responsible for ensuring the effectiveness and continual improvement of the management system, and the audit team leader is accountable for the audit process and the audit conclusions.The follow-up audit report should provide them with objective evidence of the status of the nonconformities and the corrective actions taken by the auditee13.

The outcomes of a follow-up audit should be reported to the individual managing the audit programme and the audit client. This is true because the individual managing the audit programme is responsible for planning, implementing, monitoring and reviewing the audit activities, and the audit client is the organization or person requesting an audit.The follow-up audit report should inform them of the results of the follow-up audit and any changes in the certification status of the auditee13.

ISO 19011:2022 Guidelines for auditing management systems

ISO/IEC 27001:2022 Information technology --- Security techniques --- Information security management systems --- Requirements

ISO/IEC 17021-1:2022 Conformity assessment --- Requirements for bodies providing audit and certification of management systems --- Part 1: Requirements

Get Premium ISO-IEC-27001-Lead-Auditor Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

28 comments · newest first

Beata 10 months ago

A follow-up isn't required in every case, just saying.

Sharita 11 months ago

Reporting to top management is a must!

Gail 11 months ago

Wait, are we sure a follow-up is always needed?

Una 11 months ago

Totally agree, especially for minor ones too!

Mable 11 months ago

A follow-up audit can happen for major nonconformities.

Dana 12 months ago

I feel like the question about suspending certification could be true, but I can't recall if that's a common outcome of follow-up audits.

Dominque 12 months ago

I’m a bit confused about whether a follow-up audit is required for all nonconformities. I thought it depended on the severity.

Minna 12 months ago

I remember practicing a question about reporting outcomes to top management, and I think that one is true.

Gaston 1 year ago

I think a follow-up audit can definitely happen for both major and minor nonconformities, but I'm not sure if that's true for all cases.

Therese 1 year ago

Okay, let me think this through. A follow-up audit can be done for both major and minor nonconformities, and the outcomes should be reported to the right stakeholders. I'm confident I can identify the 4 true statements here.

Pamella 1 year ago

The true statements are the ones that accurately describe the purpose and outcomes of a follow-up audit. I'd focus on identifying those based on my knowledge of ISMS audit best practices.

Kendra 1 year ago

This question seems straightforward, but I want to make sure I understand the key points about follow-up audits before selecting the true statements.

Estrella 1 year ago

This is a good test of the auditor's understanding of follow-up audits. I'd advise the trainee to carefully read each statement and match it against their knowledge of the audit process and requirements.

Xochitl 1 year ago

I feel pretty confident about this one. The question states that the administrator was able to detect an attack using the log file information, so the answer must be detection indicators. That's the category that best fits the description.

France 1 year ago

For this type of question, I usually try to eliminate the options that don't quite fit the definition first. A and D don't seem to match the description of non-discretionary controls, so I'm leaning towards B or C as the best answer.

Kallie 1 year ago

I think brand awareness and perceived value are key indicators of brand equity, so I'm leaning towards Option A.

Cecilia 2 years ago

Wait, is this like a trick question? I mean, G and H can't both be true, right? That would just be confusing the poor auditor in training!

Gerry 2 years ago

Haha, I bet the person who wrote this question is a real stickler for the details! But I'd say A, B, C, and F are the correct 'true' answers.

Annalee 2 years ago

I agree with Grover. The outcome of a follow-up audit can also lower a major nonconformity to minor status, so D is also true.

Grover 2 years ago

A, B, C, and F are definitely true. The purpose of a follow-up audit is to verify that the organization has addressed any major or minor nonconformities identified in the initial audit.

Avery 2 years ago

↳ replying to Grover

F) True

Marsha 2 years ago

↳ replying to Grover

C) True

Leslee 2 years ago

↳ replying to Grover

B) True

Carylon 2 years ago

↳ replying to Grover

A) True

Lilli 2 years ago

↳ replying to Grover

F) True

Wei 2 years ago

↳ replying to Grover

C) True

Vanna 2 years ago

↳ replying to Grover

B) True

Art 2 years ago

↳ replying to Grover

A) True

PECB ISO-IEC-27001-Lead-Auditor Exam - Topic 3 Question 36 Discussion