ISO-27001-IA practice examsIn development

1. When conducting a follow-up audit to verify corrective action effectiveness, what does the auditor verify?

1. That the corrective action was implemented as planned and that the nonconformity has not recurred
2. Whether the corrective action has been fully documented only
3. That the corrective action was approved by top management
4. That the corrective action was completed within two weeks

Why: Follow-up verification requires the auditor to confirm two things: first, that the planned corrective action was actually implemented (not just planned or documented); and second, that the underlying nonconformity has been resolved and has not recurred. Effectiveness verification may require reviewing new records, re-interviewing staff, or re-observing the process.

2. The audit programme manager needs to report audit results to the management review. Which information is MOST important to include?

1. A summary of audit findings, trends, systemic issues, status of corrective actions, and recommendations for improvement
2. A complete copy of every individual audit report with all detailed working papers and evidence documentation attached
3. Only the number of nonconformities found, without context about their nature, root causes, or impact on effectiveness
4. Individual auditor performance ratings comparing each internal auditor's finding counts and efficiency during engagements

Why: Management review needs actionable information: summary of findings, trend analysis, status of corrective actions, and improvement recommendations. This enables informed decision-making about ISMS adequacy and improvement.