The two true statements are B and E. According to ISO 19011:2022, the audit plan describes the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose1, while the audit programme describes the activities and arrangements for an audit2. The other options are either false or irrelevant. The responsibility for managing the audit programme rests with the audit programme manager, not the audit team leader (A)3. The audit plan can be changed during the conducting of the audit if necessary, with the agreement of the audit client and the auditee 4. The audit programme and the audit plan are not the same thing, so D and F are incorrect. Reference: 1: ISO 19011:2022, Guidelines for auditing management systems, Clause 3.8 \n2: ISO 19011:2022, Guidelines for auditing management systems, Clause 3.9 \n3: ISO 19011:2022, Guidelines for auditing management systems, Clause 5.3.1 \n4: ISO 19011:2022, Guidelines for auditing management systems, Clause 6.4.2
The management review is a key component of the "Check" stage in the Plan-Do-Check-Act (PDCA) cycle. Its primary purpose is to evaluate the overall ISMS and make strategic decisions for improvement. Here's why the other options are less accurate: * A . Random intervals: Reviews should be conducted at planned intervals for consistency and tracking progress. * B . Compliance: While compliance is a consideration, the main focus is on the system's suitability for the organization's needs, its adequacy in managing risks, and its overall effectiveness in achieving information security objectives. * D . Update: The management review might lead to updates, but its primary goal is evaluation, not immediate modification. Reference: * ISO/IEC 27001:2022, Section 9.3 (Management Review): Outlines the purpose and requirement for conducting management reviews.
Comprehensive and Detailed In-Depth Explanation: ISO/IEC 27001 does not prescribe a specific risk assessment methodology but instead provides general requirements for risk assessment. Organizations are free to develop their own risk assessment methods, as long as they: * Identify risks and impacts on information security. * Define risk criteria for evaluating risks. * Implement risk treatment plans based on the organization's context. A). Correct Answer: * ISO/IEC 27001 Clause 6.1.2 (Information Security Risk Assessment) states that organizations may define their own risk assessment methodology. * This approach must be systematic, measurable, and aligned with business objectives. B). Incorrect: * Organizations are not required to use a recognized methodology like OCTAVE, MEHARI, or EBIOS, as long as their approach meets ISO requirements. C). Incorrect: * ISO/IEC 27001 does not mandate a specific risk assessment method, only that a consistent and structured approach is used. Relevant Standard Reference: * ISO/IEC 27001:2022 Clause 6.1.2 (Information Security Risk Assessment Process)
Question 4
審計員發現，IT 部門 15 名員工中有兩人沒有接受足夠的資訊安全訓練。這代表什麼？
Correct Answer: A
This scenario represents an "audit finding." An audit finding refers to results that indicate a deviation from the expected performance or standards. Discovering that two employees have not received the required training is an audit finding indicating noncompliance with the organization's training requirements. References: ISO 19011:2018, Guidelines for auditing management systems
The AES (Advanced Encryption Standard) method is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting data1. This type of control is considered preventive because it is implemented to prevent unauthorized access to confidential information by ensuring that the data is unreadable to anyone who does not have the key. References: = The explanation is based on the general understanding of encryption as a security control within the field of information security, particularly as it pertains to the ISO/IEC 27001 standard for information security management systems (ISMS), which includes encryption as a preventive control measure.
