In the context of a third-party certification audit, it is very important to have effective communication. Select an option that contains the correct answer about communication in an audit context.

• A. The formal communication channels between the audit team and the auditee can be established during the opening meeting
• B. During the audit, the responibility for communication rests with the audit team leader
• C. During the audit, each auditor should periodically communicate any concerns to the auditee and audit client
• D. There is no need to establish a formal communication arrangement because an auditee can communicate with the auditor at any time during the audit

You are performing an ISMS initial certification audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to conduct the closing meeting. During the final audit team meeting, as an audit team leader, you agree to report 2 minor nonconformities and 1 opportunity for improvement as below:

During the closing meeting, the Management System Representative (MSR) updates you with the information that ABC is going to merge with WeCare medical devices manufacture within the next 3 months. ABC will be the organisation's name after the merger. He asks if it is possible to include WeCare medical devices manufacture location in the follow-up audit so that the certification will include it. He says that WeCare is certified to ISO/IEC 27001:2022.
Select one option for the correct response to the request of the MSR.

• A. Advise that any changes will impact the certified scope of the initial audit. The organisation has the responsibility to update the certification body within an agreed timeframe so that a decision can be taken about incorporating WeCare.
• B. Advise that there are no issues. The new business can be included within the certified scope immediately if WeCare can obtain the agreement of their certification body
• C. Suggest it would be better to postpone the certification process and wait until the business acquisitior is completed
• D. Advise that an initial audit would need to be carried out on WeCare but this could be combined with a follow-up audit of ABC

CMM stands for?

• A. Capacity Maturity Matrix
• B. Capability Maturity Matrix
• C. Capable Mature Model
• D. Capability Maturity Model

You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security incident management process. The IT Security Manager presents the information security incident management procedure and explains that the process is based on ISO/IEC 27035-1:2016.
You review the document and notice a statement "any information security weakness, event, and incident should be reported to the Point of Contact (PoC) within 1 hour after identification". When interviewing staff, you found that there were differences in the understanding of the meaning of "weakness, event, and incident".
You sample incident report records from the event tracking system for the last 6 months with summarized results in the following table.

You would like to further investigate other areas to collect more audit evidence. Select two options that will not be in your audit trail.

• A. Collect more evidence on how and when the Human Resources manager pays the ransom fee to unlock personal mobile data, i.e., credit card, and bank transfer. (Relevant to control A.5.26)
• B. Collect more evidence on how the organisation determined the incident recovery time. (Relevant to control A.5.27)
• C. Collect more evidence on the incident recovery procedures. (Relevant to control A.5.26)
• D. Collect more evidence on how and when the company pays the ransom fee to unlock the company's mobile phone and data, i.e., credit card, and bank transfer. (Relevant to control A.5.26)
• E. Collect more evidence on what the service requirements of healthcare monitoring are. (Relevant to clause 4.2)
• F. Collect more evidence on how the organization determined no further action was needed after the incident. (Relevant to control A.5.26)
• G. Collect more evidence by interviewing more staff about their understanding of the reporting process.
  (Relevant to control A.6.8)