ISO-IEC-27001-LEAD-AUDITOR practice question 1 of 35

In the context of a third-party certification audit, it is very important to have effective communication. Select an option that contains the correct answer about communication in an audit context.

Full set: 368 questions
Answer options
A: During the audit, each auditor should periodically communicate any concerns to the auditee and audit client
B: During the audit, the responibility for communication rests with the audit team leader
C: The formal communication channels between the audit team and the auditee can be established during the opening meeting Correct answer
D: There is no need to establish a formal communication arrangement because an auditee can communicate with the auditor at any time during the audit
Correct Answer:
C. The formal communication channels between the audit team and the auditee can be established during the opening meeting
Explanation

Effective communication is crucial for a successful audit. The opening meeting, as defined by auditing guidelines, serves to establish the ground rules for the audit. A key function of this meeting is to confirm the formal communication channels, including the frequency of meetings (e.g., daily debriefs), points of contact for both the audit team and the auditee, and the process for escalating issues. This ensures a structured, efficient, and transparent flow of information throughout the audit engagement, preventing misunderstandings and delays. Establishing these protocols upfront is a hallmark of a professionally conducted audit.

Why Incorrect

A. Individual auditors communicating concerns directly can bypass the team leader, leading to inconsistent messaging and confusion. Communication should be managed centrally.
B. While the team leader has primary responsibility, all team members communicate during interviews. The statement is too absolute and less precise than C.
D. The absence of formal communication arrangements would lead to a chaotic and unprofessional audit. Structured communication is essential for clarity and efficiency.

References

1. ISO 19011:2018, "Guidelines for auditing management systems," Clause 6.4.3, "Conducting the opening meeting." This clause states that a purpose of the opening meeting is to confirm "the communication channels between the audit team and the auditee."

2. ISO/IEC 27006:2015, "Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems," Clause 9.2.3.1. This section on conducting the opening meeting references the requirements of ISO 19011, reinforcing the need to establish communication protocols.

3. S. T. Ali, "A Framework for Information Systems Auditing," International Journal of Network Security & Its Applications, vol. 3, no. 6, pp. 159-173, Nov. 2011. The paper discusses the audit process, emphasizing the importance of the opening meeting for setting expectations and communication protocols (Section 4.2). DOI: 10.5121/ijnsa.2011.3612

Scroll to Top