According to ISO/IEC 27001 controls, when planning audit tests and assurance activities involving operational systems, who should be involved in the agreement process except the tester?

According to ISO/IEC 27002, which provides implementation guidance for the controls listed in ISO/IEC 27001 Annex A, audit activities involving operational systems must be carefully planned and agreed upon to minimize disruption. The guidance explicitly states that the scope, timing, and procedures for such tests should be agreed with the "appropriate management." This ensures that the individuals with direct responsibility and authority over the system (e.g., system owners, process owners) are involved. They are best positioned to assess the potential impact on business processes, allocate necessary resources, and approve the testing plan, thereby managing the associated risks to system availability and integrity.

A. The top management: While top management has ultimate responsibility for the ISMS, they are not typically involved in the tactical planning and approval of specific audit tests on individual systems.
C. The board of directors: The board of directors provides governance and strategic oversight. They are not involved in operational-level agreements for technical audit activities.

1. ISO/IEC 27002:2013, Information technology — Security techniques — Code of practice for information security controls, Clause 12.7.1 Information systems audit controls. The implementation guidance for this control states: "The scope of technical audit tests should be agreed with appropriate management." This clause directly supports the need for agreement with the management level responsible for the system in question.

2. PECB. (2021). ISO/IEC 27001 Lead Implementer Courseware. Module: Annex A Controls (A.12 Operations Security). The official PECB training materials, in explaining the implementation of control A.12.7.1 (from the 2013 version), emphasize that to prevent disruptions to business operations, all audit and testing activities on production systems require prior planning and formal agreement with the relevant management authority responsible for those systems.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page. In the chapter discussing operations security, the authors explain that any verification, testing, or audit of operational systems must be formally authorized by the appropriate level of management to control the risk of adverse impacts on operations (p. 268). This reinforces the principle of involving management directly accountable for the system.