The auditor should verify that the selected controls are included in the Statement of Applicability (SoA), making option C the correct answer. ISO/IEC 27001:2022 requires organizations to document which Annex A controls are applicable based on the results of the risk assessment and risk treatment process. The SoA is the formal document that records these decisions, including justification for inclusion or exclusion of controls.
The existence of a risk assessment alone is not sufficient. Auditors must confirm traceability between identified risks, selected controls, and their formal documentation in the SoA. This ensures transparency, consistency, and accountability in how the organization manages information security risks.
Option A is incorrect because ISO/IEC 27001 does not require organizations to use external consultants for risk assessments. Risk assessments may be conducted internally, provided they follow a defined and systematic methodology. Option B is incorrect because controls can be preventive, detective, or corrective; there is no requirement that selected controls be corrective only.
Therefore, verifying that selected controls are properly reflected in the Statement of Applicability is a mandatory audit activity and a core requirement of ISO/IEC 27001 compliance.

According to ISO/IEC 27001, organizations must control planned changes and review the consequences of unintended changes in order to ensure continued alignment with information security requirements. In this scenario, the organization failed to perform appropriate testing after an emergency update to the mobile app, which constitutes a nonconformity with clause 8.1 of the standard.
**References**:
- ISO/IEC 27001 Lead Auditor Reference Materials
- PECB Candidate Handbook for ISO 27001 Lead Auditor
ISO/IEC 27001 requires that organizations adhere to their established procedures for software security management. The IT Manager's approval of the app despite failed security tests and lack of proper documentation for the new version indicates noncompliance with the procedure, thus reflecting a nonconformity.
**References**:
- ISO/IEC 27001 Lead Auditor Reference Materials
- PECB Candidate Handbook for ISO 27001 Lead Auditor

From Exact Extract:
Explanation for A (Sole Responsibility of Audit Team Leader):
The audit team leader is ultimately responsible for ensuring the audit team has the necessary competence and resources to conduct the audit effectively and achieve its objectives. This includes the crucial task of selecting the appropriate team members, considering their individual competencies, sector experience, and linguistic capabilities to cover the audit scope. While the certification body might provide a pool of auditors, the specific selection for a given audit is the team leader's responsibility to ensure the team is fit for purpose.
Reference:
ISO/IEC 17021-1:2015, Clause 7.3 "Audit team": This clause details the requirements for forming the audit team. Specifically, Clause 7.3.2 "Selection of the audit team" states, "The certification body shall select the audit team, including the audit team leader and technical experts, as required, for the specific audit." While the CB "selects," in practice, the audit team leader is often delegated or directly responsible for the specific selection of their team members based on the audit's needs, and the CB formally approves. The team leader's direct involvement in team composition is critical for audit effectiveness. This is a task that cannot be fully delegated to individual team members or entirely to an administrative role within the certification body without the team leader's input and approval.
Explanation for B (Not Sole Responsibility):
While an audit team leader will certainly review, guide, or approve audit checklists, the actual compilation of detailed checklists can be performed by any competent auditor within the team, or even by a central function of the certification body. It is not exclusively the team leader's task.
Reference:
ISO 19011:2018 (Guidelines for auditing management systems), Clause 6.4.3 "Preparing documented information for the audit": This clause mentions that the audit team should prepare documented information, such as checklists, for the audit. It does not specify that this is solely the audit team leader's responsibility.
Explanation for C (Not Sole Responsibility):
While the audit team leader holds the primary authority and responsibility during the audit and certainly acts as the main representative of the certification body, all members of the audit team are expected to uphold the professionalism, ethics, and procedures of the certification body. Thus, "acting on behalf of the certification body" is a collective responsibility of the entire audit team, though the leader bears the ultimate accountability.
Reference:
ISO/IEC 17021-1:2015, Clause 4 "Principles": Outlines principles like impartiality, competence, and responsibility, which apply to all personnel involved in certification activities.
ISO 19011:2018, Clause 5 "Principles of auditing": Principles like ethical conduct, due professional care, and independence apply to all auditors.
Explanation for D (Not Sole Responsibility):
Identifying non-conformances is a fundamental responsibility of every auditor on the team. Each auditor, as they review documented information, conduct interviews, and observe processes in their assigned areas, is expected to identify and report any non-conformities against the audit criteria. The team leader then reviews, consolidates, and ensures proper categorization and documentation of these non-conformances, but they are not the sole identifier.
Reference:
ISO 19011:2018, Clause 6.4.8 "Conducting audit activities": States that "evidence of conformity and nonconformity should be collected." This is an activity carried out by all auditors.
ISO 19011:2018, Clause 6.4.9 "Identifying and recording audit information": Specifies that "audit findings...
shall be recorded." This applies to all auditors.

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 8.1 requires an organization to plan, implement and control its processes needed to meet ISMS requirements2. This includes determining what needs to be done, how it will be done, who will do it, when it will be done, what resources are required, how performance will be evaluated, etc2. Therefore, if an ISMS auditor conducting a third-party surveillance audit of a telecom's provider notes that there has been a significant increase in the number of switches failing their initial configuration test and being returned for reprogramming due to a recent ISMS upgrade that reduced access to work instructions, this indicates a nonconformity against clause 8.1 of ISO/IEC 27001:2022. The organization has failed to plan and control its operational processes effectively to ensure information security and quality2. The other options are not correct clauses to raise a nonconformity against based solely on this information. For example, clause 7.5 deals with documented information required by ISMS or determined by an organization as necessary for its effectiveness2, but it does not specify how many copies or formats of work instructions should be available; clause 10.2 deals with nonconformity and corrective action as a response to an identified problem or incident2, but it does not address how to prevent or avoid such problems or incidents in operational processes; clause 7.3 deals with awareness of ISMS policy, objectives, roles and responsibilities among persons doing work under an organization's control2, but it does not relate to how work instructions are accessed or followed; clause 7.2 deals with competence of persons doing work under an organization's control that affects its ISMS performance2, but it does not imply that lack of competence is caused by insufficient work instructions; clause 7.4 deals with communication about ISMS among internal and external interested parties2, but it does not cover how operational information is communicated within an organization. References: ISO/IEC 27001:2022 - Information technology - Security techniques - Information security management systems - Requirements