The audit team stated that the risk of a significant defect occurring in Data Grid Inc.'s ISMS was low. This refers to "Control Risk," which is the risk that a misstatement could occur in any relevant assertion related to an ISMS and that the risk could not be prevented or detected on a timely basis by the organization's internal control systems.
References: ISO 19011:2018, Guidelines for auditing management systems

This situation is unacceptable because UpNet should have requested and been granted an extension audit prior to announcing that the ISMS certification scope encompasses the whole company, including the new department. Proper procedures need to be followed to extend the certification to additional departments or processes.

The three options that will not be in your audit trail are A, C, and H. These options are either not relevant to the information security of ABC's healthcare mobile app development, support, and lifecycle process, or not within the scope of your audit. The amount of money that residents' family members pay to install the app (A) and the number of users of the app are not related to the information security aspects or objectives of the ISMS1. The verification of the developer's certifications (H) is not your responsibility as an ISMS auditor, as you should rely on the competence and impartiality of the certification bodies that issued them2. The other options are relevant and within the scope of your audit, as they relate to the security functions, testing, policies, and procedures of the mobile app development, support, and lifecycle process13. References: 1: ISO
/IEC 27001:2022, Information technology - Security techniques - Information security management systems - Requirements, Clause 4.2 \n2: ISO/IEC 27006:2022, Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems, Clause 4.1 \n3: PECB Certified ISO/IEC 27001 Lead Auditor Exam Preparation Guide, Domain 5:
Conducting an ISO/IEC 27001 audit

The purpose of retaining documented information related to the ISMS of an organisation is to the extent necessary, to have confidence that the processes have been carried out as planned. This means that the documented information provides evidence of the conformity and effectiveness of the ISMS, as well as the achievement of the information security objectives and the continual improvement of the ISMS. Documented information also supports the analysis and evaluation of the ISMS performance and the identification of opportunities for improvement. References: = ISO/IEC 27001:2022, clause 7.5.1; PECB Candidate Handbook ISO 27001 Lead Auditor, page 17.

It was appropriate for the audit team to include the observed deficiency in the audit report, making option A the correct answer. ISO/IEC 17021-1 and ISO 19011 require auditors to report all relevant findings that relate to conformity with the audit criteria, regardless of whether the affected department is formally listed within the audit scope. What matters is whether the issue relates to ISMS requirements or policies.
In this scenario, access rights control is explicitly included in Sinvestment's information security policy and is a core requirement of ISO/IEC 27001. The absence of access control procedures in the marketing department represents a weakness in the implementation of an ISMS requirement. Even though the marketing department was not part of the defined audit scope, the auditors became aware of a condition that could negatively affect the effectiveness of the ISMS as a whole.
Option B is incorrect because merely communicating the issue informally would undermine transparency and traceability. Audit reports must provide a complete and accurate record of findings. Option C is incorrect because marketing departments frequently handle personal data and sensitive information, particularly in an insurance context, and therefore clearly pose potential ISMS risks.
Auditors are required to report relevant findings objectively and without omission. Therefore, inclusion of the issue in the audit report was appropriate.