According to ISO 19011:2018, which provides guidelines for auditing management systems, an opening meeting is a formal communication between the audit team and the auditee at the start of an audit1.The purpose of the opening meeting is to confirm the audit objectives, scope and criteria, introduce the audit team and their roles, confirm the audit plan and logistics, explain the audit methods and procedures, and establish the communication channels1. Therefore, if the Managing Director of the client organization invites the audit team to view a new company video lasting 45 minutes during the opening meeting of a Stage 2 audit, the audit team leader should respond in a way that does not compromise the effectiveness and efficiency of the audit or create any misunderstanding or conflict with the auditee.Two possible ways to respond are to advise the Managing Director that the audit team has to keep to the planned schedule, as there may be limited time and resources available for the audit; or to suggest that the video could be viewed during a refreshment break, if it is relevant and useful for the audit and does not interfere with other audit activities1. The other options are not appropriate responses for the audit team leader to make in this situation.For example, stating that the audit team leader will stay behind after the opening meeting to view the video on behalf of the team may imply that the video is not important or relevant for the rest of the audit team; inviting the Managing Director to the auditors' hotel for a viewing that evening may create an impression of bias or favouritism; stating that the audit team will make a decision on the viewing at a later time may be vague or indecisive; and advising the Managing Director that the audit team agrees to his request may result in wasting valuable audit time or losing focus on the audit objectives1.References:ISO 19011:2018 - Guidelines for auditing management systems

The benefits of implementing an ISMS primarily result from a reduction in information security risks. E. The purpose of an ISMS is to apply a risk management process for preserving information security. : According to the ISO 27001 standard, the benefits of implementing an ISMS include the following1:

Assuring customers and other stakeholders of the confidentiality, integrity and availability of information Enhancing the ability to respond to information security incidents and minimize their impacts Improving the governance and management of information security Reducing the costs and losses associated with information security breaches Increasing the competitiveness and reputation of the organization.

Complying with legal, regulatory and contractual obligations The purpose of an ISMS is to provide a systematic approach to managing information security risks, based on the Plan-Do-Check-Act (PDCA) cycle1. The ISMS enables the organization to establish, implement, maintain and continually improve its information security performance, in alignment with its business objectives and the needs and expectations of interested parties1. The ISMS consists of the following elements1:

The information security policy and objectives

The scope and boundaries of the ISMS

The processes and procedures for information security risk assessment and treatment

The resources and competencies for information security

The roles and responsibilities for information security

The performance evaluation and improvement of the ISMS

The internal and external communication and awareness of the ISMS References:

ISO/IEC 27001:2013, Information technology --- Security techniques --- Information security management systems --- Requirements, clauses 1, 4, 5, 6, 7, 8, 9 and 10

PECB Candidate Handbook ISO 27001 Lead Auditor, pages 9-11

ISO/IEC 27001:2013 Information Security Management Standards

4 Key Benefits of ISO 27001 Implementation | ISMS.online

ISO/IEC 27001:2022

An Introduction to the ISO 27001 ISMS | Secureframe

Comprehensive and Detailed In-Depth

A . Correct Answer:

Virtual audits require predefined remote access protocols to ensure secure, authorized

connections for data review.

ISO 19011:2018 provides guidelines for virtual auditing security measures.

B . Incorrect:

Internal audits may use remote access, but agreement is not mandatory.

C . Incorrect:

External audits may involve remote access but do not require predefined agreements in all cases.

Relevant Standard Reference:

Audit methods are the techniques and procedures that auditors use to collect and evaluate audit

evidence. Audit methods can be classified into two categories: those that involve human

interaction and those that do not. Human interaction methods are those that require direct or

indirect communication with the auditee or other relevant parties, such as interviews,

questionnaires, surveys, observations, or walkthroughs. Non-human interaction methods are

those that do not require any communication with the auditee or other parties, such as document

reviews, data analysis, or remote surveillance.

Some examples of audit methods that do not involve human interaction are:

Performing a review of auditee's procedures in preparation for an audit: This method involves

examining the auditee's documented information, such as policies, processes, records, or reports,

to verify their adequacy and effectiveness in meeting the audit criteri

a. The auditor does not need to interact with the auditee or anyone else to perform this method.

Analysing data by remotely accessing the auditee's server: This method involves accessing and

processing the auditee's data, such as performance indicators, logs, metrics, or statistics, to

verify their accuracy and reliability in meeting the audit criteria. The auditor does not need to

interact with the auditee or anyone else to perform this method.

ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) objectives and

content fromQuality.organdPECB

ISO 19011:2018 Guidelines for auditing management systems [Section 6.2.2]

The difference between a restricted and confidential document is that a restricted document is to be shared among named individuals, while a confidential document is to be shared among an authorized group. Restricted and confidential are examples of information classification levels that indicate the sensitivity and value of information and the degree of protection required for it. Restricted documents contain information that could cause serious damage or harm to the organization or its stakeholders if disclosed to unauthorized persons. Therefore, they should only be accessed by specific individuals who have a legitimate need to know and are authorized by the information owner. Confidential documents contain information that could cause damage or harm to the organization or its stakeholders if disclosed to unauthorized persons. Therefore, they should only be accessed by a defined group of people who have a legitimate need to know and are authorized by the information owner. ISO/IEC 27001:2022 requires the organization to classify information in terms of legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification (see clause A.8.2.1). Reference: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology — Security techniques — Information security management systems — Requirements, What is Information Classification?

The involvement of all the parties described in Scenario 4 is acceptable and aligns with ISO 19011:2018 guidance on auditing management systems, making option A the correct answer. ISO 19011 recognizes that audits may involve different participants beyond the audit team, including technical experts, guides, observers, and representatives of the auditee, provided their roles are clearly defined and managed.

In this scenario, a technical expert appointed by SendPay assisted the auditors by providing specific knowledge and expertise related to the outsourced software operations and technology infrastructure. This is explicitly permitted under ISO 19011, which allows the use of technical experts when specialized knowledge is required that the auditors themselves may not fully possess. The technical expert’s role is to support the audit team with subject-matter expertise, not to influence audit conclusions or replace auditor judgment.

Option B is incorrect because ISO 19011 does not prohibit the involvement of technical experts. On the contrary, their involvement is encouraged when auditing complex or highly technical areas, such as outsourced IT operations and cloud-based services. Option C is also incorrect because limiting participation to observers would not provide the auditors with the necessary technical insight to effectively evaluate outsourced operations.

As long as the audit team leader maintains control of the audit process and ensures independence and objectivity, the involvement of auditors, auditee representatives, and technical experts is appropriate. Therefore, the involvement of all the parties in this audit is acceptable under ISO auditing principles.

According to the PECB Candidate Handbook1, one of the principles of auditing is confidentiality, which means that auditors should respect the confidentiality of information obtained during the audit and not disclose it to unauthorized parties. The handbook also states that auditors should only report audit results to those who have a legitimate need to know, such as the client, the auditee, and the certification body. Therefore, sharing the findings with other relevant managers in A or B’s other customers would be a breach of confidentiality, as they are not directly involved in the audit process or the information security management system of B. Sharing the findings with B’s Information Security Manager or other relevant managers in B would be appropriate, as they are part of the auditee organization and responsible for the implementation and improvement of the ISMS. Sharing the findings with A’s supplier evaluation team or B’s certification body would also be acceptable, as they have a legitimate need to know the audit results for the purpose of supplier selection or certification, respectively. References: 1: PECB Candidate Handbook - ISO 27001 Lead Auditor, pages 7-8.