An organization wishes to demonstrate to an auditor that its operational processes were carried out as planned over the past year. Under Clause 8.1, what is the most appropriate form of evidence?
- A.Interview statements such as opinions, recollections and verbal assurances given by the process owners to the certification body
- B.Policy statements such as mission, scope and objectives approved by top management
- C.A signed declaration such as a letter, a memo, and a certificate from the process owner
- D.Documented information such as logs, records and outputs generated during the operation of the processes
Why D is correct
Clause 8.1 requires keeping documented information to have confidence that processes were carried out as planned. Operational records, logs and outputs are the evidence that demonstrates conformant execution to an auditor.
Know someone studying for ISO 27001? Send them this one.