An organization realizes its operational documentation perfectly describes an idealized process, but staff actually follow a faster informal workaround. From a Clause 8.1 standpoint, why is this gap a problem even though work still gets done?
- A.The retained documented information no longer gives confidence the process is carried out as planned, because actual operation diverges from the documented plan
- B.The retained procedures breach Clause 7.2 competence, because staff following informal workarounds lack the training records the certification body expects to see
- C.The retained documented information fails the Clause 7.5.2 format rules, because the faster workaround was not approved by the document owner in the register
- D.The retained process descriptions are no longer in scope of the Statement of Applicability, because the workaround replaced the controls listed for the process
Why A is correct
Clause 8.1 requires keeping documented information sufficient to have confidence the process is carried out as planned. If reality diverges from the documented process, the documentation no longer evidences planned execution, and the actual workaround is uncontrolled and unassessed.
Know someone studying for ISO 27001? Send them this one.