An organization realizes its operational documentation perfectly describes an idealized process, but staff actually follow a faster informal workaround. From a Clause 8.1 standpoint, why is this gap a problem even though work still gets done?
- A.Workarounds are always more secure than documented processes
- B.Clause 8.1 only cares about documentation, not actual operation
- C.There is no problem as long as the documents look complete
- D.The retained documented information no longer gives confidence the process is carried out as planned, because actual operation diverges from the documented plan
Why D is correct
Clause 8.1 requires keeping documented information sufficient to have confidence the process is carried out as planned. If reality diverges from the documented process, the documentation no longer evidences planned execution, and the actual workaround is uncontrolled and unassessed.
Know someone studying for ISO 27001? Send them this one.