ISOISO 27001Continual ImprovementEASYFree question
An organization wants a single source-of-truth for all nonconformities regardless of origin. Which combined set of inputs should feed this register to satisfy a comprehensive Clause 10.2 process?
- A.Supplier invoices, procurement approvals, marketing campaigns, and board meeting agendas kept by the finance team
- B.Certification fees, auditor travel claims, accreditation certificates, and calendar invitations for the surveillance audit
- C.Payroll runs, staff turnover reports, recruitment plans, and office lease renewals managed by human resources
- D.Internal and external audit findings, security incidents, complaints, and monitoring/measurement deviations
Why D is correct
Nonconformities arise from multiple channels. A comprehensive register consolidates audit findings (internal and external), incidents, complaints from interested parties, and deviations detected through monitoring and measurement, ensuring all sources feed one corrective action process.
Know someone studying for ISO 27001? Send them this one.