Q: 2
Scenario 3: NightCore is a multinational technology company based in the United States that focuses
on e-commerce, cloud computing, digital streaming, and artificial intelligence. After having an
information security management system (ISMS) implemented for over 8 months, they contracted a
certification body to conduct a third party audit in order to get certified against ISO/IEC 27001.
The certification body set up a team of seven auditors. Jack, the most experienced auditor, was
assigned as the audit team leader. Over the years, he received many well known certifications, such
as the ISO/IEC 27001 Lead Auditor, CISA, CISSP, and CISM.
Jack conducted thorough analyses on each phase of the ISMS audit, by studying and evaluating every
information security requirement and control that was implemented by NightCore. During stage 2
audit. Jack detected several nonconformities. After comparing the number of purchased invoices for
software licenses with the software inventory, Jack found out that the company has been using the
illegal versions of a software for many computers. He decided to ask for an explanation from the top
management about this nonconformity and see whether they were aware about this. His next step
was to audit NightCore's IT Department. The top management assigned Tom, NightCore's system
administrator, to act as a guide and accompany Jack and the audit team toward the inner workings of
their system and their digital assets infrastructure.
While interviewing a member of the Department of Finance, the auditors discovered that the
company had recently made some unusual large transactions to one of their consultants. After
gathering all the necessary details regarding the transactions. Jack decided to directly interview the
top management.
When discussing about the first nonconformity, the top management told Jack that they willingly
decided to use a copied software over the original one since it was cheaper. Jack explained to the top
management of NightCore that using illegal versions of software is against the requirements of
ISO/IEC 27001 and the national laws and regulations. However, they seemed to be fine with it.
Several months after the audit, Jack sold some of NightCore's information that he collected during
the audit for a huge amount of money to competitors of NightCore.
Based on this scenario, answer the following question:
What type of audit evidence has Jack collected when he identified the first nonconformity regarding
the software? Refer to scenario 3.
Options
Discussion
Makes sense to pick C here. Jack compared the exact number of purchased licenses to what's installed, so that's classic mathematical evidence-he used quantifiable data, not just analysis or conversation. I think that's what ISO/IEC 27001 expects, right? Open to other takes.
C, similar question popped up in a recent mock. Numbers from invoices and inventory checks point to mathematical evidence here. Makes sense?
C fits best. Jack literally matched the number of software licenses bought (from invoices) to the number in use, which is straight up mathematical evidence in audit terms. He wasn't just analyzing or interviewing, he was counting and comparing real numbers. Pretty sure that's what ISO/IEC 27001 means by this, but let me know if you think differently!
Call it A. Comparing invoices and inventories looks like analysis, not just pure math. Analytical evidence makes sense here, I think.
I don't think it's A. Comparing license invoices with software inventory is pure numbers, so that's C (mathematical evidence). Analytical evidence would be more about interpreting patterns or trends, but Jack's just matching counts here. This kind of question trips people up sometimes!
A . The way I read it, Jack analyzed the invoices and software inventory, so that's more about analytical evidence. He didn't just count, he evaluated and interpreted the info. Not 100% though, could see why people go with C.
Option A based on what I've seen in the official guide and some practice sets.
Probably C. Jack literally compared invoice counts to installed software, so that's a numbers game-definitely mathematical evidence per ISO audit lingo. Analytical would imply deeper pattern analysis, but here it's just checking totals. Pretty confident, unless I'm missing something obvious?
A seems more like a trap, since counting invoices vs installed software is strictly numbers-C fits better in this scenario.
Not A, C. Jack directly compared the count of licenses from invoices against the actual software inventory, which is straight up numerical and quantifiable-classic mathematical evidence in ISO auditing. Analytical would be more about patterns or trends, but here it's all about those hard numbers. Pretty sure about C, though let me know if you see it different.
Be respectful. No spam.
