Certbie
Question 1 of 30
Benchmark analysis indicates that a newly acquired subsidiary\'s information security risk analysis and evaluation process, while documented, employs a significantly different methodology and set of criteria compared to the established organizational standard of the parent company. As the ISO 27001 Lead Auditor, what is the most appropriate course of action to ensure the integrity and effectiveness of the integrated Information Security Management System (ISMS)?
Conduct a detailed review of the subsidiary's risk analysis and evaluation methodology to determine its conformity with ISO 27001:2022 requirements and its effectiveness in managing information security risks, recommending a phased approach for alignment if compliant, or corrective actions if not.
Mandate the immediate adoption of the parent company's risk analysis and evaluation methodology by the subsidiary to ensure uniformity across the ISMS.
Accept the subsidiary's risk analysis and evaluation process as is, provided it is documented, without further assessment of its alignment with ISO 27001:2022 or its effectiveness.
Focus solely on the documentation of the subsidiary's risk analysis process, ensuring it meets the parent company's internal procedural standards, and disregard its actual effectiveness in risk management.

Preparing for ISO 27001 Lead Auditor? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free