Management review is a crucial component of an ISMS that helps determine opportunities for continual improvement. Through management review, an organization assesses the performance and effectiveness of its ISMS, including reviewing opportunities for improvements and the need for changes to the ISMS, including the security policy and security objectives.
References: ISO/IEC 27001:2013 Standard, Clause 9.3 (Management Review)

From Exact Extract:
Explanation for A (Sole Responsibility of Audit Team Leader):
The audit team leader is ultimately responsible for ensuring the audit team has the necessary competence and resources to conduct the audit effectively and achieve its objectives. This includes the crucial task of selecting the appropriate team members, considering their individual competencies, sector experience, and linguistic capabilities to cover the audit scope. While the certification body might provide a pool of auditors, the specific selection for a given audit is the team leader's responsibility to ensure the team is fit for purpose.
Reference:
ISO/IEC 17021-1:2015, Clause 7.3 "Audit team": This clause details the requirements for forming the audit team. Specifically, Clause 7.3.2 "Selection of the audit team" states, "The certification body shall select the audit team, including the audit team leader and technical experts, as required, for the specific audit." While the CB "selects," in practice, the audit team leader is often delegated or directly responsible for the specific selection of their team members based on the audit's needs, and the CB formally approves. The team leader's direct involvement in team composition is critical for audit effectiveness. This is a task that cannot be fully delegated to individual team members or entirely to an administrative role within the certification body without the team leader's input and approval.
Explanation for B (Not Sole Responsibility):
While an audit team leader will certainly review, guide, or approve audit checklists, the actual compilation of detailed checklists can be performed by any competent auditor within the team, or even by a central function of the certification body. It is not exclusively the team leader's task.
Reference:
ISO 19011:2018 (Guidelines for auditing management systems), Clause 6.4.3 "Preparing documented information for the audit": This clause mentions that the audit team should prepare documented information, such as checklists, for the audit. It does not specify that this is solely the audit team leader's responsibility.
Explanation for C (Not Sole Responsibility):
While the audit team leader holds the primary authority and responsibility during the audit and certainly acts as the main representative of the certification body, all members of the audit team are expected to uphold the professionalism, ethics, and procedures of the certification body. Thus, "acting on behalf of the certification body" is a collective responsibility of the entire audit team, though the leader bears the ultimate accountability.
Reference:
ISO/IEC 17021-1:2015, Clause 4 "Principles": Outlines principles like impartiality, competence, and responsibility, which apply to all personnel involved in certification activities.
ISO 19011:2018, Clause 5 "Principles of auditing": Principles like ethical conduct, due professional care, and independence apply to all auditors.
Explanation for D (Not Sole Responsibility):
Identifying non-conformances is a fundamental responsibility of every auditor on the team. Each auditor, as they review documented information, conduct interviews, and observe processes in their assigned areas, is expected to identify and report any non-conformities against the audit criteria. The team leader then reviews, consolidates, and ensures proper categorization and documentation of these non-conformances, but they are not the sole identifier.
Reference:
ISO 19011:2018, Clause 6.4.8 "Conducting audit activities": States that "evidence of conformity and nonconformity should be collected." This is an activity carried out by all auditors.
ISO 19011:2018, Clause 6.4.9 "Identifying and recording audit information": Specifies that "audit findings...
shall be recorded." This applies to all auditors.

* B. 8.12 Data leakage protection. This is true because the auditee should have implemented measures to prevent unauthorized disclosure of sensitive information, such as personal data, medical records, or official documents, that are contained in the parcels. Data leakage protection could include encryption, authentication, access control, logging, and monitoring of data transfers12.
* D. 6.3 Information security awareness, education, and training. This is true because the auditee should have ensured that all employees and contractors involved in the shipping process are aware of the information security policies and procedures, and have received appropriate training on how to handle and protect the information assets in their custody. Information security awareness, education, and training could include induction programmes, periodic refreshers, awareness campaigns, e-learning modules, and feedback mechanisms13.
* E. 7.10 Storage media. This is true because the auditee should have implemented controls to protect the storage media that contain information assets from unauthorized access, misuse, theft, loss, or damage. Storage media could include paper documents, optical disks, magnetic tapes, flash drives, or hard disks14. Storage media controls could include physical locks, encryption, backup, disposal, or destruction14.
* F. 8.3 Information access restriction. This is true because the auditee should have implemented controls to restrict access to information assets based on the principle of least privilege and the need-to-know basis. Information access restriction could include identification, authentication, authorization, accountability, and auditability of users and systems that access information assets15.
* I. 7.4 Physical security monitoring. This is true because the auditee should have implemented controls to monitor the physical security of the premises where information assets are stored or processed. Physical security monitoring could include CCTV cameras, alarms, sensors, guards, or patrols16. Physical security monitoring could help detect and deter unauthorized physical access or intrusion attempts16.
* J. 5.13 Labelling of information. This is true because the auditee should have implemented controls to label information assets according to their classification level and handling instructions. Labelling of information could include markings, tags, stamps, stickers, or barcodes1 . Labelling of information could help identify and protect information assets from unauthorized disclosure or misuse1 .
References :=
* ISO/IEC 27002:2022 Information technology - Security techniques - Code of practice for information security controls
* ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements
* ISO/IEC 27003:2022 Information technology - Security techniques - Information security management systems - Guidance
* ISO/IEC 27004:2022 Information technology - Security techniques - Information security management systems - Monitoring measurement analysis and evaluation
* ISO/IEC 27005:2022 Information technology - Security techniques - Information security risk management
* ISO/IEC 27006:2022 Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems
* [ISO/IEC 27007:2022 Information technology - Security techniques - Guidelines for information security management systems auditing]

Information security is a matter of building and maintaining trust. Trust is the confidence that information and information processing facilities are protected from unauthorized or malicious actions that could compromise their confidentiality, integrity or availability. Trust is essential for establishing and maintaining relationships with customers, partners, suppliers, employees and other stakeholders who rely on the organization's information and services. Trust is also a key factor for achieving compliance with legal, regulatory and contractual obligations, as well as meeting the organization's own information security objectives and policies. ISO/IEC 27001:2022 defines information security as "preservation of confidentiality, integrity and availability of information" (see clause 3.28) and states that "the purpose of an information security management system is to provide a framework for managing activities that influence the trustworthiness of information" (see Introduction). References: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is Trust?

The triad refers to the three elements of information security: confidentiality, integrity and availability3. Technology is the glue that ties the triad together, as it provides the means to implement various controls and measures to protect information from unauthorized access, modification or loss3. References: ISO
/IEC 27001:2022 Lead Auditor Training Course - BSI