問題文
An auditee has written a policy for each of the ninety-three reference controls and says the management system is therefore complete. The audit team finds no record of a management review and no internal audit. What does the auditor conclude?
選択肢
- The reference controls address the technique alone, so the requirements covering the management still have to be separated, so the reporting of them follows the heading.
- The reference controls complement the clauses instead, so the requirements covering the improvement still have to be satisfied, so the absence of them produces the finding.
- The reference controls bind the organization immediately, so the requirements covering the improvement still have to be deferred, so the review of them awaits the year.
- The reference controls satisfy the clauses indirectly, so the requirements covering the evaluation still have to be inferred, so the shortage of them affects the evidence.