Which one of the following should be reviewed against the audit criteria to determine audit...

•Audit Findings: These are the results of evaluating collected audit evidence against the predetermined audit criteria.

•Audit Evidence: Objective, verifiable information gathered through interviews, observations, document reviews, etc., that supports the audit findings.

•Audit Criteria: The standards, policies, procedures, or requirements of the ISMS that are used as benchmarks for the audit.

The Process: Auditors compare collected audit evidence against the audit criteria to determine whether there is conformity or nonconformity, leading them to generate audit findings.