In an information security audit, verifying the existence of documented policies and a Risk Treatment Plan is sufficient to confirm that security controls are operating effectively.

### Why this is right Those documents are specifically listed as examples checked during the initial review. The review also helps assessors and the organization become familiar with one another. ### The concept A documentation review checks whether key governance and planning artifacts exist and are sufficiently complete. Their presence alone does not prove that practices operate effectively, so the case also includes a more detailed formal check. ### Terms - **SoA**: Statement of Applicability. A document identifying which information-security controls apply in an organization’s management system. - **RTP**: Risk Treatment Plan. A plan describing how selected risks will be addressed. ### Remember Document review is an early evidence source, not a substitute for testing how practices work.