The correct answer is No, all processes listed in the ISMS scope must be audited, because the audit scope for certification must be consistent with the ISMS scope defined by the organization. ISO/IEC 27001 requires that the certification audit assess conformity of the entire ISMS as defined by its scope, not a selective subset of processes.
If HR processes are included in the ISMS scope, they are considered relevant to information security, for example through access management, onboarding and offboarding, training, and disciplinary procedures. Excluding such processes from the audit would result in incomplete coverage and undermine the validity of the certification decision.
Option A is incorrect because while audit programs and objectives influence audit planning, they cannot override the requirement to audit the full ISMS scope. The audit scope cannot be narrower than the ISMS scope for a certification audit. Option C is incorrect because ISO/IEC 27001 applies to people, processes, and technology, not only IT-related processes.
ISO/IEC 17021-1 requires certification bodies to ensure that audits cover all elements of the management system within scope. Therefore, excluding HR processes that are part of the ISMS scope is not acceptable.
