The audit team's approach to assessing risk and opportunity determination as a standalone activity is in line with established auditing norms, making option A the correct answer. ISO/IEC 27001:2022 requires organizations to identify risks and opportunities related to the ISMS and to plan actions to address them. From an audit perspective, ISO 19011 allows auditors to structure audit activities in a way that ensures effective coverage of critical requirements.
Assessing risk and opportunity determination independently does not violate auditing principles, provided it remains connected to the overall management system context. In practice, auditors often examine risk management as a distinct audit trail because it is a foundational element that influences many other ISMS processes, including control selection, operational planning, and continual improvement. Conducting a focused assessment enables auditors to evaluate whether risks are identified systematically, whether opportunities are considered, and whether treatment plans are appropriate and effective.
Option C is incorrect because although risk and opportunity management should be embedded throughout the ISMS, auditing it as a standalone activity does not contradict this principle. It is an audit structuring decision rather than a management system design issue. Option B is incorrect because auditors do not require explicit auditee requests to structure audit activities independently; they are responsible for designing the audit approach.
Therefore, the audit team's standalone assessment of risk and opportunity determination aligns with recommended auditing practices.