- Duration
- 2 days
- Level
- Internal auditor
- Formats
- Virtual instructor-led, In-house
- CPD hours
- 14
Course overview
A two-day course that teaches you how to plan and carry out effective internal audits of an information security management system against ISO/IEC 27001:2022, following the guidance of ISO 19011:2026. The emphasis is on practice: interviewing, sampling evidence, writing clear findings and following up corrective actions.
Why attend
- Meet the internal audit requirement of ISO/IEC 27001 clause 9.2 with competent auditors
- Find real improvement opportunities, not just paperwork gaps
- Prepare your organisation for certification and surveillance audits
- Build an audit programme that fits your risks
Who should attend
- Internal auditors
- ISMS team members
- Compliance staff
Learning objectives
- Plan an audit using ISO 19011
- Gather and assess evidence
- Write clear findings
Course agenda
Day 1Audit principles and preparation
- ISO/IEC 27001:2022 requirements refresher
- Audit principles and ISO 19011:2026 guidance
- Audit programme and risk-based planning
- Preparing the audit plan and checklists
- Sampling and gathering objective evidence
Day 2Conducting and reporting the audit
- Opening meetings and interview techniques
- Auditing Annex A controls: practical exercises
- Grading nonconformities and observations
- Writing clear, factual findings
- Closing meetings, reporting and follow-up
- Test
Prerequisites
Familiarity with ISO/IEC 27001, for example through our Awareness course or working on an ISMS.
Assessment and certificate
Continuous assessment and test. Continuous assessment during the audit exercises and role plays, plus a 60-minute multiple-choice and short-answer test. Pass mark 70%. Participants who pass receive a certificate of achievement; others receive a certificate of attendance.
Certificate: Certificate of achievement (on passing) or attendance from Secure iQube.
What is included
- Course slides and participant notes
- Practical workbook with exercises and case studies
- Templates you can adapt for your organisation
- Certificate of completion
- 30 days of post-course Q&A support by email
- Refreshments and lunch for classroom sessions
Dates
Public dates are announced regularly. Enquire below for the next date, or book a private session for your team on dates that suit you.