- Duration
- 5 days
- Level
- Lead auditor
- Formats
- Virtual instructor-led, In-house
- CPD hours
- 35
Course overview
This five-day course develops the expertise to lead first-, second- and third-party audits of an information security management system against ISO/IEC 27001:2022. You learn to plan an audit programme, lead an audit team, gather and evaluate evidence, grade nonconformities and report findings, using the principles of ISO 19011 and the certification-body requirements of ISO/IEC 17021-1 and ISO/IEC 27006.
Why attend
- Lead internal, supplier and certification-style audits
- Understand how certification bodies audit, so you can prepare your organisation
- Build a career path towards professional auditor certification
- Practise on a realistic multi-day audit case study
Who should attend
- Experienced internal auditors
- Aspiring certification auditors
- Supplier auditors
Learning objectives
- Lead first-, second- and third-party audits
- Manage an audit team
- Grade non-conformities consistently
Course agenda
Day 1Introduction to the ISMS and ISO/IEC 27001
- Information security fundamentals
- ISO/IEC 27001:2022 requirements and Annex A
- Certification process and accreditation
- Auditor roles and ethics
Day 2Audit principles, preparation and launch
- Audit principles and evidence-based approach
- Risk-based auditing
- Stage 1 audit and document review
- Preparing the Stage 2 audit plan and checklists
Day 3On-site audit activities
- Communication during the audit
- Interviewing, observing and sampling
- Audit test plans for key controls
- Drafting findings and nonconformities
Day 4Closing the audit
- Audit conclusions and recommendations
- Closing meeting and audit report
- Follow-up of corrective actions
- Surveillance and recertification audits
- Managing an internal audit programme
Day 5Case study review and exam
- Case study debrief
- Exam preparation
- Written exam
Prerequisites
A good understanding of ISO/IEC 27001 and information security. We recommend at least two years of experience in IT, security, audit or compliance.
Assessment and certificate
Written exam and case study. Continuous assessment of the audit case study and a 2-hour written exam on day 5, closed book. Pass mark 70%. Participants who pass receive a certificate of achievement. Options for accredited personnel certification exams are available on request.
Certificate: Certificate of achievement (on passing) or attendance from Secure iQube.
What is included
- Course slides and participant notes
- Practical workbook with exercises and case studies
- Templates you can adapt for your organisation
- Certificate of completion
- 30 days of post-course Q&A support by email
- Refreshments and lunch for classroom sessions
Dates
Public dates are announced regularly. Enquire below for the next date, or book a private session for your team on dates that suit you.