​This 3-day course provides the knowledge and skills required to perform internal audits of an organisation’s information security management system (ISMS) based on ISO 27001.

​

Who Should Attend

 

This course is aimed at:

• Individuals responsible for conducting internal ISMS audits, based on ISO 27001, or information security audits (see note).

• Newly appointed ISMS Managers, who need the core skills required for this important role.

• Those involved in ISMS implementation, operation, and maintenance

• Senior managers involved in, and/ or affected by, the outcome of ISMS audits

 

Note: Depending on the size of an organisation, internal ISMS audits may include a number of staff members, representing various departments such as HR, Finance, and Operations.

 

Learning Objectives

 

On completion of this course, delegates will be able to:

• Understand the principles of information security management systems’ auditing.

• Understand the relationship between the ISMS and compliance with specified requirements

• Plan, manage, and implement an internal audit programme.

• Provide guidance on conducting internal audits.

• Assess and evaluate the competence of other auditors in the organisation.

• Contribute in the development, implementation, and certification, (or re-certification) of an ISMS.

• Reduce duplication of effort, when conducting integrated management system (IMS) audits, e.g. combined information security and business continuity audit.

• Appreciate the challenges likely to be encountered in implementing ISM systems.

​

Benefits

 

• Participants will have a clear and practical understanding of how to plan and undertake Information Security Management System audits, in line with ISO 27001 requirements.

• Sponsoring organisations will be able to establish an internal audit programme, which will help to identify any gaps in ISO 27001 compliance, minimise risk to the business, and reduce avoidable costs.

​

Key Topics

 

• Information Security Management Systems and the role of internal auditing

• Terms and definitions used in ISO 27001.

• Overview of ISO 27001, from an internal audit perspective

• Establishing an audit programme, appropriate for an ISO 27001-based ISMS

• Selecting and training internal auditors

• Plan, conduct, report, and follow-up on an internal ISMS audit.

• Planning the audit

• Conducting the audit

• Identifying, and writing, evidence-based non-conformities of intent, implementation and effectiveness.

• Reporting audit findings

• Following up and verifying the implementation of corrective actions

• Dealing with difficult audit situations

• Auditing for compliance with the ISO 27001 standard

• Auditing for continual ISMS improvement

• Purpose of, and relationship between, the ISO 27001 and ISO 27002 standards.

• Application of ISO 19011/ISO 27007 audit processes to auditing an ISO 27001-based ISMS.

 

Prerequisites

 

No previous audit experience is required, and there are no formal entry requirements for attending the course.

 

It is assumed that delegates have a basic knowledge of ISO 27001 gained through:

• Practical on-the-job experience in information security

• Familiarity with the ISO 27001:2013 standard

• Attending the ISO 27001 Foundation training course. 

 

N.B. To derive maximum benefit from the Internal Auditor course, it is recommended that

delegates receive prior training, by attending the ISO 27001 Foundation Course.

 

Training Approach

 

This course covers both theory and practice, and comprises a series of interactive tutorials and team-based exercises, taking participants through every step of the audit process.

 

The course includes:

• Slide-based training sessions, illustrated with examples

• Business cases

• Preparation for the Foundation exam

• Practice test (mock exam) similar to the certification exam.

 

Examination

 

• Duration:     45 min.

• Format:       Closed book

• Questions   30 multiple-choice

• Pass mark: 70% (21 correct answers)

 

Certification

 

A certificate will be awarded following satisfactory completion and passing the exam.

 

General Course Information

​

For general course information please click on the link here.

​

N.B. Please read our Terms & Conditions (T&Cs) and ask for clarifications, if any, before booking your training event.

​

Book now to reserve an on-site or online instructor-led training event of your choice.

​

For more details about our:

• List of training courses please click here.

• Consulting services please click here

• Workshops please click here.

​

For queries, including non-obligation quotes, please contact us.

​

​