TRAINING PROGRAMME
ISO/IEC 27001:2022 ISMS Internal Auditor Certificate Programme
Assess information security risks and prepare audit plans and reports. A 60-hour programme covering ISO/IEC 27001:2022 and ISO 19011.
ABOUT THE PROGRAMME
A step towards your goals.
A 60-hour professional programme in protecting information assets, managing information security risks and contributing to ISMS internal audits.
Information security management · 30 hours
Explore ISO/IEC 27001:2022, clauses 4–10, organisational context, leadership, planning and performance evaluation. Study assets, risk analysis and treatment, Annex A controls, policies, procedures and the Statement of Applicability.
Internal auditing and practice · 30 hours
Use ISO 19011 principles, impartiality and professional ethics to prepare audit plans and checklists. Interviews, sampling, document review and evidence collection lead into nonconformity reporting, root cause analysis and corrective-action follow-up. A sample organisational audit and case work support preparation of an audit report.
What you will learn
- Interpret core ISO/IEC 27001:2022 requirements
- Evaluate information security risks
- Recognise Annex A security controls
- Prepare an internal audit plan and checklist
- Examine audit evidence
- Identify and report nonconformities
- Contribute to corrective-action follow-up
- Support continual improvement of an ISMS
Who is it for?
Computer, software and industrial engineers; IT and cybersecurity specialists; quality managers; internal auditors and candidates; information security managers; risk, data protection, compliance and internal control staff; IT project managers; business, banking and public-sector professionals; management-system consultants; and relevant university students.
Programme curriculum
01 Introduction to Information Security
Core concepts, confidentiality, integrity, availability and the ISMS approach.
02 The ISO/IEC 27001:2022 Standard
Structure, clauses 4–10, organisational context, leadership, planning and performance evaluation.
03 Information Security Risk Management
Identifying information assets, analysing and evaluating risks, and risk treatment.
04 Annex A Information Security Controls
Organisational, people, physical and technological security controls.
05 ISMS Documentation
Security policies, procedures, records and the Statement of Applicability.
06 Internal Audit Fundamentals
ISO 19011 auditing principles, auditor responsibilities, impartiality and professional ethics.
07 Planning an Internal Audit
Audit programmes, scope, criteria and preparing a checklist.
08 Conducting the Audit
Opening meetings, interviews, document review, sampling and gathering evidence.
09 Nonconformities and Audit Reporting
Findings, writing nonconformities, root cause analysis and following corrective actions.
10 Applied Internal Audit
A sample organisational audit, case analysis, preparing a report and evaluation.
CAREER OPPORTUNITIES
Career opportunities and application areas
Potential work settings
Information security, internal audit, quality, cybersecurity, IT, risk and compliance teams; management-system consultancies; banking, telecommunications, software, data centres, healthcare IT, e-commerce and public-sector IT units; and ISMS certification-preparation and data-protection projects.
Roles depend on existing education, experience, qualifications and applicable requirements. Employment is not guaranteed.
Certificate requirements
Complete the programme and its required assessments to become eligible. Certificate scope and recognition depend on the issuing institution and programme.
Participants who successfully complete the programme and assessment requirements receive a training certificate. It documents completed training and does not alone grant a regulated professional title or authority.
FREQUENTLY ASKED QUESTIONS
Frequently asked questions
How long is the programme?
There are 10 modules: 30 hours of ISMS topics and 30 hours of internal auditing, totalling 60 hours.
Which standards are covered?
The curriculum addresses ISO/IEC 27001:2022 requirements and ISO 19011 auditing principles.
Are Annex A controls included?
The relevant module covers organisational, people, physical and technological controls.
What does risk management cover?
Information asset identification, risk analysis, evaluation and treatment are included.
Will I study audit planning?
Audit programmes, scope, criteria and preparing a checklist form part of the curriculum.
Is practical work included?
A sample organisational audit, case analysis and audit report preparation are included.
Who is it for?
Professionals developing skills in security, IT, quality, auditing, risk or compliance, and relevant students.
Does this replace organisational ISO certification?
No. This is a personal training programme; organisational ISMS certification is a separate assessment process.
Does it grant lead auditor or certification authority?
Its scope is internal auditor training. It does not alone grant lead auditor or independent certification authority.
Is audit follow-up included?
Nonconformities, root cause analysis and following corrective actions are included.