ISO 27001 Internal Auditor Training Course

This ISO 27001 internal auditor course is suitable for:

Professionals responsible for conducting or supporting internal audits of an Information Security Management System (ISMS).

Information security and IT professionals involved in managing or maintaining an ISMS. ISMS managers, coordinators and implementation team members.

Quality, compliance and risk management professionals who need to understand information security management and auditing.

Employees involved in monitoring the effectiveness of information security processes and controls.

Individuals who want to develop their knowledge of ISO/IEC 27001:2022 and progress into internal auditing.

By the end of the course, delegates should be able to:

• Explain the purpose, benefits and fundamental concepts of an Information Security Management System (ISMS).
• Understand the structure, scope and applicability of ISO/IEC 27001:2022.
  Describe the main ISMS requirements, including leadership, planning, support,  opperation, performance evaluation and improvement.
  
• Explain the principles of information security risk assessment and risk treatment.
  
• Understand the purpose and role of ISO 27001 Annex A information security controls.
  
• Describe the principles, terminology and different types of audit.
  
• Explain how to manage an audit programme and prepare for an internal audit.
  
• Develop audit checklists and appropriate working documents.
  
• Apply audit techniques to interviews, document reviews, observations and evidence collection.
  
• Evaluate audit evidence and document findings, including nonconformities.
  
• Understand how to prepare audit conclusions, report results and carry out follow-up
  activities.
  
• Explain the competence, behaviour and evaluation expected of an auditor.

Day 1 – ISO 27001 and Information Security ManagementSystems

1. Information and information security concepts

• What information is and the different forms it can take.
• The importance of protecting organisational information.
• Confidentiality, integrity and availability.
• Understanding information security as a business and management responsibility.

2. Benefits and purpose of an ISMS

• What an Information Security Management System is.
• The purpose and benefits of implementing an ISMS.
• How an ISMS supports a structured approach to information security management.

3. Introduction to ISO/IEC 27001:2022

• The history, purpose and scope of the standard.
• Its applicability to different types and sizes of organisation.
• The structure and main requirements of ISO/IEC 27001:2022.

4. ISO 27001 process framework requirements

• Leadership and commitment.
• Planning and information security objectives.
• Support, resources, competence and awareness.
• Communication and documented information.
• Operational planning and control.
• Performance evaluation, management review and continual improvement.

5. Information security risk assessment and management

• The role of risk assessment within an ISMS.
• Identifying and evaluating information security risks.
• Risk treatment and the selection of appropriate responses.
• The relationship between risk management and information security controls.

6. ISO 27001 Annex A controls

• The purpose of Annex A as a reference set of information security controls.
• Understanding the role of controls in information security risk treatment.
• How controls support the protection of information and the operation of an ISMS.

7. Practical exercise

• Apply learning from the day through an exercise or case study.

Day 2 – ISO 27001 Internal Auditing

1. Audit principles and concepts

• The purpose and benefits of auditing.
• Different types of audit.
• Audit terminology, principles and the audit cycle.
• Introduction to ISO 19011:2018 guidance for auditing management systems.

2. Managing an audit programme

• Audit programme objectives and responsibilities.
• Risks and opportunities associated with audit programmes.
• Planning, implementing and managing audit activities.

3. Initiating and preparing for an audit

• Initiating audit activities.
• Preparing audit plans and working documents.
• Developing audit checklists.
• Understanding the responsibilities of auditors, auditees, guides and observers.

4. Conducting audit activities

• Opening meetings and communication during an audit.
• Interviewing, observing and reviewing documents and records.
• Collecting and verifying objective evidence.
• Evaluating information against the relevant audit criteria.

5. Audit findings and nonconformities

• Generating and evaluating audit findings.
• Identifying and documenting nonconformities.
• Preparing audit conclusions.
• Conducting closing meetings and communicating findings.

6. Audit reporting and follow-up

• Preparing and distributing audit reports.
• Writing clear nonconformity reports.
• Understanding corrective action and follow-up activities.
• Reviewing the outcome of audit follow-up.

7. Auditor competence and evaluation

• Auditor knowledge, skills and professional behaviour.
• Impartiality, communication and cultural awareness.
• Evaluating auditor competence.

8. Practical exercises and final examination

• Applying auditing techniques through practical exercises.
• Mock audit interviews and nonconformity report writing.
• Reviewing key learning and completing the final examination.

The ISO 27001 Internal Auditor Training Course combines information security management knowledge with practical auditing techniques to help delegates understand both the requirements of an ISMS and how its effectiveness can be evaluated.

Key benefits include:

Understand ISO 27001: Develop knowledge of the standard's requirements and the purpose of an ISMS.
Improve risk awareness: Understand information security risk assessment, risk
treatment and the role of Annex A controls.
Build auditing skills: Learn how to plan, prepare for and conduct internal audits.
Gather reliable evidence: Understand how to collect and evaluate objective evidence against audit criteria.
Report findings effectively: Develop knowledge of documenting nonconformities and preparing audit reports.
Support continual improvement: Understand how audit results and follow-up activities contribute to improving an ISMS.
Develop professional competence: Explore the responsibilities, behaviours and competence expected of an internal auditor. 

TÜV SÜD is trusted by over 16,000 companies and thousands of learners worldwide, reflecting our commitment to delivering quality training

The course uses tutor-led sessions, interaction, discussions, exercises, case studies and assignments to support learning across both days. 

Day 1 develops delegates' understanding of ISO/IEC 27001:2022, information security management, risk assessment and Annex A controls.

Day 2 builds on this foundation by exploring audit planning, evidence collection, audit findings, reporting and follow-up.

No formal prerequisites are specified in the supplied coursepresentation. A basic understanding of information security management systemsand ISO/IEC 27001 may be beneficial.

 What is ISO 27001 internal auditor training?

ISO 27001 internal auditor training develops knowledge ofISO/IEC 27001 requirements and the skills needed to plan, conduct and reportinternal audits of an Information Security Management System (ISMS). It coversinformation security management, risk assessment, controls, audit evidence,nonconformities and reporting. 

What does the two-day ISO 27001 Internal Auditor TrainingCourse cover?

Day 1 covers information security concepts, ISMS benefitsand requirements, risk assessment and management, and ISO 27001 Annex Acontrols. Day 2 focuses on audit principles, audit planning, conducting audits,checklists, audit findings, reporting, follow-up and auditor competence.Practical exercises and a final examination are also included. 

What is the difference between ISO 27001 and ISO 19011?ISO/IEC 27001 specifies requirements for an InformationSecurity Management System.

ISO 19011 provides guidance on auditing managementsystems, including audit principles, managing audit programmes, conductingaudits and evaluating auditor competence. This course covers the ISMSrequirements and introduces the auditing guidance used to support the internalaudit process. 

What are ISO 27001 Annex A controls?

Annex A provides a reference set of information securitycontrols that organisations consider as part of their risk treatment process.The selection and implementation of controls should be appropriate to theorganisation's information security risks and ISMS requirements.

 
Who should attend ISO 27001 internal auditor training?

The course is suitable for internal auditors, informationsecurity and IT professionals, ISMS coordinators, compliance and riskprofessionals, and others involved in implementing, maintaining or auditing aninformation security management system.

Instructor

Name: Jacqueline Daley
Job Title: Management Systems Trainer and Lead Auditor

Jacqueline has more than 30 years of experience working with management systems, compliance and business improvement across a wide range of industries and organisational settings.

Her experience combines consultancy, management system development and implementation, auditing and professional training, giving her a strong practical understanding of how International Organization for Standardisation requirements apply within real businesses. She currently works as a third-party Lead Auditor, undertaking certification audits against a variety of ISO Standards, including ISO 9001, ISO 14001, ISO 45001, and ISO 27001, alongside her wider consultancy and training activities.

Throughout her career, Jacqueline has supported organisations in developing, implementing and improving management systems, preparing for certification, managing risk and compliance, and embedding effective processes into day-to-day operations. Her training experience includes the delivery of management systems and compliance courses, webinars and bespoke programmes, as well as the development of course materials and practical implementation tools.

Jacqueline’s training style draws heavily on real world experience, using practical examples to make technical requirements understandable and relevant. Her focus is not simply on explaining the requirements of a standard, but on helping delegates understand how they can be applied effectively within their own organisations.