Skip to content
CybersecurityLead / Executive

ISO/IEC 27001 Lead Auditor

Master the audit of Information Security Management Systems and lead certification-readiness audits with confidence.

  • 5 days (40 training hours)
  • Live Virtual / In-House
  • Verifiable certificate

Course overview

This course prepares information security and compliance professionals to plan, conduct, report and follow up audits of an Information Security Management System against ISO/IEC 27001:2022, using the audit principles of ISO 19011 and the certification requirements of ISO/IEC 17021-1. Participants work through a full simulated audit of a case-study organisation, from the opening meeting to the final report.

Learning objectives

By the end of the course, participants will be able to:

  • Explain the structure and requirements of ISO/IEC 27001:2022, including the Annex A controls
  • Apply ISO 19011 audit principles to plan a risk-based ISMS audit
  • Collect and evaluate objective evidence through interviews, observation and document review
  • Grade findings as major or minor non-conformities, or opportunities for improvement
  • Write a clear audit report and verify the effectiveness of corrective actions
  • Lead an audit team and manage the audit from opening to closing meeting

Benefits

For you

  • Qualify to lead internal, supplier and second-party ISMS audits
  • Earn a certificate employers can verify online
  • Build practical audit skills through a full case-study audit

For your organisation

  • An in-house lead auditor to run the internal audit programme required by clause 9.2
  • Stronger preparation for Stage 1 and Stage 2 certification audits
  • Reduced reliance on external consultants for supplier assurance

Course content

  1. Day 1

    Information security and ISO/IEC 27001:2022

    ISMS concepts, context, scope, risk assessment and treatment, the Statement of Applicability and the 93 Annex A controls.

  2. Day 2

    Audit principles and planning

    ISO 19011 and ISO/IEC 17021-1, audit programmes, audit objectives, risk-based sampling and preparing the audit plan and checklists.

  3. Day 3

    Conducting the audit

    Opening meetings, interview technique, evidence collection, auditing technical controls and handling difficult situations.

  4. Day 4

    Findings and reporting

    Writing non-conformity statements, grading findings, closing meetings, audit reports and corrective action follow-up.

  5. Day 5

    Case-study audit and examination

    Leading a simulated audit end to end, followed by the written examination.

Who should attend

  • Information security managers and ISMS coordinators
  • Internal auditors and compliance officers
  • IT managers and consultants moving into audit roles

Prerequisites

Working knowledge of information security concepts. Familiarity with ISO/IEC 27001 is recommended but not required.

Assessment & certification

Continuous assessment of case-study exercises and a closed-book written examination on day five. Participants who pass receive a Vander certificate for 40 training hours with a unique, verifiable certificate ID.

How certificate verification works

Related courses

All courses