Skip to content
CybersecurityLead / Executive

ISO/IEC 27001 Lead Auditor

Master the audit of Information Security Management Systems and lead certification-readiness audits with confidence.

  • 5 days (40 training hours)
  • Live Virtual / In-House
  • Verifiable certificate

Download the course brochure

ISO/IEC 27001 Lead Auditor: objectives, day-by-day content, assessment and delivery options in one document. A training advisor may follow up about dates and fees.

Course overview

This course prepares information security and compliance professionals to plan, conduct, report and follow up audits of an Information Security Management System against ISO/IEC 27001:2022, using the audit principles of ISO 19011 and the certification requirements of ISO/IEC 17021-1. Participants work through a full simulated audit of a case-study organisation, from the opening meeting to the final report.

Learning objectives

By the end of the course, participants will be able to:

  • Explain the structure and requirements of ISO/IEC 27001:2022, including the Annex A controls
  • Apply ISO 19011 audit principles to plan a risk-based ISMS audit
  • Collect and evaluate objective evidence through interviews, observation and document review
  • Grade findings as major or minor non-conformities, or opportunities for improvement
  • Write a clear audit report and verify the effectiveness of corrective actions
  • Lead an audit team and manage the audit from opening to closing meeting

Benefits

For you

  • Qualify to lead internal, supplier and second-party ISMS audits
  • Earn a certificate employers can verify online
  • Build practical audit skills through a full case-study audit

For your organisation

  • An in-house lead auditor to run the internal audit programme required by clause 9.2
  • Stronger preparation for Stage 1 and Stage 2 certification audits
  • Reduced reliance on external consultants for supplier assurance

Course content

  1. Day 1

    Information security and ISO/IEC 27001:2022

    ISMS concepts, context, scope, risk assessment and treatment, the Statement of Applicability and the 93 Annex A controls.

  2. Day 2

    Audit principles and planning

    ISO 19011 and ISO/IEC 17021-1, audit programmes, audit objectives, risk-based sampling and preparing the audit plan and checklists.

  3. Day 3

    Conducting the audit

    Opening meetings, interview technique, evidence collection, auditing technical controls and handling difficult situations.

  4. Day 4

    Findings and reporting

    Writing non-conformity statements, grading findings, closing meetings, audit reports and corrective action follow-up.

  5. Day 5

    Case-study audit and examination

    Leading a simulated audit end to end, followed by the written examination.

Who should attend

  • Information security managers and ISMS coordinators
  • Internal auditors and compliance officers
  • IT managers and consultants moving into audit roles

Prerequisites

Working knowledge of information security concepts. Familiarity with ISO/IEC 27001 is recommended but not required.

Assessment & certification

Continuous assessment of case-study exercises and a closed-book written examination on day five. Participants who pass receive a Vander certificate for 40 training hours with a unique, verifiable certificate ID.

How certificate verification works

Related courses

All courses