Duration

2 days

Course Aim

To provide guidance and practical experience in planning, executing and reporting Information Security Management System Audits. The course is broken down into a combination of knowledge and skills.

Course Description

This course aims to provide guidance and practical experience in planning, executing, and reporting Information Security Management System audits.

Information security is now recognized as an important business process which, if not managed correctly and efficiently, may impact upon an organization’s ability to deliver its products and services to their customers. Just as important, lack of security has the potential to impact revenues. The highly specialized skills and practical knowledge needed to assess an organization’s capability to manage all aspects of information security is one that can be learnt.

This innovative, two-day course provides a solid foundation in all aspects of the audit process. Stage by stage, delegates are taken through a structured programme that includes a balance of theory and practice. It uses a combination of collaborative learning and practical activities, enabling delegates to gain an understanding of the key activities for auditing.

How will I benefit?

Appropriately trained auditors will bring added value to the internal audit process
Your business will remain compliant to the international Standard for Information Security Management Systems
Skills development for your internal auditors; as well as the main core knowledge requirements

What will I learn?

By the end of the course delegates will be able to:

To have understanding in the areas of:
The principles of auditing to ISO/IEC 27001:2013
Audit activities
Explain the role of an auditor to plan, conduct, report and follow up an ISMS audit in accordance with ISO 19011
Have the skill to:
Initiate the audit
Prepare the audit activities
Conduct audit activities
Prepare and distribute the audit report
Complete the audit
Audit follow-up
Audit an ISMS to establish conformity (or otherwise) with ISO 27001

Who should attend?

The course is especially suitable for:

Anyone who is or will be coordinating internal audit activities within your organization
Those who have responsibility to audit an Information Security Management System
Existing auditors who wish to refresh their skills

Prerequisites

The course is aimed at those who already have an understanding of ISO/IEC 27001:2013. If you do not have this understanding, you’re strongly recommended to attend the one-day requirements training course as the requirements of this standard are not taught on this internal auditor’s course.

Agenda

Day 1

Time

Topic

9:00

Tutor Introduction

Welcome and Safety Information

Delegate Introductions

Overview of Course Structure and Learning Objectives

Background to Information Security Management Systems (ISMS)

ISO 27001: Structure, Auditing Areas, Terms and Definitions

Management System and ISMS Auditing

Auditor Competence, Responsibilities and Characteristics

Audit Evidence Triangle

Types of Audit

Audit Activities

Creating an Audit Plan

Checklists

Audit Questioning Techniques: Communication and Interpersonal Skills

17:00

Day 2

Time

Topic

9:00

Review of Day 1 Quiz

17:00

Conducting the Opening Meeting

Conducting an Audit

Work Documents

Conducting an Audit

Nonconformities and Writing Nonconformities

Creating the Audit Report: Prepare, Approve & Distribute

Conducting Audit Follow-up Activities

Course Review and Final Questions

Programme scope, delivery arrangements and suitability are confirmed during enquiry.