Duration
5 days
Overview
Auditing is crucial to the success of any management system. As a result, it carries with it heavy responsibilities, tough challenges and complex problems. This five-day intensive course trains ISMS auditors to lead, plan, manage and implement an Audit Plan. It also empowers them to give practical help and information to those who are working towards certification and also provides the knowledge and skill required to carry out 2nd party auditing (suppliers and subcontractors).
How will I benefit?
Effective auditing helps to ensure that the measures you put in place to protect your organization and your customers are properly managed and achieve the desired result.
What will I learn?
Explain the purpose and business benefits of:
- Information Security Management Systems (ISMS), ISMS standards
- Management system audit
- Third-party certification
Explain the role of an auditor to plan, conduct, report and follow up an Information Security MS audit in accordance with ISO 19011 (and ISO 17021 where appropriate).
Have the skills to: Plan, conduct, report, and follow up an audit of an ISMS to establish conformity (or otherwise) with ISO/IEC 27001/2, ISO 19011 (and ISO 17021 where appropriate)
Who should attend?
This course is suitable for those wishing to Lead audits of ISMS in accordance with ISO 27001:2013 (either as a 2nd party, or 3rd party auditor), those wishing to learn about effective audit practices. Security and quality professionals, existing information security auditors who wish to expand their auditing skills and consultants who wish to provide advice on ISO 27001:2013 ISMS Auditing.
Prerequisites
You should have a good knowledge of ISO 27001:2013 and the key principles of a ISMS. If not, we strongly recommend you attend our ISO 27001:2013 Requirements course. It will also help if you have attended an internal or lead auditor course or have experience with conducting internal or supplier audits.
Agenda
Day 1
Time
Topic
08.30
17.30
Benefits to you, welcome and introductions
Course aims, objectives and structure
KNOWLEDGE
First, second and third party audits
Audit process
Audit objectives, scopes and criteria’s
Audit resources
Roles and responsibilities and confidentiality
Audit methods
Stage 1 audit
Stage 2 audit
Audit plan
Work documents
Opening meeting
Audit evidence
Effective communication
Audit findings
Audit meetings
Closing meeting
Audit reports
Audit follow-Up
Close day 1
Day 2
Time
Topic
08.30
18.00
Day 1 review
KNOWLEDGE continued
Purpose and business benefits of an ISMS
Terminology
Plan-Do-Check-Act
ISMS context
Role of the auditor
ISMS documentation
SKILLS
Initiating the audit
Document review
Audit plan
Work documents
Opening meeting
Observations
Auditing ‘Top Management’
Close day 2
Day 3
Time
Topic
08.30
18.00
Specimen exam: Sections 1 and 2 review
SKILLS
Auditing ‘Context’
Auditing ‘Actions to address risks and opportunities’
Tutorial on body language
Audit trails
Auditing ‘Objectives, resource and competence’
Auditing ‘Operations and monitoring….’
Close day 3
Day 4
Time
Topic
08.30
18.00
Specimen exam: Section 3 review
SKILLS
Auditing ‘Continual improvement’
Nonconformities
Closing meeting
Audit report
Audit follow-up
Specimen exam: Section 4
Close day 4
Day 5
Time
Topic
08.00
Hand in homework – audit report
The certification and accreditation process, the role of CQI and IRCA, the CQI and
IRCA ISMS auditor certification requirements and code of conduct
Final questions/final revision
Evaluation
Introduction/readiness to the exam
10.15
Exam
12.15
End of course
Programme scope, delivery arrangements and suitability are confirmed during enquiry.