Duration

2 days

Course Description

The course aims to provide guidance and practical experience in planning, executing, and reporting Information Security Management System Audits.

Information Security is now recognised as an important business process which if not managed correctly and efficiently may impact upon an organisation’s ability to deliver its products and services to their customers. Just as important, lack of security has the potential to impact upon revenues. The highly specialised skills and practical knowledge needed to assess an organisation’s capability to manage all aspects of information security is one that can be learnt.

This innovative, two-day course provides a solid foundation in all aspects of the audit process. Stage by stage delegates are taken through a structured programme that includes a balance of theory and practice using a combination collaborative learning and practical activities enabling delegates to gain an understanding of the key activities for auditing.

Course Benefits

Appropriately trained auditors will bring added value to the internal audit process
Your business will remain compliant to the international standard for Information Security Management Systems
Skills development for your internal auditors; as well as the main core knowledge requirements

Learning Objectives

Upon completion of this training, delegates will be able to explain and apply:

The principles of auditing and the principles of auditing to ISO/IEC 27001:2013
Audit activities
Initiating the audit
Preparing audit activities
Conducting audit activities
Preparing and distributing the audit report
Completing the audit
Audit follow-up

Intended Audience

All personnel who are/will be coordinating internal audit activities within your organization
Persons who have been given the responsibility to audit an Information Security Management System
Existing auditors who wish to refresh their skills

Prerequisites

The course is aimed at personnel who already have an understanding of ISO/IEC 27001:2013 (delegates who do not have this understanding are strongly recommended to attend the one-day requirements training course; as the requirements of this standard are not taught on this internal auditor’s course)

Agenda

Day 1

Time

Topic

9:00

Tutor Introduction

Welcome and Safety Information

Delegate Introductions

Overview of Course Structure and Learning Objectives

Background to Information Security Management Systems (ISMS)

ISO 27001: Structure, Auditing Areas, Terms and Definitions

Management System and ISMS Auditing

Auditor Competence, Responsibilities and Characteristics

Audit Evidence Triangle

Types of Audit

Audit Activities

Creating an Audit Plan

Checklists

Audit Questioning Techniques: Communication and Interpersonal Skills

Conducting the Opening Meeting

Conducting an Audit

17:00

Day 2

Time

Topic

9:00

Review of Day 1 Quiz

Work Documents

Conducting an Audit

Nonconformities and Writing Nonconformities

Creating the Audit Report: Prepare, Approve & Distribute

Conducting Audit Follow-up Activities

16:30

Course Review and Final Questions

Programme scope, delivery arrangements and suitability are confirmed during enquiry.