Duration

3 days

Overview

The three-day workshop-based training provides participants the knowledge and skills to plan, conduct, report and follow up an internal audit of an information security management system based on ISO/IEC 27001:2013 and in accordance with ISO 19011. Internal audit is a mandatory requirement as per Clause 9.2 of ISO/IEC 27001:2013.

Objectives

By the end of the training, participants will be able to:

Develop personal skills & knowledge required to conduct the internal audit
Understand the principles of auditing to ISO/IEC 27001:2013
Apprehend the internal audit activities
Initiate and conduct internal audit
Develop techniques to collect and record audit evidence
Write an effective non-conformity (NCR)
Learn how to prepare Internal Audit Report
Be a competent as an internal auditor for ISO/IEC 27001:2013

Who should attend?

This course is recommend the course may be beneficial to auditors who want to conduct ISMS audits, those who want to obtain competence in ISMS audit process and also to members of the information security team, that may include:

Information Security Manager/IT Manager/Executives
Information Security Auditors
ISMS Team Members
ISO/IEC 27001:2013 Internal Auditors
Data Centre Engineers
ISMS Management Representatives (MR)
Project Managers

Pre-requisite

It is recommended that participants attend the ISO/IEC 270001:2013 Foundation (Awareness) or ISO/IEC 27001:2013 Implementer course so that participants have basic knowledge of the concepts of information security management system ISMS and an understanding of the requirements of ISO/IEC 27001:2013 and the commonly used information security management terms and definitions.

Course Delivery

Competency-based accelerated learning techniques combining lectures, discussions and workshops. The trainer will coach the participants through the whole process of internal audit from auditing, identifying and recording non-conformities (NCs), issuing the Corrective Action Request (CAR) until the stage at follow-up of Corrective Action.

Course Outline

Introduction to Auditing
Types of audits
Internal Quality Audit
Type of Audit
Clause 9.2 internal audit requirements
Internal Auditor Competencies
Competence of ISMS Internal Auditor
Desired behavior for auditors
Internal Audit Planning
Preparing Audit Programme and Audit Plan
Preparation of Checklist
Internal Auditing Process
Process Audit Approach
Auditing Techniques (Interviewing/Observing/Verifying)
Collecting and recording Audit Evidence (Conformance & Nonconformance)
Auditing ISMS:
Organization and its context
Needs and expectations of interested parties
Scope of ISMS
Information Security Policy and organizational structure
Information security risk assessment, risk treatment plans, SOA
Information Security objective and associated plans
Competencies and documented information
Performance evaluation
Monitoring, measurement, analysis and evaluation
Management review
Nonconformity and corrective action
Continual improvement
Auditing controls:
Information security policies
Organization of information security
Human resource security
Asset management
Access control
Cryptography
Physical and environmental security
Operations security
Communications security
System acquisition, development and maintenance
Supplier relationships
Information security incident management
Information security aspects of business continuity management
Compliance
Audit Performance
Audit Findings Classification (Major/Minor Non-conformance)
Managing Corrective Action Request :
Issuance of Non-Conformance (NC)
Preparation of audit report
Investigation of root causes

Programme scope, delivery arrangements and suitability are confirmed during enquiry.