ISO 27001 Internal Auditor Training

ISO/IEC 27001:2022 has been the only valid edition since the transition window closed on 31 October 2025, and internal audit is the mechanism by which a certified organisation demonstrates — to its own management, to management review and to its certification body — that the information security management system actually works rather than merely exists on paper. This course qualifies IT and security staff, ISMS managers and internal auditors to plan, conduct, report and follow up internal audits against clauses 4 to 10 and against the controls the organisation has declared in its Statement of Applicability.

The programme follows the order an auditor meets the work: the mandate and purpose of clause 9.2; the audit cycle, programme management and auditor competence requirements of ISO 19011:2018; clause-by-clause audit approaches for context, leadership, planning, risk assessment and risk treatment, support, operation, performance evaluation and improvement; and then the Annex A reference set as restructured in 2022 — 93 controls in four themes, including the eleven new controls — together with the evidence that organisational, people, physical and technological controls are genuinely operating. One discipline runs through the whole course: Annex A is a reference control set filtered by the Statement of Applicability, never a checklist of mandatory requirements.

The closing module is deliberately practical: building the audit plan and working documents, running the opening meeting, interviewing and sampling, following an audit trail to its end, writing nonconformities in problem–location–requirement form, grading major against minor defensibly, and verifying corrective action for root cause and effectiveness rather than accepting a promise.

Assessment is a 30-question online exam with a 70% pass mark. Successful learners receive a verifiable SKEDMIA certificate. Approximately 15 hours of self-paced study.