Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27001:2022 Information Security Management Systems Lead Auditor Training is a comprehensive training programme designed to develop lead auditors who can assess the information security management systems established by organisations to protect their information assets against international standard requirements, plan and conduct audits, and manage audit teams.
The training covers the requirements of the ISO/IEC 27001:2022 standard, the fundamental principles of information security, information security risk management, ISO/IEC 27002:2022 Annex A controls, the Statement of Applicability (SoA), audit principles, audit planning and implementation processes, the evaluation of nonconformities, and audit reporting methods.
The programme has been designed using an approach in which theoretical knowledge is supported by practical exercises. It aims to develop participants’ lead auditing skills through case studies, sample risk assessments, audit scenarios and reporting exercises
Objectives and Outcomes
Purpose of the Training
The purpose of this training is to equip participants with the knowledge and skills required to interpret the requirements of ISO/IEC 27001:2022, assess information security risks and control mechanisms, conduct risk-based audits and carry out lead auditor activities.
Learning Outcomes
Participants who complete the training are expected to acquire the following knowledge and skills:
- Interpret the purpose, scope and requirements of ISO/IEC 27001:2022
- Evaluate information security management system processes and their effectiveness
- Analyse information assets, threats, vulnerabilities and information security risks
- Audit information security risk assessment and risk treatment processes
- Evaluate information security controls within the scope of ISO/IEC 27002:2022
- Examine the processes for preparing and evaluating the Statement of Applicability (Statement of Applicability – SoA)
- Apply the principles of confidentiality, integrity and availability of information security to audit processes
- Evaluate access control, cryptography, network security, incident management and business continuity processes
- Apply audit planning and execution techniques in accordance with ISO 19011:2026
- Define the audit scope, criteria and objectives
- Manage the audit team and coordinate audit activities
- Collect objective audit evidence and evaluate nonconformities
- Prepare audit reports and evaluate the effectiveness of corrective actions
Programme and Method
Day 1 – ISO/IEC 27001 Requirements and Information Security Risk Management
- Purpose, scope and structure of the ISO/IEC 27001:2022 standard
- Fundamental principles of an information security management system
- Concepts of confidentiality, integrity and availability
- Requirements of Clauses 4–10 of ISO/IEC 27001
- Context of the organisation, leadership and planning
- Information security policy, objectives and responsibilities
- Information security risk assessment and risk treatment processes
- ISO/IEC 27005:2022 risk management approach
- Statement of Applicability (SoA)
- ISO/IEC 27002:2022 and Annex A controls
- Organisational, people, physical and technological controls
- Access control, data protection and incident management
- Security of suppliers and cloud services
- Performance evaluation and continual improvement
- ISO/IEC 27001:2022/Amd 1:2024 amendments
- Practical exercise: Assessment of information security risks and control mechanisms
Day 2 – Audit Principles and Conducting the Audit
- Audit principles within the scope of ISO 19011:2026
- Overview of ISO/IEC 17021-1 and ISO/IEC 27006-1 audit requirements
- First-, second- and third-party audits
- Duties and responsibilities of the Lead Auditor
- Preparation of the audit programme and audit plan
- Determination of the audit scope, criteria and objectives
- Stage 1 and Stage 2 certification audits
- Document review and checklist preparation
- Opening meeting and audit interviews
- Collection and evaluation of audit evidence
- Risk-based auditing and sampling techniques
- Auditing information security processes and Annex A controls
- Review of the SoA and risk treatment plans
- Practical exercise: Audit planning and a sample information security audit scenario
Day 3 – Audit Findings, Reporting and Lead Auditor Practices
- Formulation of audit findings
- Identification and classification of nonconformities
- Evaluation of major and minor nonconformities
- Writing nonconformities based on objective evidence
- Evaluation of audit conclusions
- Preparation of the ISO/IEC 27001 audit report
- Conducting the closing meeting
- Evaluation of corrective actions and root cause analyses
- Closure of nonconformities and follow-up audits
- Surveillance and recertification audits
- Management of the audit team and Lead Auditor responsibilities
- Practical exercise: Writing nonconformities and audit reporting
- General assessment and final examination
Training Method
The training programme is delivered through an interactive learning approach in which theoretical knowledge is supported by practical exercises.
Methods used in the training:
- Theoretical instruction and presentations
- Clause-by-clause review of the standard requirements
- Information security risk assessment exercises
- Evaluation of Annex A controls
- Case study analyses
- Group work and discussions
- Preparation of an audit plan and checklist
- Sample information security audit scenarios
- Nonconformity writing and evaluation exercises
- Audit reporting exercises
- Knowledge assessment and final examination
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must obtain a passing grade in the examination at the end of the training; participants who use their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
1. Who is the ISO/IEC 27001 Lead Auditor Training suitable for?
It is suitable for information security specialists, information technology professionals, cybersecurity specialists, quality management system managers, internal auditors and professionals wishing to audit information security management systems.
2. What is the difference between ISO/IEC 27001 and ISO/IEC 27002?
ISO/IEC 27001 defines the requirements for establishing, implementing, maintaining and continually improving an information security management system. ISO/IEC 27002 provides guidance on implementing information security controls.
3. How many information security controls are included in the ISO/IEC 27001:2022 standard?
Annex A of the ISO/IEC 27001:2022 standard contains a total of 93 controls across four categories: organisational, people, physical and technological. The applicability of the controls is determined within the framework of the organisation's risk assessment and risk treatment process.
4. What is the difference between the 5-day and 3-day training courses?
The 5-day programme provides comprehensive coverage of ISO/IEC 27001 requirements, risk management, Annex A controls and audit processes. The 3-day programme offers intensive content for participants who already have knowledge of information security and auditing.
5. Does the training include practical exercises?
Yes. The training includes practical exercises in information security risk assessment, reviewing control mechanisms, audit planning, case study analysis, writing nonconformities and audit reporting.
6. Can the training be delivered online or face to face?
Yes. The training can be arranged online or face to face, depending on the requirements of participants and organisations.
7. Is there an examination at the end of the training?
A final examination is planned as part of the programme to assess participants' knowledge and skills.
8. Is a certificate issued at the end of the training?
Yes. The relevant training certificate is issued based on the attendance requirements and assessment results.
Resources
- ISO/IEC 27001:2022 – Information Security Management Systems – Requirements
- ISO/IEC 27001:2022/Amd 1:2024 – Climate Action Changes
- ISO/IEC 27002:2022 – Information Security Controls
- ISO/IEC 27005:2022 – Guidance on Managing Information Security Risks
- ISO 19011:2026 – Guidelines for Auditing Management Systems
- ISO/IEC 27006-1:2024 – Requirements for Bodies Providing Audit and Certification of Information Security Management Systems
- ISO/IEC 17021-1:2015 – Requirements for Bodies Providing Audit and Certification of Management Systems
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR011ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR012ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session planned