ISO 28000:2022 Security Management Systems Internal Auditor Training and Certification Program

Programme Summary

Develop the skills to conduct focused internal audits of organizational security against ISO 28000:2022. Participants practise planning, interviewing, sampling and reporting using a distribution hub and supply network case. Exercises examine security threats, operational vulnerabilities and coordinated protective controls, test the strength of evidence and distinguish supported findings from assumptions. The course supports effective corrective action and clearer assurance about system performance.

Training Objectives

1 Build disciplined organizational security audit practice; 2 Prioritise audit scope using operational risks; 3 Strengthen interviewing and evidence evaluation; 4 Develop substantiated findings and concise reports; 5 Evaluate corrective action effectiveness.

Learning Outcomes

1 Plan a organizational security audit; 2 Sample security threat assessments; 3 Conduct a focused evidence gathering interview; 4 Write findings linked to specified criteria; 5 Evaluate action on uncontrolled physical access.

Target Audience

Internal Auditors; Security Managers; Corporate Security Officers; Supply Chain Security Managers; Management System Coordinators.

Target Industries

Logistics and Distribution; Ports and Terminals; Industrial Manufacturing; Critical Infrastructure; Retail Distribution.

Course Contents

• Module 1 Internal Audit Purpose and Conduct: Audit objectives criteria and independence; Integrity confidentiality and evidence based decisions; Audit guidance and organisational responsibilities.
• Module 2 Defining the Internal Audit Scope: System boundaries and process interactions; Applicable requirements and previous audit results; Operational risks and sampling limitations.
• Module 3 Planning the Audit Assignment: Audit programme priorities and resources; Assignment schedule and interview responsibilities; Risk based sampling and evidence requests.
• Module 4 Preparing Relevant Audit Evidence: Security threat assessments; Access and movement records; Security incident reports.
• Module 5 Auditing Security Context and System Scope: Organisational activities and security boundaries; Internal external and supply chain interfaces; Interested parties obligations and climate relevance.
• Module 6 Auditing Security Leadership and Planning: Policy objectives and accountable responsibilities; Security plans and measurable action priorities; Competence awareness and information sharing.
• Module 7 Auditing Supply Chain and Partner Security: Custody movements and transfer points; Supplier and partner security responsibilities; Changes in routes facilities and dependencies.
• Module 8 Auditing Security Incident Preparedness and Response: Threat escalation and reporting responsibilities; Response coordination and continuity interfaces; Exercises investigation and incident learning.
• Module 9 Interviewing Observation and Evidence Evaluation: Open questions and focused follow up; Corroborating records interviews and observations; Conflicting evidence and additional sampling decisions.
• Module 10 Findings Reporting and Closing Discussions: Requirement evidence and nonconformity statements; Clear conclusions and balanced reporting; Communicating findings without prescribing consultancy solutions.
• Module 11 Corrective Action and Audit Follow Up: Correction root cause and corrective action; Evidence of implementation and effectiveness; Closure decisions and recurring weakness escalation.
• Module 12 Internal Audit Simulation: Plan and conduct an individual interview; Evaluate records and defend two findings; Review corrective action and present conclusions.

Assessment

• 60 single best answer questions, including applied scenarios; one mark per question.
• 90 minute invigilated digital examination with identity verification. Approved accessibility adjustments preserve the assessed competence.
• Clean standard text and supplied case documents permitted; internet, messaging and external AI tools prohibited.
• Individual applied assessment (90 minutes): Conduct an individual simulated organizational security audit: prepare a sampling plan, interview a role player, evaluate supplied records, report two supported findings and review one proposed corrective action.
• Assessment criteria: Risk relevant sampling of security threat assessments; Interview and findings supported by traceable requirements and evidence; Sound corrective action judgement on uncontrolled physical access.
• Pass each component separately: 45/60 written marks (75%) and at least 70% on the applied task.
• All mandatory criteria must pass: Do not fabricate evidence or knowingly present unsupported conformity conclusions.
• Individual results and feedback are provided. One reassessment may follow coaching under the published enrolment terms.

Certification

• Successful learners receive a TQCSI Arabia digital Certificate of Successful Completion.
• The certificate records the learner name, exact programme title, teaching hours, completion date and unique verification reference.
• Verified identity, full attendance and separate written and applied passes are required; all mandatory critical criteria must be met.
• Proposed issue target: within 30 calendar days of approved results and settlement of applicable fees.
• Records successful internal auditor course completion in organizational security; workplace auditor appointment still depends on demonstrated competence and organisational authorisation.
• Attendance confirmation may record completed hours for unsuccessful learners; it does not certify successful completion.

Programme Profile

Number of daysNumber of daysNumber of days

333

Total teaching hoursTotal teaching hoursTotal teaching hours

18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.

Delegates allowedDelegates allowedDelegates allowed

Maximum 20 delegates.Maximum 20 delegates.Maximum 20 delegates.

Training prerequisitesTraining prerequisitesTraining prerequisites

Working knowledge of ISO 28000:2022 and relevant organizational security processes is required. Prior audit experience is helpful; requirements training should precede this course.Working knowledge of ISO 28000:2022 and relevant organizational security processes is required. Prior audit experience is helpful; requirements training should precede this course.Working knowledge of ISO 28000:2022 and relevant organizational security processes is required. Prior audit experience is helpful; requirements training should precede this course.

Pre course assignment and assessmentPre course assignment and assessmentPre course assignment and assessment

Complete a 30-minute requirements diagnostic; review supplied security threat assessments and prepare three evidence seeking audit questions.Complete a 30-minute requirements diagnostic; review supplied security threat assessments and prepare three evidence seeking audit questions.Complete a 30-minute requirements diagnostic; review supplied security threat assessments and prepare three evidence seeking audit questions.

End of course assessmentEnd of course assessmentEnd of course assessment

60 question written exam (90 minutes) and individual applied task (90 minutes).60 question written exam (90 minutes) and individual applied task (90 minutes).60 question written exam (90 minutes) and individual applied task (90 minutes).

Passing criteriaPassing criteriaPassing criteria

75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.