ISO/IEC 27001:2022 Information Security Management Systems Internal Auditor Training and Certification Program

Programme Summary

Develop the skills to conduct focused internal audits of information security management against ISO/IEC 27001:2022. Participants practise planning, interviewing, sampling and reporting using a cloud enabled business information case. Exercises examine information risks, justified security controls and assurance evidence, test the strength of evidence and distinguish supported findings from assumptions. The course supports effective corrective action and clearer assurance about system performance.

Training Objectives

1 Build disciplined information security management audit practice; 2 Prioritise audit scope using operational risks; 3 Strengthen interviewing and evidence evaluation; 4 Develop substantiated findings and concise reports; 5 Evaluate corrective action effectiveness.

Learning Outcomes

1 Plan a information security management audit; 2 Sample risk assessment and treatment records; 3 Conduct a focused evidence gathering interview; 4 Write findings linked to specified criteria; 5 Evaluate action on unsupported control exclusions.

Target Audience

Internal Auditors; Information Security Managers; IT Risk Managers; Security Governance Analysts; Management System Coordinators.

Target Industries

Financial Services; Cloud and IT Services; Telecommunications; Healthcare Providers; Government Digital Services.

Course Contents

• Module 1 Internal Audit Purpose and Conduct: Audit objectives criteria and independence; Integrity confidentiality and evidence based decisions; Audit guidance and organisational responsibilities.
• Module 2 Defining the Internal Audit Scope: System boundaries and process interactions; Applicable requirements and previous audit results; Operational risks and sampling limitations.
• Module 3 Planning the Audit Assignment: Audit programme priorities and resources; Assignment schedule and interview responsibilities; Risk based sampling and evidence requests.
• Module 4 Preparing Relevant Audit Evidence: Risk assessment and treatment records; Statement of applicability; Access and incident records.
• Module 5 Auditing Information Context and Security Scope: Information assets processes and service boundaries; Interested party and contractual security needs; Security objectives and climate relevance.
• Module 6 Auditing Risk Treatment and Applicability: Treatment options and control selection; Annex A comparison and exclusion justification; Statement of applicability and treatment approval.
• Module 7 Auditing Physical and Technical Security Interfaces: Access lifecycle and privileged permissions; Physical protection and information handling; Configuration monitoring and vulnerability management.
• Module 8 Auditing Incident and Continuity Controls: Event reporting and incident response coordination; Evidence preservation and learning from incidents; Information security during disruption and recovery.
• Module 9 Interviewing Observation and Evidence Evaluation: Open questions and focused follow up; Corroborating records interviews and observations; Conflicting evidence and additional sampling decisions.
• Module 10 Findings Reporting and Closing Discussions: Requirement evidence and nonconformity statements; Clear conclusions and balanced reporting; Communicating findings without prescribing consultancy solutions.
• Module 11 Corrective Action and Audit Follow Up: Correction root cause and corrective action; Evidence of implementation and effectiveness; Closure decisions and recurring weakness escalation.
• Module 12 Internal Audit Simulation: Plan and conduct an individual interview; Evaluate records and defend two findings; Review corrective action and present conclusions.

Assessment

• 60 single best answer questions, including applied scenarios; one mark per question.
• 90 minute invigilated digital examination with identity verification. Approved accessibility adjustments preserve the assessed competence.
• Clean standard text and supplied case documents permitted; internet, messaging and external AI tools prohibited.
• Individual applied assessment (90 minutes): Conduct an individual simulated information security management audit: prepare a sampling plan, interview a role player, evaluate supplied records, report two supported findings and review one proposed corrective action.
• Assessment criteria: Risk relevant sampling of risk assessment and treatment records; Interview and findings supported by traceable requirements and evidence; Sound corrective action judgement on unsupported control exclusions.
• Pass each component separately: 45/60 written marks (75%) and at least 70% on the applied task.
• All mandatory criteria must pass: Do not fabricate evidence or knowingly present unsupported conformity conclusions; Protect confidential or personal information within supplied case material.
• Individual results and feedback are provided. One reassessment may follow coaching under the published enrolment terms.

Certification

• Successful learners receive a TQCSI Arabia digital Certificate of Successful Completion.
• The certificate records the learner name, exact programme title, teaching hours, completion date and unique verification reference.
• Verified identity, full attendance and separate written and applied passes are required; all mandatory critical criteria must be met.
• Proposed issue target: within 30 calendar days of approved results and settlement of applicable fees.
• Records successful internal auditor course completion in information security management; workplace auditor appointment still depends on demonstrated competence and organisational authorisation.
• Attendance confirmation may record completed hours for unsuccessful learners; it does not certify successful completion.

Programme Profile

Number of daysNumber of daysNumber of days

333

Total teaching hoursTotal teaching hoursTotal teaching hours

18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.

Delegates allowedDelegates allowedDelegates allowed

Maximum 20 delegates.Maximum 20 delegates.Maximum 20 delegates.

Training prerequisitesTraining prerequisitesTraining prerequisites

Working knowledge of ISO/IEC 27001:2022 and relevant information security management processes is required. Prior audit experience is helpful; requirements training should precede this course.Working knowledge of ISO/IEC 27001:2022 and relevant information security management processes is required. Prior audit experience is helpful; requirements training should precede this course.Working knowledge of ISO/IEC 27001:2022 and relevant information security management processes is required. Prior audit experience is helpful; requirements training should precede this course.

Pre course assignment and assessmentPre course assignment and assessmentPre course assignment and assessment

Complete a 30-minute requirements diagnostic; review supplied risk assessment and treatment records and prepare three evidence seeking audit questions.Complete a 30-minute requirements diagnostic; review supplied risk assessment and treatment records and prepare three evidence seeking audit questions.Complete a 30-minute requirements diagnostic; review supplied risk assessment and treatment records and prepare three evidence seeking audit questions.

End of course assessmentEnd of course assessmentEnd of course assessment

60 question written exam (90 minutes) and individual applied task (90 minutes).60 question written exam (90 minutes) and individual applied task (90 minutes).60 question written exam (90 minutes) and individual applied task (90 minutes).

Passing criteriaPassing criteriaPassing criteria

75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.