ISO/IEC 27001 Lead Auditor: Information Security Management System

The auditor's perspective

This course teaches you to assess conformity, not build an ISMS from scratch. The emphasis is on evidence: what an adequate risk treatment plan looks like on paper, how to test whether a stated control actually operates, and what constitutes a major nonconformity in a given context.

Where this fits

Auditor competence here transfers directly into internal audit programmes, second-party supplier assessments, and a path toward third-party certification body work, one of the most consistently requested credentials in Australian information security roles.

What you will learn

• Explain the fundamental concepts and principles of an information security management system
• Interpret ISO/IEC 27001 requirements for an ISMS from the perspective of an auditor
• Evaluate ISMS conformity to ISO/IEC 27001 requirements using fundamental audit concepts and principles
• Plan, conduct and close an ISO/IEC 27001 audit in accordance with ISO/IEC 17021-1 and ISO 19011
• Manage an ISO/IEC 27001 audit programme

Course content

1. 1. Introduction to the ISMS and ISO/IEC 27001

   Fundamental concepts, ISO/IEC 27001 requirements and the certification process.

2. 2. Audit principles and planning

   Fundamental audit concepts, risk- and evidence-based auditing, and initiating the audit.

3. 3. On-site audit activities

   Stage 2 audit execution, communication during the audit and audit procedures.

4. 4. Closing the audit

   Drafting findings and nonconformity reports, evaluating action plans and managing an audit programme.

Exam and certification

Open-book written exam delivered online through PECB Exams. Duration: 3 hours.

Your fee includes your first exam attempt and one free retake within 12 months. After passing, you can apply for the relevant PECB credential.