Information Security Management Systems Lead Auditor Training

Understand how to initiate, participate in, lead, and report on audits, aligned with the guidance provided in ISO 19011, including:

• Audit planning requirements, such as undertaking the document review and developing the audit plan and timetable
• Delivering a successful, risk-based audit program using appropriate auditing techniques, including evidence collection, sampling, and verification
• Conducting and leading audit meetings, including opening, closing, and team meetings
• Collating audit findings, understanding and identifying key risks and documenting nonconformances
• Creating, reviewing, and issuing the audit report, including audit findings and outcomes.
• Understand the structure and requirements of an ISMS in alignment with ISO/IEC 27001:2022 and its relationship with ISO/IEC 27002:2022
• Identify and evaluate the application of Information Security Management principles from ISO/IEC 27002:2022, aligned with an organisation’s threat and risk environment, including organisational, people, physical, and technological controls

Apply the ISO/IEC 27001 and 27002 standards to design and assess ISMS controls and processes within an organisational context, and to establish conformity with the standard.

This course is divided into two flexible modules, enabling you to attend both modules in the same week or spread across different sessions. The first 2-day module is equivalent to our Becoming a Skilled Lead Internal/External Auditor course, where you learn how to conduct an audit of any management system in accordance with ISO 19011. The remaining 3-day module covers the requirements of the updated ISMS standard, ISO/IEC 27001:2022. 

Timetable

Day 1 – Monday

Preparing for a management systems audit

• Introduction to auditing
• 7 fundamental audit principles
• Roles and responsibilities of an auditor
• Setting appropriate audit objectives, scope, and criteria
• Undertaking the document review
• Audit planning, including effective timetabling
• Checklist generation and review
• Conducting an opening meeting

Day 2 – Tuesday

Conducting a management systems audit

• Communication skills and interview techniques
• Effective audit practices, evidence and sampling
• Determining conformance and an evidence-based approach
• Conducting a closing meeting
• Developing the audit report and writing audit findings
• Reviewing corrective action.

Day 3 – Wednesday

Information security management systems

• Introduction to information security
• Context of information security
• Information security management systems requirements
• Risk-based approach to information security
• Structure of information security controls and control attributes.

Day 4 – Thursday

Information security controls

• Information security controls – organisational, people, physical, technological
• Information classification
• Documentation requirements of an information security management system.

Day 5 – Friday

Application of information security management systems 

• Statement of applicability
• Information security audit scenarios
• Course review.

Upon successful completion of the course, you will receive a Certificate of Attainment with 3 Exemplar Global competencies:

• Exemplar Global AU26 – Auditing management systems 
• Exemplar Global TL26 – Lead audit teams 
• Exemplar Global IS – Auditing information security management systems

Upon successful completion of the course and all required assessment items, you will receive a Statement of Attainment for BSBSS00128 Lead Auditor Skill Set, consisting of: 

• BSBAUD411 Participate in quality audits  
• BSBAUD511 Initiate quality audits 
• BSBAUD512 Lead quality audits 
• BSBAUD513 Report on quality audits

Nationally Recognised Training assessment components are to be completed within 6 months.

There are no prerequisites for this course.

You will complete a series of workshops during the course, which form part of the assessment. Upon the completion of each module there is a short multiple-choice quiz. You will receive continual assistance and feedback from the facilitator. 

To complete the Nationally Recognised Training units of competency and the BSBSS00128 Lead Auditor Skill Set, an additional assessment is required to be completed and submitted to RTP for review following the training, demonstrating your knowledge and understanding of the audit process. You will be provided with instructions to assist with the completion of the assessment, and templates are available for use, as required. Your trainer will explain the post-course assessment process during the training. 

Nationally Recognised Training assessment components are to be completed within 6 months. 

This course is ideal if you:

• Are looking to become an internal auditor for an information security management system
• Are developing or improving an ISMS 
• Hold responsibility for auditing or managing information security within your organisation
• Want to formalise your existing experience with a recognised qualification.
• Looking to undertake formal professional development

A business background is recommended, though no prior experience in auditing or management systems is required.

This course is your first step to becoming a third-party ISMS auditor under the Exemplar Global scheme. Once you’ve achieved the required competencies, you can apply for auditor certification through Exemplar Global.

Visit the Exemplar Global website for full certification requirements and current fees.  

Expand your qualifications with the following courses:

Training available in a separate week:

• Quality Management Systems (Exemplar Global QM)
• Environmental Management Systems (Exemplar Global EM)
• OH&S Management Systems (Exemplar Global OH 45001)  
• Business Continuity (Exemplar Global BC and BSBOPS407X)
• Risk Management Fundamentals (BSBOPS504)
• Psychological Health and Safety at Work

If you’re looking for a foundation-level understanding of ISO standards and auditing skills, check out our library of eLearns, which includes our self-paced 45-minute Introduction to ISO/IEC 27001module.   

Price

The price of this course is $3,150 GST exempt.

Discounts for multiple attendees are available – please contact us to find out what discounts can be applied.

How to enrol

We offer an easy, streamlined enrolment process – you can either enrol directly into your course online or call us on 1300 95 96 92 to enrol over the phone.

How to pay

We offer a variety of payment methods:

• Bank transfer
• Credit card
• Payment plans.

Payment plans

We can arrange flexible payment plans on an individual basis. Please be aware that your certificate will be held until full payment has been received.

Public – Virtual/Online

This course is delivered online via our virtual training platform. Our virtual courses are available to participants in Australia and New Zealand. They provide the same premium learning experience as our face-to-face sessions, with the added convenience of online learning. The virtual platform mimics in-person learning and aims to be engaging and interactive, with real-time group exercises, Q&A sessions, and online assessments. No matter your location, you can benefit from our expert-led training and become proficient in auditing an ISMS.

Please note: Due to licensing restrictions, our virtual courses are open to participants from Australia and New Zealand only.

In-house – Face-to-face or virtual

In-house training can provide a cost-effective training solution for organisations with a number of staff who require training. We can also customise a course to suit your own individual needs and include your own audit documentation. Call us on 1300 95 96 92 or complete the form below to request a quote.

Request an In-house quote