ISO/IEC 27001:2022 Internal Auditor Training Course (Self-Paced Online)

This comprehensive self paced online course prepares you to plan and conduct internal audits of an information security management system against ISO/IEC 27001:2022. You will learn to carry an internal audit from initiation through to reporting and follow up, using ISO 19011:2026 as your auditing framework.

The course follows a realistic, scenario based approach, so you practise the internal audit lifecycle the way it happens in the field: planning the audit, gathering and evaluating evidence, raising findings, and reporting to management. It opens with a concise recap of ISO/IEC 27001:2022 so you are grounded in the standard before you audit against it.

Key concepts covered

• The ISO/IEC 27001:2022 information security management system, in brief
• The seven principles of auditing and the audit lifecycle
• Audit initiation, scope, criteria and the audit plan
• Reviewing the ISMS scope, risk assessment and Statement of Applicability
• Evidence gathering, and distinguishing evidence from inference
• Writing Major NC, Minor NC, and OFI statements, and verifying corrective action

Becoming an internal auditor in ISO/IEC 27001:2022 and ISO 19011:2026 strengthens your value to any organisation running an information security management system. This course enables you to:

• Plan and conduct internal audits with confidence and consistency
• Surface the issues that matter and help reduce information security risk
• Help your organisation stay audit ready for certification and surveillance
• Take a clear next step in your auditing career, including towards the Lead Auditor qualification

Why learning online works for you

• Learn anytime, anywhere. Study on demand, on site or off site, whenever it suits you
• Self paced. Move at your own speed and spend more time on the areas you want to master
• Cost effective. No travel, accommodation, or time away from the office to fund
• Lifetime access. Return to the materials whenever you need them
• Built to stick. Interactive, multi format lessons keep you engaged and improve retention

By the end of this course you will be able to:

• Explain the purpose of an information security management system and of internal auditing
• Plan, conduct, report, and follow up an internal audit in accordance with ISO 19011:2026
• Prepare an audit plan from the requirements of ISO/IEC 27001:2022
• Review the ISMS scope, risk assessment, risk treatment and Statement of Applicability
• Gather and evaluate objective evidence, and distinguish evidence from inference
• Write Major NC, Minor NC, and OFI statements that are factual and defensible
• Verify the effectiveness of corrective action

This course also explains how ISO certification works. You will learn what ISO certification is, the role of accredited certification bodies and accreditation, the two stage certification audit, and how organisations achieve and maintain certification through surveillance and recertification.

This course is designed for anyone who plans, conducts, or supports internal audits of a management system, including:

• New and developing internal auditors
• People who implement or maintain the information security management system
• Information security, IT, risk and compliance staff, and consultants
• Anyone preparing to progress to the Lead Auditor qualification
• Those helping their organisation prepare for certification or surveillance audits

There are no prerequisites for this course.

A working knowledge of the current version of ISO/IEC 27001 is recommended and will help you get the most from the auditing material. If you are new to the standard, you can build this foundation through our ISO/IEC 27001:2022 Foundation course. This course also includes a concise recap of the standard before the auditing modules.

You will need a computer, laptop, or tablet with a reliable internet connection. The course works in any modern web browser, such as Google Chrome, Microsoft Edge, Mozilla Firefox, or Apple Safari. For the best experience, keep your browser updated to the latest version.