ISO/IEC 27001 internal auditing
Following ISO 19011 you plan an ISMS internal audit programme, prepare checklists, interview, gather evidence, grade and write nonconformities and follow up corrective actions.
Level 301 · 18 lessons · 15 practice labs
Lessons
The audit programme
- ISO 19011 auditing principles
- A risk-based audit programme
- Auditor competence and impartiality
- Quick task: an annual internal audit programme
Preparation
- The audit plan and agenda
- Preparing an audit checklist
- Document review
- Quick task: a checklist for clause 6
Fieldwork
- The opening meeting
- Audit interview techniques
- Following trails and sampling
- Recording evidence
- Quick task: extract evidence from an interview transcript
Reporting and follow-up
- Grading nonconformities and observations
- Writing nonconformity statements
- The closing meeting and report
- Verifying corrective action
- Capstone: a full internal audit of Annex A access controls
Practice labs
- Match the principle to the breach: Match eight auditor behaviours to the ISO 19011 principle each breaches.
- An annual internal audit programme: From a company's process list, risk levels and past findings, prepare an annual audit programme spread over the months.
- Assign auditors without conflicts: Assign six auditors to eight audits by competence and conflict information and show that nobody audits their own work.
- Find what the audit plan lacks: Mark which of objective, scope, criteria, timetable and interviewees are missing from an audit plan.
- A checklist for clause 6: Prepare a checklist that states the evidence to look for under the risk assessment, risk treatment and objectives requirements.
- Carry out a document review: Review a scope statement, policy and statement of applicability against the standard and list the points to verify on site.
- Turn them into open questions: Turn ten closed or leading audit questions into open questions.
- Extract evidence from an interview transcript: From the transcript of an interview with a system administrator, separate statements, records seen and claims still to verify.
- Follow the audit trail end to end: Trace an access request from the form through approval, the account record and the review minutes and report the broken link.
- Grade the finding: Grade ten findings as major nonconformity, minor nonconformity or observation.
- Write the nonconformity statement: From three evidence sets, write three nonconformity statements with requirement, evidence and nature of the failure.
- Fix badly written findings: Rework six findings that blame a person, lack evidence or cite no clause so they are defensible.
- The closing meeting agenda: From an audit's results, prepare the closing meeting agenda and the summary table to present.
- Evaluate the corrective action: Mark which of five corrective action plans fix only the symptom and do not address the root cause.
- An audit report on Annex A access controls: From a prepared evidence set, write an internal audit report on access controls with findings, grades and a conclusion.
About this course
Following ISO 19011 you plan an ISMS internal audit programme, prepare checklists, interview, gather evidence, grade and write nonconformities and follow up corrective actions.
What you will learn
- The audit programme
- Preparation
- Fieldwork
- Reporting and follow-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.