1. Coverage of ISO/IEC 27001

The aim of this course is to provide delegates with the knowledge and skills required to perform first, second and third-party audits of information security management systems against ISO/IEC 27001 (with ISO/IEC 27002), in accordance with ISO 19011 and ISO 17021 as applicable.

This course is designed for delegates who have prior knowledge of information security management principles and concepts, and the requirements of ISO/IEC 27001 (with ISO/IEC 27002). Learning objective 1.1.1 and enabling objective 2.1 require delegates to apply and extend this prior knowledge in context with performing a management system audit. CQI and IRCA will accept training courses that include some coverage of the specific information security management-related clauses of ISO/IEC 27001, sufficient to enable delegates to refresh their prior knowledge. CQI and IRCA will not accept training courses designed to impart this knowledge. CQI and IRCA will not accept a clause-by-clause analysis of ISO/IEC 27001 in certified courses.

This course does require delegates to audit an information security management system against the requirements of ISO/IEC 27001 (with ISO/IEC 27002), including the ability to identify audit evidence to establish conformity or nonconformity.

You should advise delegates that course examination questions can relate to any requirement of ISO/IEC 27001 and the expected prior knowledge.

2. Auditing information security management system requirements

You will need to demonstrate that your course gives delegates the opportunity to audit an information security management system, covering the full scope of ISO/IEC 27001 (with ISO/IEC 27002).

CQI and IRCA require audit skills to be practised and tested through tasks, and in real or simulated audit situations. CQI and IRCA require a majority of the time available to be spent on these activities. A contiguous case study approach is often the most effective means of covering the learning objectives, particularly those relating to the auditing of the ISMS processes referenced in 2.3.3.

Tasks and simulated audits must make use of information security management system materials and documented information (scope, policies, objectives, plans etc) representative of those that auditors can expect to find in real audits of information security management systems, based on ISO/IEC 27001.

CQI and IRCA recognise it may not be practical for each student to audit all elements of ISO/IEC 27001. To meet the requirements of enabling objective 2.3.3 you should design audit activities so that individual and team activities collectively evaluate conformity (or otherwise) with all elements of ISO/IEC 27001.

CQI and IRCA require tasks and real or simulated audit situations to be both realistic and of sufficient complexity and duration to allow delegates to demonstrate, and for tutors to evaluate, achievement or otherwise of the audit skills specified in enabling objective 2.3.