ISO 27005 Internal Auditor - United Kingdom

ISO 27005 Internal Auditor Course Outline

The following subjects will be taught during this course:

Module 1: Introduction to ISO 27005 Standard

• Introduction
• Concepts, Key Definitions, and Background
• Quality Management System (QMS)
• Information Security Risk Management
• Role and Importance
• Understanding the Situation in an Organisation
• Reviewing and Monitoring
• Octave Method
• EBIOS Method
• MEHARI
• Harmonised TRA Method

Module 2: Interaction with Other ISO

• How ISO 27005 Interacts with ISO 27001?
• Quantifying the Business Impact
• Impact Severity

Module 3: Planning Individual Internal Audits

• Internal Audit Approach
• Risk Assurance Mapping
• Audit Plan
• Research the Audit Area
• Conduct Process Walk-Throughs
• Map Risks to the Organisation, Process, or Function
• Obtain Data Prior to Fieldwork

Module 4: Conducting Internal Audit and Handling the Interview Process

• Identify Risks
• Plan and Audit Activities
• Validate the Facts and Complete the Work
• Develop a Deliverable or Report that will Drive Action
• Follow Up

Module 5: Understanding Risk Management in an Internal Audit

• Introduction
• Risk Management Process

Module 6: Preparation of an ISO 27005 Audit

• Define Audit Objectives and Scope
• Select Audit Criteria
• Establish Audit Teams
• Develop Audit Plan

Module 7: Conducting an ISO 27005 Audit

• Risk Management Process
  • Context Establishment
  • Risk Assessment
  • Risk Treatment
  • Risk Acceptance
  • Risk Communication and Consultation
  • Risk Monitoring and Review

Module 8: Closing an ISO 27005 Audit

• Prepare Audit Report
• Distribute Audit Report
• Conduct Audit Follow-up

Module 9: Managing an ISO 27005 Audit Program

• Know What and When to Audit
• Create an Audit Schedule
• Pre-Planning the Scheduled Audit
• Conducting the Audit
• Record the Findings
• Report Findings