Who is this programme for?
Employees and specialists in information security management, prospective internal auditors and process owners with internal audit responsibilities.
Curriculum & Assessment Programme
ISO/IEC 27001 Internal Auditor – Curriculum and Assessment Programme
Apply ISO/IEC 27001 in an internal audit, from justified planning and interviews to findings that others can understand and act upon.
Academy-owned programmes are offered in German and English. Hungarian instruction is available for PECB courses only.
Audience and entry requirements
What are the entry requirements?
Basic knowledge of ISO/IEC 27001 and an understanding of relevant workplace processes. Prior knowledge is considered through a short entry check. No particular provider qualification is compulsory; gaps in subject foundations should be addressed before the audit training.
Scope and learning format
24 teaching units of 45 minutes = 18 clock hours over 3 course days, including 3 units (135 minutes) of final assessment per candidate. Teaching, supervised practice and case transfer occupy 21 units. Oral components use individually allocated, potentially parallel assessment slots. Breaks are excluded.
Live online through alfaview or in person, with learning materials and assessment information in the Odoo portal. One teaching unit (UE) is 45 minutes; breaks are excluded. The timetable, teaching and assessment languages and any individual oral assessment slots are confirmed before the course begins.
Which competencies will you demonstrate?
- Translate an audit assignment into a reasoned plan involving the appropriate people.
- Build an evidence trail across several sources and identify unresolved questions.
- Write a factual finding that affected colleagues can understand without additional explanation.
- Recommend the next audit step without presenting untested statements as established conclusions.
- State the limits of conclusions and identify specialist clarification needs transparently.
The curriculum
Audit foundations and assignment
ISO 19011 audit principles, roles, integrity, confidentiality, independence, objectives and audit criteria.
Scope / allocation
3 teaching units
Evidence and output
A bounded audit assignment with criteria.
Standard-specific audit trails
ISMS scope, information security risks, risk treatment, applicability of controls and evidence of effectiveness. From an information security risk through the justified control to actual access or incident evidence.
Scope / allocation
3 teaching units
Evidence and output
A map connecting requirements, risks and audit questions.
Planning and sampling
Audit objectives, process selection, timetable, risk-based sampling, document review and considerations for live online audits.
Scope / allocation
4 teaching units
Evidence and output
An audit plan and justified sampling plan.
Interviews and evidence review
Open questions, active listening, follow-up questions and comparison of statements with records. Relevant evidence: Risk assessment, treatment plan, statement of applicability, approvals, access record and incident report.
Scope / allocation
4 teaching units
Evidence and output
An interview guide and traceable evidence notes.
Evaluation and reporting
Separate requirement, evidence, finding and evaluation; state conformity, nonconformity and unresolved questions objectively.
Scope / allocation
3 teaching units
Evidence and output
Two developed findings linked to criteria and evidence.
Integrated case, closing and follow-up
An organisation operates a cloud service. Review risk treatment, access rights, supplier management and a security incident using a bounded case file. Closing discussions, follow-up and effectiveness review. An ISMS audit does not replace penetration testing or comprehensive technical testing. Confidential security information is used only with agreed authorisation.
Scope / allocation
4 teaching units
Evidence and output
An integrated audit case dossier.
Final assessment
Standard-specific knowledge questions, a written audit case and an observed interview with professional discussion.
Scope / allocation
3 teaching units
Evidence and output
Scored audit plan, findings and communication.
How your work is assessed
Weighting: 30 %
Standard and audit knowledge
20 selected-response and short-answer tasks on audit principles, the selected management system, sampling and evidence.
45 minutes
- Technical accuracy
- Understanding of the chosen standard focus
- Justified selection of audit methods
Weighting: 50 %
Practical audit case
Using a bounded case file, produce an audit plan, a justified sample and two evidence-based findings with follow-up. An organisation operates a cloud service. Review risk treatment, access rights, supplier management and a security incident using a bounded case file.
60 minutes
- Risk-appropriate planning and sampling
- Link between requirements and evidence
- Objective findings and clear limitations
- Appropriate follow-up and effectiveness review
Weighting: 20 %
Audit interview and professional discussion
A 15-minute observed role-play interview followed by 15 minutes of questions about evaluation and reporting.
30 minutes
- Open, purposeful questions
- Objective evaluation of evidence
- Respectful and clear communication
- Handling contradictions and limitations
Pass requirements
A pass requires at least 70 of 100 weighted overall points and at least 60 of 100 points in every mandatory assessment component. In the practical component, the critical criterion “link between requirements and evidence” must achieve at least 2 of 4 rubric points. These thresholds are Academy policy; ISO/IEC 17024 does not prescribe these scores.
Practical performance is scored against each published criterion from 0 to 4: 0 = absent or unusable; 1 = substantial technical gaps; 2 = usable work with identifiable gaps; 3 = traceable and technically sound; 4 = complete, precise and critically justified. Criteria within a component are weighted equally unless a different published allocation is stated in the task. Component scores are converted to a percentage.
Link between requirements and evidence
Permitted resources and AI
Permitted aids are the standard edition named in the assessment plan, personal course notes, the supplied case materials and a basic calculator. Communication with third parties, generative AI, automated answer services and unapproved internet research are not permitted during assessed components. Word processing is permitted for case dossiers; accessibility aids are agreed beforehand.
Identity and independent work
Before assessment, identity is checked against an official photo ID. For live online assessment, access, supervision, permitted aids and technical contingency arrangements are explained beforehand. This does not automatically require retaining an ID copy or recording the assessment.
The common assessment rules also cover retakes, reasonable adjustments, appeals, confidentiality and certificate authorisation.
Assessment and Certificate RulesWhat your certificate demonstrates
Academy course certificate: ISO/IEC 27001 Internal Auditor, 24 teaching units with passed assessment
- Scope of the credential
- The certificate records the competencies specified in the programme and demonstrated through documented assessment, the assessment date, scope and programme version. Attendance alone is insufficient for an assessment certificate.
- How to interpret the qualification
- An Academy course certificate with assessment. It is not a PECB, TÜV, DEKRA or CQI/IRCA qualification and is not evidence of accredited personnel certification. No accreditation or full conformity of the Academy with ISO/IEC 17024 is claimed. It records the standard focus actually assessed. It does not authorise work as a third-party certification auditor or automatically permit certification of organisations. An ISMS audit does not replace penetration testing or comprehensive technical testing. Confidential security information is used only with agreed authorisation.
- Assessment date and currency
- Under Academy policy, this certificate is valid for a maximum of three years from its date of issue. It is issued only after all programme and assessment requirements have been met and the award decision has been documented. The validity period does not start on enrolment or at the beginning of the course. The actual validity period and expiry date are stated on the certificate; a shorter period applies only when expressly specified in the relevant course or assessment programme. There is no automatic extension. Renewal requires a documented review of current knowledge and application appropriate to the programme, using recent evidence and/or a suitable update or competence assessment. Repurchasing the entire course is not a blanket requirement. A renewed Academy certificate is also valid for no more than three years from its issue date. Attendance and passing an assessment remain verifiable historical facts tied to their dates; they do not provide indefinite validity as evidence of current competence.
This programme applies to deliveries whose agreed course and assessment plan explicitly references this revision. Existing bookings retain their agreed terms.
Programme questions
Does the certificate cover standards other than ISO/IEC 27001?
The certificate names the standard focus actually assessed. Transferable audit methods do not replace subject knowledge and assessment for another management system.
Can I independently lead every audit after three days?
The course demonstrates defined competencies through a bounded assessment case. Real assignments also require relevant sector knowledge, practical experience, an appropriate audit scope and organisational appointment.
What concrete task will I work on?
An organisation operates a cloud service. Review risk treatment, access rights, supplier management and a security incident using a bounded case file. Audit planning, sampling, evidence-based findings and professional interviewing are assessed.
What if I fail an assessment component?
You receive feedback on the assessed competency areas. Failed components may be retaken under the common assessment rules using equivalent new tasks. Dates, any preparation required and any fees are communicated beforehand.
What does the Academy certificate demonstrate?
It records a passed course assessment with stated competencies, scope and programme version. It is not accredited personnel certification and does not replace professional experience or an assignment-specific suitability assessment.
Advice & course planning
Solo self-employed in Germany? Discuss potential KOMPASS support with an official advisory centre before booking. We can help you select a suitable programme in a consultation.
An Academy-owned assessed competence credential. The assessment programme refers to selected principles of ISO/IEC 17024:2026. This is not a claim of accreditation or fully demonstrated conformity.