ISO/IEC 27701 Privacy Information Management
The privacy extension to your ISMS: controller and processor duties, GDPR and DPDP Act mapping.
Enquire
ISO/IEC 27001 Lead Auditor
Five days that take you from reading the standard to leading the audit: planning scope, sampling evidence, writing nonconformities that hold up, and closing a meeting where nobody agrees with you.
Course overview
ISO/IEC 27001 is the international standard for an information security management system. Auditing one is a skill in its own right: the standard tells you what must exist, not how to find out whether it really does. This program teaches the second part.
Over five days you work through a complete audit cycle against ISO/IEC 27001:2022 and its Annex A control set, using the audit guidance in ISO 19011 and the certification requirements in ISO/IEC 17021-1 as your frame. You will plan an audit from a real scope statement, build a checklist that does not read like a questionnaire, interview a difficult auditee, sample evidence, grade what you find, and defend it.
Why take this course
Most people arrive able to quote clause 6.1.2 and unable to tell whether the risk assessment in front of them is genuine or reverse-engineered the week before the audit. That gap is what gets audits waved through, and what gets an organisation breached anyway, holding a valid certificate.
- Taught by auditors who are still auditing, using findings they have actually had to defend
- Roughly half the time is workshop: documents, interviews, findings, reports
- Small cohorts, so every participant writes findings and gets them marked
- Built on the 2022 edition: 93 Annex A controls, four themes, the attribute table
Learning outcomes
By the end of the program you will be able to:
- Explain the intent of every clause from 4 to 10 and what evidence satisfies it
- Judge whether a scope statement, SoA and risk treatment plan are consistent with each other
- Plan a Stage 1 and Stage 2 audit, allocate an audit team, and set a defensible sample
- Conduct interviews that produce evidence rather than agreement
- Write a nonconformity with requirement, evidence and statement of nonconformity clearly separated
- Grade major against minor consistently, and justify the call
- Evaluate root cause analysis and corrective action, and decide when to close a finding
Who should attend
- Internal auditors moving to lead-auditor responsibility
- Information security and GRC managers
- Consultants who advise on ISMS implementation
- IT and engineering leads accountable for controls
- Anyone preparing to join a certification body's audit team
Prerequisites
There is no formal entry requirement, but the pace assumes you arrive with:
- A working understanding of information security concepts
- Familiarity with the structure of ISO management system standards
- Ideally, prior exposure to ISO/IEC 27001 at foundation or implementer level
If you are unsure, tell us your background in the enquiry form and we will give you an honest answer.
Course structure
Day 1: The standard, properly
Management system anatomy, clauses 4 to 10, the Annex A themes and attributes, and how the Statement of Applicability is supposed to be derived.
Day 2: Risk, controls and evidence
Risk assessment and treatment in practice; what "documented information" means; reading an SoA against a risk treatment plan and spotting the seams.
Day 3: Planning the audit
ISO 19011 principles, audit programme versus audit plan, Stage 1 and Stage 2, team roles, sampling, checklist design. First full workshop.
Day 4: Conducting the audit
Opening meeting, interview technique, evidence trails, note discipline, nonconformity writing and grading, handling pushback. Role-play throughout.
Day 5: Reporting, closure and assessment
Closing meeting, audit report, corrective action review, follow-up and closure decisions. Written assessment and individual feedback.
Upcoming batches
| Dates | Mode | Timing | Status |
|---|---|---|---|
| To be announced | Live online | IST, weekday | Registering |
| To be announced | Live online | IST, weekend | Waitlist |
| To be announced | Pune, in-person | IST, weekday | Waitlist |
Dates are confirmed once a batch reaches minimum enrolment. Join the waitlist and you are told first.
Certification information
Participants who complete the program and pass the written assessment receive a ZULTIV certificate of successful completion, stating the standard, the syllabus covered and the contact hours. Those who attend without sitting the assessment receive a certificate of attendance.
Please read this carefully: ZULTIV is a training and assurance provider. We are not an accredited certification body and we do not issue ISO certificates to organisations, nor do we award personnel credentials on behalf of any scheme owner. If you need an externally awarded lead auditor credential, tell us in the enquiry form and we will explain which examination bodies award it and what the route looks like, including when the honest answer is that you do not need one.
Your trainer
Led by a practising lead auditor
Every ZULTIV lead auditor program is delivered by someone who audits for a living , not a full-time trainer working from a slide pack. That means the examples are current, the war stories are first-hand, and the answer to "what would you actually do here?" is a real one.
Full trainer profile and credentials are shared with confirmed participants ahead of the batch, and are available on request.
Frequently asked questions
Roughly the first two days establish the standard and the audit framework; days three
to five are predominantly workshop. You will personally plan an audit, run interview
segments, write findings, and present a closing meeting.
It is a genuine assessment, not a formality, it is scenario-based and asks you to
write and grade findings rather than recall clause numbers. Participants who take part
in the workshops throughout the week generally pass comfortably.
ISO/IEC 27001 is copyrighted and must be purchased from ISO or a national standards
body: we cannot distribute it. We recommend having your own copy, and we tell you
exactly which edition and which companion documents are worth the money.
Tell us as early as you can. Depending on which day it is, we will either arrange a
catch-up session before the next module or move you to the following batch at no extra
charge. The workshop days are difficult to make up in isolation.
Yes, and it is usually the better option above about eight people, because we can
rebuild the workshop material around your own scope, SoA and control set. See
Corporate Training.
Enquire now
Ask about this program
Tell us where you are starting from. We will come back with dates, fees and a straight answer about whether this is the right course for you.
Related
Programs people take alongside this one
ISO/IEC 42001 Lead Auditor
Audit an AI management system, the standard boards started asking about in 2024.
Enquire
ISO/IEC 27001 Internal Audit
Would rather we ran the audit than taught you to? That is our assurance side.
View service