Who is this lead auditor course for?
The course is relevant to auditors, consultants and professionals responsible for information security arrangements. You should already understand the relevant management-system requirements and basic audit principles so that you can focus on evaluating evidence and leading the audit process.
What will you learn to evaluate?
Assess how an organisation protects information through a risk-based information security management system.
- Information security risks, treatment choices and the Statement of Applicability.
- Governance, documented controls and evidence of implementation.
- Monitoring, internal review and corrective action for the security management system.
Five-day training and examination route
The published PECB agenda progresses from the management system and standard to audit preparation, on-site activities, reporting and closing. Day 5 is the certification examination. Exercises develop audit planning, evidence gathering, findings and communication skills.
Does passing the exam make you a certified Lead Auditor?
Passing the exam allows you to apply for the appropriate PECB credential. The full Lead Auditor grade also has professional experience and audit-experience requirements, together with acceptance of the Code of Ethics. A Provisional Auditor route is available where the experience requirements are not yet met.
A training completion attestation, an exam result and a professional credential are different outcomes. Your application should match your documented experience.
Is this a technical penetration-testing course?
The focus is auditing an information security management system. Technical controls form part of the evidence, but the course concerns governance, risk treatment, implementation and assurance rather than teaching offensive security testing.