CQI/IRCA ISMS Lead Auditor study plan
CQI/IRCA ISMS Lead Auditor · Give each week a clear focus.
8 weeks · About 7 hours per week
Audit fundamentals and the principles of auditing (ISO 19011) & Conducting the audit: evidence gathering, interviewing, sampling and auditing techniques
Match each of the ISO 19011 auditing principles to a concrete auditor behaviour you would demonstrate on an ISO/IEC 27001 audit
Classify five written scenario statements as conformity, nonconformity, observation or improvement opportunity, and justify each classification
Select and justify a sampling approach (random, stratified, judgement-based) for three described audit situations
Draft a ten-question interview guide covering access control and incident management for an information security manager
Construct an evidence-gathering sequence (document review, observation, interview, re-performance) for one process
Your checkpoint
A two-page audit technique card containing a principles-to-behaviour table, five classified scenarios, three sampling justifications, a ten-question interview guide and one evidence sequence diagram
Audit planning, scope, criteria, documentation review and audit programme management
Define scope, boundaries, criteria and objectives for a given audit client in writing
Build a three-year audit programme with cycle frequency, coverage and resource estimates
Produce a documentation review checklist for an ISMS manual, risk register and Statement of Applicability
Construct a two-day audit timetable with clause coverage, auditor allocation and sampling rationale
Calculate audit duration and team size for a defined organisation size and complexity
Your checkpoint
A complete audit plan pack for a fictional 200-person SaaS provider: scope and criteria statement, documentation review checklist, two-day timetable, sampling rationale and duration calculation
Audit findings, nonconformity reporting, conclusions and follow-up of corrective action
Write nonconformity statements using the requirement-evidence-gap structure with correct clause references
Grade eight findings as major or minor nonconformity using stated classification criteria
Formulate corrective action requests with root-cause prompts and objective effectiveness-verification evidence
Draft the structure and required content of an audit report, including conclusions and recommendations
Design a follow-up schedule that tests implementation and effectiveness of corrective action
Your checkpoint
A set of eight nonconformity records from a case scenario, each with clause reference, objective evidence, classification, corrective action request and a proposed follow-up verification method
Leading an audit team and managing communications, conflicts and audit team competence
Assign auditor roles, responsibilities and clause ownership for a four-person audit team
Build an audit team competence matrix covering ISMS knowledge, sector knowledge, audit skills and personal attributes
Script a full opening meeting agenda and a closing meeting agenda with required attendees
Design a communication and escalation plan covering auditee disagreements and unresolved conflicts
Plan a conflict-handling approach for two described team and auditee conflict scenarios
Your checkpoint
An audit team pack: role allocation chart, competence matrix with identified gaps, opening and closing meeting scripts, and a one-page communication, escalation and conflict-handling plan
ISO/IEC 27001 requirements and Annex A information security controls in an audit context
Trace ISO/IEC 27001 clauses 4 to 10 to the specific objective evidence an auditor would seek for each
Map the Annex A control themes and identify the audit focus for each theme
Construct test procedures for five selected Annex A controls, including sample selection and pass criteria
Differentiate the audit tests needed for risk assessment, risk treatment and the Statement of Applicability
Identify the most common audit pitfalls when testing leadership commitment and performance evaluation
Your checkpoint
A clause-by-clause audit evidence table covering clauses 4 to 10, plus five written control test procedures with sampling plans and pass criteria
Information security management systems: purpose, benefits and structure of ISO/IEC 27001 & Related standards, risk management concepts and legal/regulatory and certification context
Describe the purpose, benefits and Plan-Do-Check-Act structure of an ISMS and explain how the standard's clauses interlock
Compare ISO/IEC 27001 with 27002, 27005, 27017, 27018 and 27701 in terms of purpose and audit relevance
Summarise certification context: accreditation, certification body role, stage 1 and stage 2 audits, surveillance and recertification
Identify legal, regulatory and contractual obligations that an ISMS audit must consider and how to test for them
Explain risk assessment, risk treatment options, residual risk acceptance and the role of the Statement of Applicability
Your checkpoint
A one-page comparison table of six related standards with audit relevance, plus a fifteen-card flashcard set on certification, legal/regulatory context and risk management concepts
Conducting the audit: evidence gathering, interviewing, sampling and auditing techniques & Audit findings, nonconformity reporting, conclusions and follow-up of corrective action
Conduct a simulated audit day from a written case file, gathering evidence through interviews and document sampling
Maintain a structured evidence log linking each item to a clause or control
Write six findings from the simulated evidence, mixing conformities and nonconformities with correct classification
Produce a full audit report with conclusions, certification recommendation and follow-up actions
Your checkpoint
A complete simulated audit output: evidence log, six graded findings and a full audit report scored against a self-built rubric at 80 per cent or better
Information security management systems: purpose, benefits and structure of ISO/IEC 27001 & Audit fundamentals and the principles of auditing (ISO 19011) & Audit planning, scope, criteria, documentation review and audit programme management & Conducting the audit: evidence gathering, interviewing, sampling and auditing techniques & Audit findings, nonconformity reporting, conclusions and follow-up of corrective action & Leading an audit team and managing communications, conflicts and audit team competence & ISO/IEC 27001 requirements and Annex A information security controls in an audit context & Related standards, risk management concepts and legal/regulatory and certification context
Rank your weakest three domains from prior deliverables and re-test each with targeted questions
Complete a timed 60-question mock examination under exam conditions
Re-derive the answer rationale for every missed question and record the underlying knowledge gap
Assemble a one-page exam-day strategy covering question triage, time allocation and scenario-based question handling
Your checkpoint
A timed 60-question mock examination scored at 80 per cent or above, plus a one-page personal remediation list naming each weak area, its evidence source and a re-test date
Milestones
Week 2: Self-score the audit plan pack against a ten-point checklist covering scope, criteria, programme cycle, documentation review, timetable and sampling rationale; rewrite any element scoring below full marks
Week 4: Closed-book 30-question quiz across domains 2, 3, 4, 5 and 6 scored at 75 per cent or above, with a written list of gaps for weeks 5 to 8
Week 7: Simulated audit report graded against your own rubric at 80 per cent or above, with at least five of six findings correctly structured and classified
Week 8: Timed 60-question mock examination at 80 per cent or above, with every incorrect answer mapped to a named remediation action and re-test date