PECB ISO 28000 Lead Auditor study plan
PECB ISO 28000 Lead Auditor · Give each week a clear focus.
8 weeks · About 7 hours per week
Fundamental principles and concepts of a security management system
Define and contrast the core ISO 28000 security management system concepts: security, resilience, risk, threat, vulnerability, and asset, in your own words
Map the Plan-Do-Check-Act cycle onto the ISO 28000 clause structure and explain where each clause sits
Explain the scope and applicability of ISO 28000 to supply chain security and how it relates to ISO 31000 risk management and the ISO 28000 series guidance documents
Identify the fundamental principles of a security management system, including leadership, risk-based thinking, and continual improvement, and describe why each matters
Your checkpoint
A one-page concept map linking the PDCA cycle, the ISO 28000 clause structure, and the core security terminology, with a short written definition for each term
Security management system requirements
Break down the clause-by-clause requirements of ISO 28000, from scope and normative references through to improvement
Interpret the requirements for security policy, security risk assessment, and security risk treatment and explain what objective evidence would demonstrate conformity
Explain the requirements for documented information, competence, awareness, and communication in a security management system
Distinguish mandatory requirements from guidance and identify where an auditor has discretion versus where conformity is binary
Your checkpoint
A clause-by-clause requirements checklist with, for each clause, the requirement, the type of evidence an auditor would seek, and common conformity pitfalls
Fundamental audit concepts and principles
Define the audit types (first-party, second-party, third-party) and explain the principles of auditing in ISO 19011, including integrity, fair presentation, due professional care, confidentiality, independence, and evidence-based approach
Describe the audit process stages and the roles and responsibilities of the audit client, audit team leader, auditors, and auditee
Explain audit criteria, audit evidence, and audit findings, and distinguish nonconformity, observation, and opportunity for improvement
Explain the risk-based approach to auditing and how to determine audit sampling and prioritization
Your checkpoint
A written comparison table of audit principles and audit types, plus a set of ten practice scenarios where you classify each finding as major nonconformity, minor nonconformity, observation, or opportunity for improvement with justification
Preparing an ISO 28000 audit
Draft an audit plan for a fictional organization that defines objectives, scope, criteria, schedule, and resource allocation
Prepare a document review checklist and a set of audit checklists mapped to ISO 28000 clauses
Design an opening meeting agenda and a set of interview questions for top management, security risk owners, and operational staff
Identify the information needed to assess audit feasibility, including access, confidentiality, and safety constraints
Your checkpoint
A complete audit preparation pack for a fictional organization: audit plan, document review checklist, clause-mapped audit checklist, and opening meeting agenda
Conducting an ISO 28000 audit
Conduct a simulated opening meeting and document how you confirm scope, criteria, schedule, and communication arrangements
Practice evidence collection through interviews, document review, and observation, and record findings against audit criteria
Write nonconformity statements that state the requirement, the objective evidence, and the gap, without prescribing the solution
Explain how to handle conflicting evidence, uncooperative auditees, and changes to the audit plan during the audit
Your checkpoint
A simulated audit report section containing at least five properly written nonconformity statements, each traceable to a clause and to recorded objective evidence
Closing an ISO 28000 audit
Prepare a closing meeting agenda and explain how to present findings, agree on corrective action timelines, and record disagreements
Explain the requirements for audit report content, distribution, and retention, and the criteria for audit completion
Describe how to evaluate corrective action submissions and verify effectiveness, and how follow-up audits are scoped
Explain the audit client's role in accepting the report and the auditor's limits regarding consultancy
Your checkpoint
A closing meeting pack including agenda, a summary of findings, a corrective action request template, and a follow-up verification plan
Managing an ISO 28000 audit program
Explain the elements of an audit programme, including objectives, extent, risk-based scheduling, resources, and performance monitoring
Describe how to establish, implement, monitor, review, and improve an audit programme in line with ISO 19011 guidance
Explain auditor competence requirements and how to evaluate auditor performance and programme effectiveness
Identify how audit programme records support continual improvement of the security management system
Your checkpoint
A one-year audit programme outline for a fictional organization, including a risk-based schedule, competence criteria for auditors, and programme performance indicators
Fundamental principles and concepts of a security management system & Security management system requirements & Fundamental audit concepts and principles & Preparing an ISO 28000 audit & Conducting an ISO 28000 audit & Closing an ISO 28000 audit & Managing an ISO 28000 audit program
Review weak areas identified in earlier weeks and re-explain each weak concept without notes
Complete a full timed mock examination covering all seven domains and analyze every incorrect answer by domain
Rehearse scenario-based questions on audit planning, conduct, reporting, and programme management under time pressure
Consolidate a personal summary sheet of key definitions, clause requirements, and audit process steps
Your checkpoint
A scored mock examination result with a domain-by-domain error analysis and a final one-page revision sheet covering all seven domains
Milestones
Week 2: Can explain every ISO 28000 clause requirement and the evidence that would demonstrate conformity, without referring to notes
Week 4: Has produced a complete, internally consistent audit preparation pack that another auditor could execute from
Week 6: Can write a nonconformity statement and run a closing meeting end to end, and scores at least 70 percent on a practice set of audit-conduct and reporting scenarios
Week 8: Scores at least 80 percent on the full timed mock examination with no domain below 65 percent