Certified ISO/IEC 27001 Lead Auditor Training in Switzerland

• Develop the confidence to plan, lead, and report complete ISMS audits.
• Designed for auditors, consultants, and compliance professionals responsible for ISMS programmes.
• Delivered as an accredited PECB-authorised training programme.

The Certified ISO/IEC 27001 Lead Auditor course develops the knowledge and practical expertise required to audit an Information Security Management System (ISMS) against ISO/IEC 27001:2022.

The programme is based on widely recognised audit principles, procedures, and techniques. Participants learn how to plan, conduct, report, and follow up both internal and external ISMS audits.

The course applies the management system auditing guidance of ISO 19011 together with the certification audit requirements associated with ISO/IEC 17021-1. This allows participants to move beyond simply understanding ISO/IEC 27001 requirements and learn how those requirements should be assessed from an auditor's perspective.

The programme also develops the wider competencies required of a Lead Auditor, including audit programme management, leading an audit team, communicating with clients, evaluating audit evidence, reporting nonconformities, and managing conflict during the audit process.

By the end of the training, participants will be able to interpret ISO/IEC 27001 within an audit context, structure Stage 1 and Stage 2 audits, manage audit activities, and communicate findings professionally.

Key Benefits

Bilginç IT Academy is a recognized official training partner of PECB (Professional Evaluation and Certification Board).
Through this partnership, we deliver globally accredited PECB-certified training programs, enabling professionals to gain international recognition and practical expertise in areas such as Artificial Intelligence Management, Information Security, Environmental, and Quality Management Systems.
Visit our official PECB partner page here: Bilginç IT Academy – PECB Official Partner 

Participants should have:

• A fundamental understanding of ISO/IEC 27001
• Knowledge of Information Security Management System concepts
• Comprehensive knowledge of audit principles

By the end of the course, participants will be able to:

• Explain how an ISMS operates based on ISO/IEC 27001
• Describe the relationship between ISO/IEC 27001, ISO/IEC 27002, and other relevant standards and regulatory frameworks
• Explain the auditor's role under ISO 19011
• Plan a management system audit
• Lead an audit team
• Initiate and follow up audit activities
• Interpret ISO/IEC 27001 requirements from an auditor's perspective
• Conduct Stage 1 and Stage 2 audits
• Develop audit test plans
• Evaluate objective evidence
• Draft audit findings and nonconformity reports
• Prepare audit reports
• Assess corrective action plans
• Conduct audit follow-up
• Establish and manage internal audit programmes
• Evaluate auditor competence
• Manage audit communication and conflict resolution

Day 1: Introduction to Information Security Management Systems and ISO/IEC 27001

The first day introduces the structure of ISO/IEC 27001 and the fundamental principles of an ISMS.

Course Objectives and Structure

Topics include:

• Programme objectives
• Course structure
• Lead Auditor responsibilities
• Expected learning outcomes

Standards and Regulatory Frameworks

Topics include:

• ISO/IEC 27001
• ISO/IEC 27002
• Related management system standards
• Regulatory frameworks
• Relationships between standards

Certification Process

Topics include:

• ISO/IEC 27001 certification lifecycle
• Certification audit approach
• Stage 1 audit
• Stage 2 audit
• Surveillance
• Recertification

Fundamental Principles of Information Security

Topics include:

• Information security
• Confidentiality
• Integrity
• Availability
• Risk-based information security
• Relationship between governance and management

Management Systems

Topics include:

• Management system approach
• Policies
• Processes
• Controls
• Monitoring
• Improvement

Information Security Management Systems

Topics include:

• Purpose of an ISMS
• ISMS scope
• ISMS components
• Risk management
• Performance evaluation
• Continual improvement

Day 2: Audit Principles, Preparation and Launching the Audit

Fundamental Audit Concepts and Principles

Topics include:

• Audit objectives
• Audit scope
• Audit criteria
• Audit evidence
• Auditor independence
• Objectivity
• Confidentiality
• Professional judgement

Evidence-Based Audit Approach

Participants examine how objective and verifiable evidence is used to support audit conclusions.

Topics include:

• Objective evidence
• Evidence reliability
• Sampling
• Document review
• Interview evidence
• Observation
• Traceability

Initiating the Audit

Topics include:

• Audit request
• Defining audit objectives
• Establishing scope
• Selecting the audit team
• Client communication
• Initial documentation review
• Evaluating audit feasibility

Stage 1 Audit

Stage 1 focuses on determining whether the organisation is ready to proceed to the Stage 2 certification audit.

Topics include:

• ISMS documentation review
• Scope validation
• Organisational context
• Readiness assessment
• Identifying significant gaps
• Preparing for Stage 2

Preparing the Stage 2 Audit

Topics include:

• Detailed audit planning
• Audit schedule
• Team responsibilities
• Sampling plans
• Audit agenda
• Evidence requirements

Stage 2 Audit – Part 1

Participants begin exploring the practical execution of the Stage 2 audit.

Day 3: On-Site Audit Activities

Stage 2 Audit – Part 2

This section focuses on assessing ISO/IEC 27001 implementation and ISMS effectiveness.

Topics include:

• ISMS implementation assessment
• Process conformity
• Control implementation
• Operational evidence
• Management involvement
• ISMS effectiveness

Communication During the Audit

Topics include:

• Opening meetings
• Auditor-auditee communication
• Interview techniques
• Active listening
• Clarification
• Managing disagreements
• Conflict resolution
• Preparing for the closing meeting

Audit Procedures

Participants examine common methods used to collect and verify audit evidence.

Topics include:

• Interviews
• Document review
• Observation
• Sampling
• Following audit trails
• Process tracing
• Evidence verification

Creating Audit Test Plans

Topics include:

• Audit objectives
• Test criteria
• Evidence sources
• Sampling
• Test procedures
• Expected evidence
• Evaluation methods

Drafting Audit Findings and Nonconformity Reports

Topics include:

• Conformity
• Nonconformity
• Objective evidence
• Formulating findings
• Writing nonconformities
• Traceability to requirements
• Audit reporting principles

Day 4: Closing the Audit

Audit Documentation and Quality Review

Topics include:

• Working papers
• Evidence records
• Audit notes
• Findings
• Report consistency
• Quality review
• Document control

Closing the Audit

Topics include:

• Closing meeting
• Audit conclusions
• Final audit report
• Certification recommendation
• Client communication
• Audit records

Evaluating Action Plans

Topics include:

• Corrective actions
• Root cause analysis
• Action plan adequacy
• Evidence of correction
• Effectiveness review
• Follow-up requirements

Benefits of the Initial Audit

Topics include:

• ISMS maturity insight
• Process improvement opportunities
• Risk visibility
• Compliance confidence
• Management awareness

Managing an Internal Audit Programme

Topics include:

• Audit programme objectives
• Risk-based scheduling
• Resource allocation
• Auditor assignment
• Audit frequency
• Reporting
• Follow-up
• Continual improvement

Competence and Evaluation of Auditors

Topics include:

• Auditor knowledge
• Audit skills
• Professional behaviour
• Independence
• Experience
• Performance evaluation
• Continuing professional development

Closing the Training

The final section reviews the key Lead Auditor concepts and examination domains.

Exams and Assessments

The associated PECB Certified ISO/IEC 27001 Lead Auditor examination is delivered remotely through the PECB proctoring platform.

Participants receive an exam voucher and take the remote-proctored examination after the course.

The examination meets the requirements of the PECB Examination and Certification Programme (ECP).

Exam Competency Domains

Domain 1: Fundamental Principles and Concepts of an ISMS

• Information Security Management System fundamentals
• ISMS principles
• ISO/IEC 27001 concepts

Domain 2: Information Security Management System

• ISMS requirements
• Management system operation
• Information security management processes

Domain 3: Fundamental Audit Concepts and Principles

• Audit principles
• Audit evidence
• Independence
• Objectivity
• Professional judgement

Domain 4: Preparation of an ISO/IEC 27001 Audit

• Audit planning
• Scope
• Objectives
• Audit team
• Stage 1 audit
• Stage 2 preparation

Domain 5: Conducting an ISO/IEC 27001 Audit

• Stage 2 audit
• Interviews
• Audit procedures
• Evidence gathering
• Test plans
• Conformity assessment

Domain 6: Closing an ISO/IEC 27001 Audit

• Findings
• Nonconformities
• Reporting
• Corrective actions
• Follow-up
• Audit closure

Domain 7: Managing an ISO/IEC 27001 Audit Programme

• Audit programme planning
• Scheduling
• Resource management
• Auditor competence
• Monitoring
• Continual improvement

Examination results are communicated to candidates by email. Results are normally reported as Pass or Fail rather than as an exact numerical grade.

Candidates who successfully pass the examination and meet the relevant certification requirements may apply for the PECB Certified ISO/IEC 27001 Lead Auditor certification scheme.

Candidates who do not pass may receive guidance identifying the competency domains where additional preparation is needed before attempting a retake.