Ready to strengthen your ISMS internal audits?
Expert and experienced consultants, 8,100+ client engagements in 60+ countries, from gap assessment to a system ready for its certification audit.
Talk to a Sterling consultant← All courses
Practitioner · Auditing Coming soon
ISO/IEC 27001 Internal Auditor Training
Audit your ISMS with evidence, not assumptions.
A practitioner course for internal auditors of information security management systems: what ISO/IEC 27001:2022 clause 9.2 requires of internal audits, and how to plan, conduct, report and follow up an ISMS audit using ISO 19011:2026 guidance, including auditing the risk assessment, the Statement of Applicability and Annex A controls.
This course is in production. Talk to Sterling to be told when it opens.
Learning outcomes
Knowledge you can put to work.
Connect the subject to the responsibilities and decisions people encounter in their roles.
- Explain what ISO/IEC 27001:2022 clause 9.2 requires of internal audits and the audit programme
- Plan an ISMS audit and prepare checklists covering the management system clauses and Annex A controls
- Interview control owners and sample technical and organisational evidence
- Audit the risk assessment, Statement of Applicability and risk treatment plan
- Write clear nonconformities, report results and follow up corrective action
What the course covers
The ground this course will cover.
- The role of the internal auditor, and what ISO/IEC 27001:2022 clause 9.2 requires of the internal audit programme
- ISO 19011:2026 principles of auditing and the risk-based approach to planning ISMS audits
- Preparing for an audit: scope, criteria, documented information, the audit plan and ISMS checklists
- Auditing ISMS clauses 4 to 10, including the risk assessment, Statement of Applicability and risk treatment plan
- Auditing Annex A controls: interviews, observation, configuration and log reviews, and sampling records
- Writing nonconformities and opportunities for improvement that trace back to a requirement or control
- The closing meeting, the audit report, corrective action and audit follow-up
The module list, running time and the standard's edition are shown here when the course opens.
Frequently asked questions
Your questions,
answered.
About ISO/IEC 27001 Internal Auditor Training, its certificate and enrolment.
Ask SterlingWho is the ISO/IEC 27001 Internal Auditor course for?
It is for people who carry out or support internal audits of an ISO/IEC 27001 information security management system: ISMS team members, IT and security staff, control owners, compliance officers and staff appointed as internal auditors. It suits organisations preparing for certification and those strengthening an existing ISMS audit programme. A working knowledge of ISO/IEC 27001 helps; learners new to it may start with Sterling Academy's ISO/IEC 27001 awareness training.
What does the ISO/IEC 27001 Internal Auditor course cover?
It covers what ISO/IEC 27001:2022 clause 9.2 requires of internal audits, and the ISO 19011:2026 guidance on how to audit. You learn the work an internal auditor does: plan the audit, prepare checklists, interview control owners, sample and verify evidence, write nonconformities, report the results and follow up corrective action. It also shows how to audit the risk assessment, the Statement of Applicability and Annex A controls.
How long does the ISO/IEC 27001 Internal Auditor course take?
ISO/IEC 27001 Internal Auditor Training is in production. When it opens, it will be a set of short video modules followed by practice questions and a final exam, and the course page will show the number of modules and the approximate video runtime; allow additional time for the practice questions, the audit exercises and the exam. With 12 months of access, you can complete it in one sitting or spread it over several sessions.
Do learners receive a certificate?
Yes. Learners who reach the 70% pass mark in the final exam receive a Sterling Academy Certificate of Completion for ISO/IEC 27001 Internal Auditor Training. Each certificate carries a unique number and a QR code, and anyone can check it online using the certificate number and the holder's surname. It is a training certificate for the individual learner, showing completion of the course; it is not an auditor qualification.
Is the course online and self-paced?
Yes. ISO/IEC 27001 Internal Auditor Training is a self-paced online course made of short video modules, in English with captions. You study at your own pace during 12 months of access, and practice questions after modules help you check your understanding before the final exam. If a point is unclear, questions are answered by a Sterling consultant.
Can we enrol a team, and how much does it cost?
ISO/IEC 27001 Internal Auditor Training has a list price of US$149 per learner, with a limited-time offer of US$99 per learner until 31 December 2026. Teams save 20% for 11 to 50 learners and 30% for 51 to 200; 201 or more learners are priced on request. Client administrators can track their team's progress. Prices are in US dollars, excluding taxes, and Sterling confirms final pricing and enrolment.
Does this course make me a qualified auditor, or our organisation ISO 27001 certified?
No. The Certificate of Completion is a training certificate: it shows that one person completed the ISO/IEC 27001 Internal Auditor course and reached the pass mark in its final exam. Who may audit internally is decided by your own organisation, based on the competence it requires. Sterling does not certify organisations; an organisation is certified to ISO/IEC 27001 by an independent certification body after that body's own audit.
Assessment & completion
Complete the learning.
Keep a verifiable record.
Learners who complete the course and its final exam receive a numbered Sterling Academy Certificate of Completion with online QR verification.
This records course completion. It does not confer ISO certification or a professional auditor qualification.
- Pass mark
- 70%
- Prerequisites
- None
Your next step
Not sure which course?