Lead implementer: a 3-week study plan

Implementer courses are about building a management system that works — and passing an exam about how you would do it. Use your own organisation (or one you know well) as the case study throughout.

1 Week 1 — the standard and the project

Read clauses 4 to 10 of the standard, noting every requirement for documented information
Draft a scope statement and a list of interested parties for your organisation (clauses 4.2 and 4.3)
Sketch the main processes and how they interact (clause 4.4)

2 Week 2 — risk, objectives and controls

Work through a small risk assessment using the method your standard expects (for ISO/IEC 27001 and ISO/IEC 42001 this includes selecting controls and a Statement of Applicability)
Write three measurable objectives with owners, resources and deadlines (clause 6.2)
List the competence and awareness needs for people affected (clauses 7.2 and 7.3)

3 Week 3 — operation, checking and certification

Plan monitoring and measurement: what, how, when, who analyses it (clause 9.1)
Draft an internal audit programme for one year (clause 9.2) and a management review agenda (9.3)
Understand how certification works: stage 1 and stage 2 audits, surveillance and recertification
Read how ISO auditor exams work — PECB implementer exams follow the same rules as its auditor exams

4 The exam

PECB lead implementer courses run five days with the exam on day 5; IBITGQ’s CIS LI exam (GRC Solutions) is a 90-minute online exam. Questions usually describe a scenario and ask what an implementer should do next, so practise applying clauses rather than reciting them.

1 Week 1 — the standard and the project

2 Week 2 — risk, objectives and controls

3 Week 3 — operation, checking and certification

4 The exam

S Sources