Information security · Internal auditor
ISO/IEC 27001 Internal auditor
Teaches you to plan, carry out, report and follow up internal (first-party) audits of your own organisation’s management system. Usually two days, assessed by continuous assessment and a short test.
1 About this qualification
This is a internal auditor course applied to ISO/IEC 27001, the standard for information security.
Requirements for an information security management system: assessing information security risks, treating them with appropriate controls, and keeping the system effective. Annex A lists 93 reference controls in four themes.
2 UK courses
Course names, certification, duration and delivery as stated by each provider. We do not list prices — they change often; see the provider’s page.
| Course (as named by the provider) | Provider | Certified by | Duration | Link |
|---|---|---|---|---|
| Internal Auditor Training Course - ISO 27001:2022Classroom; Live online; In-house | BSI | Not stated | 2 days | Course pagechecked 3 October 2026 |
| ISO 27001:2022 Internal Auditor | LRQA | Not stated | See provider | Course pagechecked 3 October 2026 |
| CQI and IRCA ISO 27001 Internal Auditor Training (A2574)Virtual – tutor led | NQA | CQI and IRCA certified | 2 days | Course pagechecked 3 October 2026 |
| IRCA-CQI Information Security Management Systems (ISMS - ISO 27001:2022) Internal Auditor | DNV | CQI and IRCA certified | 16 hours | Course pagechecked 3 October 2026 |
| ISO 27001 Internal Auditor Training Course | Bywater | CQI and IRCA certified | 2 days | Course pagechecked 3 October 2026 |
| ISO/IEC 27001:2022 Internal Auditor Course — CQI|IRCA ref PT220 | Batalas | CQI and IRCA certified | 2 days | Course pagechecked 3 October 2026 |
| ISO 27001 Internal Auditor Training Course (2 days) | Amtivo (British Assessment Bureau) | Not stated | 2 days | Course pagechecked 3 October 2026 |
Certified by: CQI and IRCA certified (4) · Not stated (3). What the schemes mean.
3 How it is assessed
| Scheme | Typical length | Assessment |
|---|---|---|
| CQI and IRCA | Approx. 14 hours (two days); DNV lists 16 hours | Continuous assessment plus a short test — for example, Batalas describes a short multiple-choice test on the final day |
| Provider-branded courses | 1–2 days | Often continuous assessment; some issue a CPD certificate |
PECB does not run a separate internal auditor course — its auditor route is the five-day Lead Auditor course.
4 How to prepare
- Internal auditor: a 2-week study planTen short sessions to get ready for a two-day internal auditor course and your first internal audits.
- ISO/IEC 27001: structure and key clausesThe clauses to know before day one.
Practice questions
- ISO/IEC 27001:2022 information security 8 questions
- Harmonized Structure (clauses 4–10) 9 questions
- Audit findings and nonconformities 8 questions
- Certification schemes and auditor registration 9 questions
5 Other ISO/IEC 27001 qualifications
- ISO/IEC 27001 Foundation / requirements 6 courses
- ISO/IEC 27001 Lead auditor 8 courses
- ISO/IEC 27001 Implementer / lead implementer 7 courses
- ISO/IEC 27001 Auditor conversion 4 courses
- ISO/IEC 27001 Transition (new edition) 2 courses