ISO 27701 Internal Auditor Training

The ISO 27701 Internal Auditor course offers essential training in how to assess and improve Privacy Information Management Systems (PIMS) within your organisation. Built on the ISO 27701 standard, this Course is ideal for professionals involved in privacy, data protection, or internal compliance. You’ll learn how to prepare, conduct, and report internal audits that align with ISO 27001 and extend to privacy-specific controls under ISO 27701.

Key Topics Covered

• Introduction to ISO 27701: Scope, structure, and purpose of the privacy extension to ISO 27001.

• Role of an Internal Auditor: Key responsibilities, audit planning, and stakeholder engagement.

• Privacy Management Controls: Understanding PIMS-specific controls and their organisational impact.

• Audit Techniques: Preparing checklists, conducting interviews, collecting evidence.

Course Benefits

• Strengthen Internal Oversight: Improve your organisation’s ability to monitor and maintain privacy compliance.

• Enhance Audit Skills: Build a solid foundation in planning, executing, and reporting internal audits.

• Support Regulatory Readiness: Help your organisation prepare for external audits and data privacy reviews.

• Add Professional Value: Gain recognised skills that support roles in governance, privacy, and compliance.

This Course is suitable for professionals responsible for internal audits or privacy governance, including:

• Internal Auditors

• Privacy Officers

• Compliance Coordinators

• Information Security Staff

• Data Governance Professionals

• IT Risk Managers

Module 1: Introduction to ISO 27701

• Introduction

• Scope

• Normative References

• Terms, Definitions, and Abbreviations

Module 2: General

• Structure of this Document

• Application of ISO/IEC 27001:2013 Requirements

• Application of ISO/IEC 27002:2013 Guidelines

• Customer

Module 3: Information Management

• What is Information Management?

• Importance of Information Management

• Areas of Information Management

• Challenges Involved in Information Management

• Managerial Function

Module 4: PIMS-Specific Requirements Related to ISO/IEC 27001

• General

• Context of the Organisation

• Leadership

• Planning

• Support

• Operation

• Performance Evaluation

• Improvement

Module 5: PIMS-Specific Guidance Related to ISO/IEC 27002

• General

• Information Security Policies

• Organisation of Information Security

• Human Resource Security

• Asset Management

• Access Control

• Cryptography

• Physical and Environmental Security

• Operations Security

• Communications Security

• Systems Acquisition, Development, and Maintenance

• Supplier Relationships

• Information Security Incident Management

• Information Security Aspects of Business Continuity Management

• Compliance

Module 6: Personally Identifiable Information (PII)

• What is Personally Identifiable Information (PII)?

• Compliance Environment

• PII Security Controls

• Sensitive Vs Non-Sensitive PII

• Safeguarding PII

• PII Vs Personal Data

Module 7: Introduction to Internal Auditing

• What is Internal Audit?

• Who is Internal Auditor?

• Types of Internal Audit

• Internal Audit Functions

• Internal Vs External Audit

Module 8: Information System Audit

• Need for Information System Audit

• Information System Auditing Standards

• Auditing Guidelines

Module 9: Audit Preparation and Planning

• Audit Scope and Charter

• Audit Planning

• Risk-Based Approach

• Audit Staffing

• Audit Schedule

• Communication of Audit Plan

• Computer Assisted Auditing Techniques

Module 10: Information Security Risk Assessment

• Introduction to Risk Management

• Why Perform an Information Security Risk Assessment?

• Principles of Risk Assessment

• Risk Assessment Process

• Quantitative Vs Qualitative Security Risk Assessment Methods

Module 11: Additional Guidance for PII Controllers and Processors

• General

• Conditions for Collection and Processing

• Obligations to PII Principals

• Privacy by Design and Privacy by Default

• PII Sharing, Transfer, and Disclosure

By the end of the course, you will be able to:

• Understand ISO 27701 requirements and its integration with ISO 27001

• Conduct internal audits of PIMS using structured techniques

• Evaluate privacy controls and identify improvement areas

• Support your organisation in achieving and maintaining compliance

• Provide meaningful internal audit reports that aid decision-making

To achieve the ISO 27701 Internal Auditor Training, candidates will need to sit for an examination. The exam format is as follows:  

• Question Type: Multiple Choice   

• Total Questions: 30  

• Total Marks: 30 Marks  

• Pass Mark: 50%, or 15/30 Marks  

• Duration: 40 Minutes