Download the certification brochure (Spanish): Click here

Exam Details

• Exam Name: ISO/IEC 27001:2022 Internal Auditor Certified (27001-IAE)
• Exam Format: Multiple choice, online with remote supervision (proctoring)
• Exam Delivery: Safe Exam Browser
• Number of Questions: 50 questions: 70% scenarios / 30% conceptual
• Exam Duration: 90 minutes
• Passing Score: 70% (35 out of 50 correct answers)
• Available Languages: Spanish / English
• Attempts: Maximum 2 attempts (minimum 15 days between attempts)
• Validity: 3 years · 15 CPD credits per year

Main Subjects

• Audit fundamentals and information security management principles (10%): ISO 19011:2018 auditing principles; First-, second- and third-party audits; Criterion, evidence, finding, nonconformity and observation; PDCA cycle and ISMS components; Annex A:2022 and Amendment 1:2024 on climate action.
• ISMS audit planning and preparation (20%): Risk-based annual audit program; Scope, criteria and objectives; Audit team: independence and competence; Document review: policy, SoA, risks and climate determination; Checklists and audit plan.
• Conducting the audit: clauses 4 to 10 (30%): Context and climate determination (4.1 and 4.2, Amd 1:2024); Leadership (clause 5); Planning and support (clauses 6 and 7); Operation and performance evaluation (clauses 8 and 9); Improvement (clause 10); Interviews, sampling, document tracing and remote auditing.
• Evaluating the Annex A:2022 controls (20%): Organizational controls (5.1 to 5.37); People controls (6.1 to 6.8); Physical controls (7.1 to 7.14); Technological controls (8.1 to 8.34); Control effectiveness with ISO/IEC 27002:2022; Auditing the Statement of Applicability; Controls 7.5, 8.13 and 8.14 against climate threats.
• Audit communication, reporting and follow-up (10%): Writing and classifying findings; Final audit report; Closing meeting with management; Follow-up and effectiveness of corrective actions.
• Integrated auditing and regulatory context (10%): Integration with ISO 9001, ISO 22301 and ISO/IEC 27701; Climate action common to several systems; GDPR and the NIS2 Directive; NIST CSF, COBIT, CIS Controls and PCI DSS; Continuous auditing and CAAT tools.

Who is this certification for?

• Management system internal auditors: Who want to extend their competence to information security.
• Information security and cybersecurity professionals: Who need to verify the effectiveness of their ISMS with an independent view.
• Certified ISO/IEC 27001 implementers: Who want to take the next step on the path toward auditing.
• Compliance, risk and quality leads: Who integrate information security auditing into their internal audit program.

Prerequisites

Mandatory: ISO/IEC 27001:2022 Implementer Certified (27001-IC). The internal auditor needs to master the requirements they will audit. Next level: ISO/IEC 27001:2022 Lead Auditor Certified Expert (27001-LAE).