ISO/IEC 27002:2022 - Internal Auditor

FSMQC offers ISO/IEC 27002:2022 - Internal Auditor as a separate internal auditor course. Participants study the subject modules below and apply them through the selected training track. Completion of one track does not automatically award the other tracks.
​
Catalogue code: I08-IA. Contact FSMQC to confirm the course dates, entry requirements, delivery language and applicable assessment route.

Review selected adopted controls against documented internal criteria. Sample access and backup evidence, interview owners and report gaps without inventing a standalone certification requirement.

IT, security, operational risk and assurance personnel. FSMQC confirms course readiness, language and learner support needs before enrolment.

Module 1. Purpose and control selection
Explain the relationship between security risk and suitable controls. Distinguish control guidance from the requirements of an information security management system.
​
Module 2. Organisational and people controls
Examine responsibilities, information classification, supplier interfaces, awareness and personnel security. Explain how clear ownership and behaviour support consistent control operation.
​
Module 3. Physical and technological controls
Review access, equipment and environment protection alongside identity, configuration, logging, backup and technical safeguards. Select controls suited to the scenario and risk.
​
Module 4. Implementation and effectiveness
Define expected evidence, responsible owners and review methods. Explain why having a policy or tool is different from demonstrating that a control works and remains appropriate.

FSMQC uses instructor-led explanation, guided discussion and course-specific applied practice.
​
A fictional service operation with obsolete access permissions and an untested recovery record. Use an FSMQC authored, fictional case with sufficient facts and records for independent learner work.
​
Learning resources: Control selection worksheet, access list, simulated logs and implementation plan. Provide a learner explanation, agenda, authorised reference access, exercise instructions and feedback.
​
Assessment: A knowledge check and individual practical audit outputs assess planning, evidence gathering, findings, reporting and follow-up. FSMQC course completion does not confer ISO certification, registered auditor status or accreditation. The licensed reference and applicable amendments control delivery. This is the current catalogue family replacing the legacy ISO/IEC 17799 label. It is controls guidance, not a standalone management system certification standard.

Training centre opening hours: Monday-Friday, 08:00-17:00. International venue times are local and confirmed before booking.
​
Daily sessions are arranged within the opening hours, with up to 7.5 learning hours and 1.5 hours of breaks on a full day. Shorter courses and final days finish once the required learning and assessment hours are complete.
​
Catalogue duration reference: 16 scheduled hours / 2 days. Required contact/learning hours are retained; scheduled days may be adjusted. Total qualification time and independent study are not automatically classroom hours.
​
2026 proposed cohort 1: 26 Mar 2026, 27 Mar 2026, 01 Apr 2026. Venue: Sydney, Australia (venue to confirm).
​
Dates before 23 October 2026 are historical planning entries, not confirmation of completed delivery. Contact FSMQC for current availability and written confirmation before making travel arrangements.
​
Other eligible locations may be requested in UAE, UK, Australia or Egypt, subject to course-specific delivery approval and venue availability.

Contact FSMQC for current course fees and a written quotation. The quotation confirms dates, delivery language, learning materials, assessment arrangements and applicable charges before enrolment.