Business Continuity Auditor acc. to ISO 22301

Internal audits as a powerful tool for system improvement

Overview

This course covers the theory behind conducting internal and external audits, based on the audit process set out in ISO/IEC 19011.

This includes

• relevant terms and definitions, as well as
• the process steps from the Plan–Do–Check–Act cycle.
• Using examples, we move from theory to practice.

Course objective

Participants will be able to plan and conduct audits, document the results, and evaluate and improve the audit process. Furthermore, participants will be familiar with the individual steps of the audit process and will be able to adapt them to their organisation. Participants will be familiar with the relevant documented information – such as the audit programme, audit plan, checklist and audit report – and will be able to draw these up. Audits can be carried out, and the necessary information can be gathered, assessed and reported to the clients using appropriate communication techniques.

Dauration: 1 day

Between Auditor and Developer. Systemic Thinking, Effective Communication

Overview

Auditors face a dual challenge during an audit: on the one hand, they must act as expert auditors; on the other, as forward-thinking development agents.  Auditors liaise with both senior management and operational management. In addition to specialist knowledge, auditors require strong interpersonal skills, the ability to think holistically and recognise cross-departmental system interdependencies, as well as a firm grasp of the basic principles of communication. Theory and practice complement each other in a balanced way in this seminar: the second day of the course is primarily devoted to training through role-play exercises.

Course objective

Participants practise thinking in terms of systemic relationships, gain an understanding of the skills required of an auditor, and master the basic principles of communication in theory and practice.

Duration: 2 days

Building on the knowledge of ISO 22301 acquired in the BCM Manager course and the content covered in the Audit Techniques and Psychological Foundations courses, this module specifically addresses the requirements for conducting audits of ISO 22301 management systems.

The examination content relates to the following courses:

• Audit Techniques
• Psychological Principles
• ISO 22301 Standard

Admission to the examination

Registration for this examination must be made in writing to CIS GmbH, and the candidate must demonstrate that they meet the admission requirements. Should the candidate have completed the training as part of the CIS course series , the training will be automatically recognised, provided that they have attended at least 80 per cent of each course module.

Should a candidate wish to have other training courses recognised, it is necessary to have the equivalence of these courses to the certification programme assessed. A separate, written application must be submitted to establish this equivalence. The application must be accompanied by a description of the training courses completed and a comparison of these with the requirements of the certification programme. The relevant requirements can be obtained from the certification body. A qualification check is carried out to verify compliance with the certification programme and to ensure that the references provided by the applicant are up to date. This consists of an oral technical interview lasting between 30 and 60 minutes and is conducted by an assessor. The defined training content as set out in the certification programme serves as the basis.

Further examination requirements

• Valid CIS ‘Business Continuity Manager’ certificate
• Completion of the CIS Business Continuity Auditor training course or equivalent training
• Proof of at least 2 years’ professional experience in the field of information security management or business continuity within the last 3 years
• Four audits conducted or supervised, totalling at least 15 audit days in the field of business continuity or information security management (including preparatory and follow-up work, within the last 3 years)

Taking the examination

The examination is a written test. It consists of multiple-choice questions and lasts 1 hour.

Certificate

Upon passing the examination, the certificate “Business Continuity Auditor in accordance with ISO 22301” will be issued; if the candidate lacks professional experience and/or audit experience, the certificate will bear the designation “Candidate”.

Auditor Candidate: It is still possible to sit the examination even without sufficient professional experience and proof of auditing experience. In this case, you will be granted the status of Auditor Candidate; as soon as you have gained the necessary practical experience, we will amend your certificate free of charge – a simple, unbureaucratic process that reflects our commitment to quality. Please note: Candidate status cannot be extended.

Validity period of the certificate

3 years

Certificate renewal criteria

• Proof of 2 years’ professional experience in information security management or business continuity within the last 3 years
• Proof of having conducted 4 audits totalling at least 15 audit days in information security management or business continuity
• One CIS refresher course within the last 3 years.