Learn to audit by auditing.
Our classroom version of this course took 32 contact hours, and most of them were spent on theory. Now the theory comes in adaptive self-study at your own pace. The eight live hours are spent on the part that needs an instructor and a group: running an audit, interviewing an auditee and defending your findings.
Who it's for
IT, security, risk and compliance professionals who will run internal audits in organisations covered by NIS2, or who are preparing for an auditor role. Cohorts are formed by sector, for example finance, public sector or energy, so the cases match your world. Within a cohort, participants come from different roles and levels of experience and learn from each other.
After this course, participants can
- scope and plan an internal audit using the ISO 19011 principles
- map NIS2 / NKDL and MK Nr. 397 requirements to ISO 27001 controls
- collect and evaluate audit evidence, including interviews
- write clear, defensible audit findings and nonconformities
- present results to management and follow up corrective actions
How your path adapts
Your skill check and profile set the path. Experienced IT and compliance professionals typically skip the audit-principles and NIS2 essentials modules and spend their self-study time on evidence, sampling and writing findings.
Your role in the cohort
Throughout the course, participants rotate through three roles in a simulated organisation. Each role gets its own briefing pack and sees only the information that role would really have. The auditee knows things the auditors have to uncover.
Lead auditor
Owns the plan and scope, runs the opening and closing meetings, signs off findings.
Auditor
Collects and evaluates evidence, interviews, drafts findings.
Auditee
Holds the organisation's briefing — including what it would rather not show.
Four weeks at a glance
| Week | Self-study (adaptive) | Live session (2 h) | Cohort assignment |
|---|---|---|---|
| 1 | Audit principles, NIS2/NKDL and MK Nr. 397 essentials | Kick-off; the simulated organisation; audit scope | Draft the audit plan |
| 2 | ISO 27001 controls; evidence and sampling | Interview practice: auditor vs auditee role-play | Collect and evaluate evidence |
| 3 | Writing findings; grading nonconformities | Findings workshop: peer and instructor critique | Write the audit report |
| 4 | Reporting to management; follow-up | Closing meeting simulation; final debrief | Final mastery check |
Format & time commitment
8 live hours plus about 4–5 hours of self-study a week. The AI tutor answers questions between sessions from the course material and the standards, citing its sources. The instructor reviews every written assignment.
[Instructor name]
[Credentials and a short bio.]
Questions
Why only 8 live hours?
Internal Cybersecurity Auditor
Plan, run and report an internal audit against NIS2 and ISO 27001, practised in a full audit simulation with your cohort.