Learn It.
Bring your basic understanding of GRC, from coursework, training from any provider, or independent study. If ISO/IEC 27001 or auditing is new to you, allow additional time to learn the concepts as you work.
27001 Lead Auditor Portfolio
Lead a simulated ISO/IEC 27001 certification audit, and build an audit file you can show hiring managers and clients.
For recent graduates, career changers, and professionals who want to audit organizations' information security management systems (ISMS), including aspiring internal auditors, GRC analysts and advisers. You need a basic understanding of governance, risk management, and compliance (GRC); previous work experience and certifications are optional.
This is a capstone project. You take the role of lead auditor in a simulated certification audit of a fictional company, from planning to follow-up, with written feedback from Dr. Rose Shumba on each phase.
Learn it. Build and defend it. Use it professionally.
USD $397
Enroll in the Portfolio
27001 Lead Auditor PortfolioPut your GRC knowledge into practice through a simulated audit.
You may have studied GRC or auditing through coursework, training, or independent study, or you may be working through an audit course now. Now you want to see how audit criteria, evidence, sampling and nonconformities come together in a full audit.
How do I show that I can plan an audit, test the evidence and report what I found?
What would you show when someone asks how you audit?
An interviewer asks you to describe a nonconformity you raised: what the requirement was, what the evidence showed, and why you graded it major or minor.
A potential client asks how you would plan their certification audit. Which areas would you examine first, and what evidence would you ask to see?
An audit you've worked through yourself gives you something concrete to discuss: the evidence you examined, the findings you reached, and the reasons behind them.
Build the work. Practice explaining your findings.
Training builds your knowledge. Applying it to a realistic audit builds your practice in testing evidence and defending findings.
Why did you sample those records? Does this evidence show the control works? Is this finding major or minor?
In this capstone, you answer questions like these as you audit. You document your reasoning, receive feedback, and practice explaining your work.
Lead TechFlow's certification audit, from planning to follow-up.
TechFlow Solutions, a fictional company, has prepared for its ISO/IEC 27001 certification audit, and you are the appointed lead auditor.
You work through nine guided steps in four phases:
- 1
Plan the audit. Set up the audit, then carry out Stage 1: assess whether TechFlow is ready for Stage 2, from its documents, its risk assessment and its internal audit and management review results.
- 2
Prepare Stage 2. Plan the Stage 2 audit and write the audit questions for selected clauses and Annex A controls.
- 3
Audit and report. Conduct the simulated Stage 2 audit from TechFlow's records, interview notes and observations. Log the evidence, write nonconformity reports and the audit report, and record a closing meeting presentation for TechFlow's leaders.
- 4
Follow up. Evaluate TechFlow's corrective action plans, then examine the evidence that it carried them out and that they worked.
Two optional steps follow: an internal audit program and a surveillance audit plan.
In each phase, you submit your written work with a short video answering one interview or client question about it.
You finish by selecting your best three pieces, which can include your closing meeting presentation, and sharing them through one portfolio link. Each piece is clearly labeled as simulated work, ready for interviews and client conversations.
Learn it. Build and defend it. Use it professionally.
Build and Defend It.
Lead TechFlow's audit. Complete each guided task, write the reasons for your findings, and submit each phase for written feedback from Dr. Rose Shumba.
Use It Professionally.
Record a short answer for each phase, and practice discussing your audit in interviews, at work and in advisory conversations. Share your strongest three pieces through one portfolio link.
Is this portfolio for you?
This program is for:
- People who want to audit an ISMS, as internal auditors or certification auditors.
- Aspiring GRC analysts and advisers who want practice testing evidence and reporting findings.
- Recent graduates, career changers, and people taking or completing ISO/IEC 27001 Lead Auditor training through any provider.
- Implementers who want to see their work from the auditor's side.
Previous work experience, certifications and PECB training are optional. You need a basic understanding of governance, risk management, and compliance (GRC), and a willingness to read evidence closely, make judgments and revise your work. Audit experience and knowledge of ISO/IEC 27001 help; if they are new to you, allow additional study time, because the requirements of ISO/IEC 27001 are the audit criteria.
Guided tasks, audit files, and feedback on every phase.
Your portfolio materials
- TechFlow's audit files: its ISMS documents, records, interview notes and observations.
- Nine guided audit steps, plus two optional steps, in one report template.
- Audit working papers, worked examples and a sample interview answer.
- A showcase format for sharing your best three pieces through one link.
Your mentor support
- One written review from Dr. Rose Shumba for each of the four phases, returned within three working days. Each optional step is reviewed as its own phase, for up to six reviews in all.
- Live group office hours every two weeks, where you can ask questions and discuss your work.
Your 90 days of mentor support begin when you enroll. You keep access to the program materials for 6 months.
Get feedback from Dr. Rose Shumba.
Dr. Rose Shumba brings more than twenty years of cybersecurity education experience. She is a PECB Certified ISO/IEC 27001 Senior Lead Implementer and a PECB Certified ISO/IEC 42001 Lead Implementer, and a former director of a National Security Agency and Department of Homeland Security Center of Academic Excellence in Cyber Defense.
She writes the feedback on your audit phases and leads the group office hours, helping you examine your findings and explain your work more clearly.
Frequently asked questions
Who can join?
This program is for recent graduates, career changers, and professionals who have a basic understanding of governance, risk management, and compliance (GRC) and want practical work samples they can show and explain.
You do not need previous work experience or a particular certification. You should have a basic understanding of governance, risk management, and compliance (GRC) through coursework, training, or independent study. If ISO/IEC 27001 is new to you, allow additional time to learn the relevant concepts as you complete your project.
I'm new to ISO/IEC 27001. Can I still take part?
Yes, if you have a basic understanding of governance, risk management, and compliance (GRC). You'll work through a fictional company case using guided tasks, templates, and feedback. Allow additional time to learn the ISO/IEC 27001 concepts as you complete the project.
This is a practical portfolio program. It does not include a full certification training course.
Do I need PECB training to join?
You can join without PECB training. You need a basic understanding of governance, risk management, and compliance (GRC), from coursework, training from any provider, or independent study. The project follows ISO/IEC 27001, so plan to use ISO/IEC 27001 learning resources as you complete the tasks.
Does this program include teaching lessons?
This program is a self-paced audit capstone, focused on applying what you know about GRC and auditing. It provides the audit files, guided tasks, templates and feedback. You use your own learning resources and the standard to support your work.
How long does it take?
Allow about 9 to 11 hours for the nine steps, including your recorded closing meeting presentation. Your short phase videos and revisions take extra time. The two optional steps take about one and a half hours together.
What will I build?
An audit initiation record, a Stage 1 audit report, a Stage 2 audit plan, two audit test plans, an audit evidence log, nonconformity reports, an audit report, a closing meeting presentation, and a corrective action evaluation and verification.
Do I need to complete the Lead Implementer Portfolio first?
You can start here. The audit files match the documents learners draft in the 27001 Lead Implementer Portfolio, so the two programs work well together.
Is this real client work?
TechFlow Solutions is fictional, and the audit is simulated practice. When you share your portfolio, identify it as a simulation and explain what you personally completed.
How does the feedback work?
During your 90 days, you submit each phase's written work and video together for one written review from Dr. Rose Shumba, returned within three working days. Reviewing each phase before you start the next lets you correct an early stage of the audit before later steps build on it. You use the feedback to revise your work on your own.
Does this include PECB training or certification?
This is a Tech Academy portfolio program. PECB training, examinations, certification applications and credentials are separate. The Tech Academy also offers PECB certification training for learners who want that pathway.
Does the portfolio guarantee a job or clients?
It gives you simulated work samples and practice explaining your approach. Employment and client outcomes depend on factors beyond this program.
What is the refund policy?
All our programs are digital. Once access to the program has been provided, the purchase is non-refundable. Please review the program description and what is included before enrolling.
Build work you can show and explain.
Lead a simulated ISO/IEC 27001 certification audit, receive written feedback from Dr. Rose Shumba, and practice explaining the findings behind your work.
USD $397
Enroll in the PortfolioThis is a simulated portfolio project. Certification training and examinations are purchased separately.
