ISO 28000 Supply Chain Security Management Internal Auditor

Module 1: Introduction to ISO 28000

• ISO 28000 overview
• Purpose and scope
• Supply chain security
• Security management concepts
• Management system approach
• Key terminology

Module 2: Supply Chain Security Management System

• Management system structure
• Supply chain environment
• Security management principles
• Organisational responsibilities
• System boundaries
• Security management lifecycle

Module 3: Organisational Context

• Internal context
• External context
• Interested parties
• Security requirements
• Supply chain dependencies
• Management system scope

Module 4: Leadership & Security Governance

• Leadership commitment
• Security policy
• Roles and responsibilities
• Accountability
• Security objectives
• Security culture

Module 5: Supply Chain Security Risk Management

• Security risk concepts
• Threat identification
• Vulnerability identification
• Risk analysis
• Risk evaluation
• Risk treatment

Module 6: Physical & Facility Security Controls

• Perimeter protection
• Facility access
• Restricted areas
• Visitor management
• Physical monitoring
• Facility protection

Module 7: Personnel & Access Security

• Personnel security
• Identity verification
• Access permissions
• Privileged access
• Security awareness
• Insider threats

Module 8: Cargo & Inventory Security

• Cargo protection
• Inventory controls
• Loading and unloading
• Storage security
• Cargo integrity
• Handling controls

Module 9: Transportation & Logistics Security

• Transportation risks
• Vehicle security
• Shipment monitoring
• Route considerations
• Delivery controls
• Logistics security

Module 10: Supplier & Third-Party Security

• Supplier security
• Security requirements
• Supplier evaluation
• Contractor controls
• Third-party risks
• Partner monitoring

Module 11: Information & Documentation Security

• Supply chain information
• Information access
• Document protection
• Data integrity
• Communication security
• Security records

Module 12: Incident & Emergency Management

• Security incidents
• Incident identification
• Reporting and escalation
• Emergency preparedness
• Response activities
• Recovery considerations

Module 13: Internal Audit Principles

• Purpose of internal audits
• Integrity
• Objectivity
• Independence
• Professional conduct
• Evidence-based auditing

Module 14: Internal Audit Programme

• Audit programme objectives
• Audit priorities
• Audit frequency
• Audit resources
• Auditor responsibilities
• Programme monitoring

Module 15: Audit Objectives, Scope & Criteria

• Audit objectives
• Defining scope
• Audit criteria
• Organisational boundaries
• Security processes
• Audit feasibility

Module 16: Audit Planning & Preparation

• Audit planning
• Audit schedules
• Process selection
• Reviewing documentation
• Identifying audit trails
• Preparing audit activities

Module 17: Developing Audit Checklists

• Checklist structure
• Security requirement questions
• Risk management questions
• Operational control questions
• Supplier security questions
• Incident management questions

Module 18: Conducting Internal Audit Activities

• Opening meetings
• Personnel interviews
• Process observations
• Document reviews
• Record reviews
• Following audit trails

Module 19: Gathering & Evaluating Audit Evidence

• Objective evidence
• Evidence sources
• Audit sampling
• Evidence reliability
• Evidence sufficiency
• Evaluating control effectiveness

Module 20: Audit Findings & Nonconformities

• Evaluating conformity
• Identifying gaps
• Nonconformities
• Supporting evidence
• Writing findings
• Improvement opportunities

Module 21: Audit Reporting & Closing Meeting

• Audit conclusions
• Audit report structure
• Findings summary
• Closing meetings
• Communicating results
• Management feedback

Module 22: Corrective Actions & Audit Follow-Up

• Immediate corrections
• Root cause concepts
• Corrective-action planning
• Reviewing responses
• Effectiveness verification
• Continual improvement