Security awareness and training audit program.
How to audit whether employees, managers and IT staff are made aware and trained regularly and in line with their tasks and whether this has a measurable effect.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation has a concept for information security awareness and training that reaches all target groups, including management, IT staff and service providers. It also assesses whether participation is tracked, effectiveness is measured and reporting of anomalies is encouraged.
Scope
- Information security awareness and training offerings for all staff
- Management training and specialist training for IT staff and administrators
- Phishing simulations, learning platform and participation tracking
- Out of scope: general professional training without a security focus
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A concept governs objectives, target groups, content, formats and frequency of awareness and training. | BSI ORP.3; ISO/IEC 27001:2022 Annex A 6.3 | Read the concept, check approval and currency and compare it with the training plan for the current year. | Awareness and training concept, annual plan |
| 2 | Content is tailored to the roles and risks of the target groups. | DORA Art. 13(6); BSI ORP.3 | For three target groups, compare content with the typical risks of their work. | Training material per target group |
| 3 | New staff are briefed before or as soon as they gain access to information; everyone takes part regularly. | ISO/IEC 27001:2022 Annex A 6.3; ISO/IEC 27001:2022 clause 7.3 | For ten joiners, compare the briefing date with the account creation date. | Joiner list, attendance records, account creation dates |
| 4 | Members of management attend training on cyber risks regularly. | NIS2 Directive Art. 20(2); § 38(3) BSIG | Check management attendance records for the last two years and the training content. | Attendance records, management training material |
| 5 | Basic cyber hygiene rules are taught and easy to find. | NIS2 Directive Art. 21(2)(g); § 30(2) no. 7 BSIG | Have the rules located on the intranet and ask five employees about key rules. | Rules of conduct, interview notes |
| 6 | IT staff and administrators receive specialist training that ensures their competence for security tasks. | ISO/IEC 27001:2022 clause 7.2 | Compare competence requirements for two IT roles with training records. | Competence profiles, training records, certificates |
| 7 | Phishing simulations are run regularly, evaluated and linked to learning offers. | ISO/IEC 27001:2022 Annex A 6.3; BSI ORP.3 | Review results of the latest simulations: click rate, report rate and follow-up actions. | Simulation analyses, follow-up training |
| 8 | Participation is tracked; outstanding mandatory training is reminded and escalated. | ISO/IEC 27001:2022 Annex A 6.3 | Retrieve participation rates per department and trace the handling of those who are overdue. | Participation report, reminders, escalations |
| 9 | The effectiveness of the measures is measured and fed back into planning. | ISO/IEC 27001:2022 clause 9.1 | Review effectiveness metrics and check whether results led to changes in the program. | Metrics report, changes to the training plan |
| 10 | Staff know the reporting path for security events and use it. | ISO/IEC 27001:2022 Annex A 6.8 | Analyse the number of reports over time and ask five employees about the reporting path. | Reporting statistics, interview notes |
| 11 | Service providers with access to systems or information are included in awareness activities. | DORA Art. 13(6) | Check contracts and attendance records for two providers with access. | Contract clauses, provider attendance records |
| 12 | Data protection training is coordinated with the data protection officer. | Art. 39(1)(b) GDPR | Ask about coordination of content and responsibilities between information security and data protection. | Data protection training plan, coordination record |
| 13 | Budget and owners are defined for awareness and training. | DORA Art. 5(2)(g) | Review the program budget and resources and compare them with the scope of the annual plan. | Budget plan, role description |
Documents to request
- Awareness and training concept
- Annual training plan
- Training material per target group
- Participation reports per department
- Management attendance records
- Phishing simulation analyses
- Effectiveness metrics
- Reporting statistics for security events
Typical findings
- Training is the same for everyone and ignores roles.
- New staff gain access weeks before their first training.
- Management is exempt from mandatory training.
- Participation rates are low, overdue staff are not followed up.
- Phishing simulations are run but not evaluated.
- Service providers with administrator access are not included.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing