Information Security Audit & Permanent Control

Curriculum

1. 1

   Scope and objectives of information security audits in finance

   Lecture

   3h
2. 2

   Information security audit frameworks: ISO 27007, COBIT, IIA

   Comparative course

   3h
3. 3

   Mapping banking processes and information security control points

   Hands-on workshop

   4h
4. 4

   Interview and evidence-gathering techniques in information security audits

   Role play

   3h
5. 5

   Basic technical audit tools (vulnerability scanning, log review)

   Cyber Range lab

   4h
6. 6

   Writing audit reports and formulating recommendations

   Writing workshop

   4h

Skills acquired

• Plan and conduct a basic information security audit in a financial institution
• Use the ISO 27007, COBIT and IIA frameworks in the African context
• Collect technical and organisational audit evidence
• Write a clear, remediation-oriented information security audit report

Curriculum

1. 1

   Auditing an ISO 27001 ISMS: from document review to control testing

   Audit simulation

   6h
2. 2

   Auditing business continuity (ISO 22301, BIA, recovery and maintenance tests)

   ROOM#42 exercise

   5h
3. 3

   Permanent control: the three lines of defence and the CISO's role

   Lecture + case

   4h
4. 4

   Technical audit: review of firewall, Active Directory and SIEM configuration

   Cyber Range lab

   6h
5. 5

   BCEAO/BEAC compliance: auditing specific requirements (circulars, SMCA)

   Regulatory workshop

   4h
6. 6

   Monitoring the action plan and measuring remediation effectiveness

   Hands-on workshop

   4h
7. 7

   Presenting audit findings to management: communication techniques

   Committee simulation

   3h
8. 8

   Preparing and presenting the final report

   Coaching

   3h

Skills acquired

• Carry out a full ISMS audit of a financial institution according to ISO 27007
• Conduct technical control tests on security equipment
• Audit regulatory compliance with BCEAO/BEAC information security requirements
• Present audit results to the audit committee and executive management

Curriculum

1. 1

   Designing a multi-year information security audit plan for a banking group

   Strategy workshop

   5h
2. 2

   Auditing information security governance at board level

   Board simulation

   5h
3. 3

   Auditing relationships with critical providers (third parties, cloud, SWIFT)

   Practical case

   5h
4. 4

   Auditing digital transformation: open banking, mobile money, APIs

   Technical workshop

   5h
5. 5

   Advanced audit techniques in an information security crisis (ROOM#42)

   ROOM#42 simulation

   6h
6. 6

   Information security maturity indicators: CMMI, ISM3, prudential scoring

   Seminar

   5h
7. 7

   Publishing and promoting audit work: reports, strategic recommendations

   Writing workshop

   4h

Skills acquired

• Design and run an information security audit programme for a pan-African financial group
• Assess cyber governance at the highest level (board, executive committee)
• Audit critical providers and new technologies (APIs, cloud, open banking)
• Contribute to developing BCEAO/BEAC regulatory control policies

Curriculum

1. 1

   Teaching information security audit: cases, simulations, role play

   Seminar

   5h
2. 2

   Designing technical audit exercises (Cyber Range, ROOM#42)

   Hands-on workshop

   6h
3. 3

   Delivering and assessing AFP-ACP in real conditions

   Assessed demonstration

   10h

Skills acquired

• Train information security auditors from Foundation to Expert
• Design realistic audit simulations combining the Cyber Range and ROOM#42
• Keep the AFP-ACP framework up to date with changing standards