You passed the exam. I teach you real-world skills.

CISSP since 2005, CISA since 2012. 45 years experience. 8 years teaching.

I teach real-world skills not found in Body of Knowledge. Practical, experience-based training and advice.

Certification courses teach you what auditors should know. They don't teach you how to plan an audit, write findings management actually accepts, or get remediation to happen. That's the gap I've spent 45 years learning to close — as a security consultant, an internal auditor at HP Canada, NAV Canada, and Shared Services Canada, and for the last eight years, as an instructor. Everything on this site comes from work I've actually done, not from a textbook.

Start here:

See my free courses → YouTube Channel @pisecaudit for short videos that help Auditors. You can see my teaching style and what I have to offer, before you sign up for in a paid course.

Download my free PDF on Fact Sheets.

Book a free 15-minute call via calendly. I will schedule your next course.

Book a 15-minute meeting

Paid courses vary in price; see the cost on the page about the course. If you pay for the course yourself, the prices are as marked. For example, you can pay $150 USD for a 90-minute course, or your employer will be invoiced $200 USD.
CPE hours: You can claim self-reported hours after completing the course.

I also offer on-site training... your location, your topic, your attendees, your date and time.

Testimonials

Read the reviews from students in courses that I have delivered.

Frequently Asked Questions (FAQ)

1. Where are the courses?
👉 I offer on-site training at your workplace or in a venue close to you. You choose which topics should be included. Your choice of attendees. Your choice of day and time.
👉 I have pre-recorded videos (MP4) and supporting materials (PD4) in the courses available on my web site. You book the call. After you pay, I give you the username and password, and the URL. When you browse to the URL, you are asked for the username and password that I gave you.
Caution: The password is reset after 4 days. If you need more time, send me an email to "renew my password".

2. How much do I pay?
👉 I charge a minimum of $250 CAD for on-site training (4 students, 1 hour). If you have more attendees, or a longer duration, I charge $60 CAD per student per hour. If you are outside 45km from Kemptville, I may add travel costs. See on-site training for more details.
👉 Prices vary according to the course. Check out the courses for different offers.
If you pay out of your own pocket, prices are as marked. If your employer pays, then prices are slightly higher, so that I can send an invoice to your employer.

3. When are you availabile?
My time is normally scheduled between 7am and 8pm Eastern Time (Winter UTC-5 | Summer UTC-4). My on-site training is usually scheduled in this period, Monday to Saturday, travel permitting, except bank holidays. On-line courses are available 24 hours a day, 7 days a week, including holidays.
I reply to emails within one business day.

4. I already passed the CISA, CIA, or CISSP. Why do I need more training?
Certification exams confirm that you understand the Body of Knowledge. They do not give you practice scoping a real engagement, working with imperfect evidence, writing defensible findings, or presenting results to management. Practical training focuses on those skills.

5. Is this training suitable if I am still building the work experience my certification requires?
Yes. Certification bodies expect candidates to have verified professional experience. Practical training does not replace that work experience, but it helps you get more out of your early engagements and perform with more confidence while you build it.

6. I am a CISSP, not an auditor. Is this relevant to me?
Yes. Many CISSP holders move into audit, assurance, or GRC roles, or regularly work with auditors. Understanding how audits are planned, tested, and reported helps you conduct audits yourself and makes you far more effective when your own controls are being audited.

7. How is this different from a CISA or CIA exam preparation course?
Exam preparation courses teach you to answer examination questions. This training assumes you already know the material and focuses on applying it: making audit decisions, testing controls, evaluating evidence, and communicating findings in real organizations.

8. What is Cybersecurity Audit Training?
Cybersecurity Audit Training teaches professionals how to plan, conduct, document, and report cybersecurity audits. It typically covers audit scoping, risk assessment, security control evaluation, evidence gathering, testing, findings, and audit reporting.

9. Is Cyber Security Audit Training suitable for IT auditors?
Yes. Cyber Security Audit Training can help IT auditors strengthen their ability to evaluate cybersecurity controls, understand security risks, assess evidence, and communicate audit findings. It can also benefit cybersecurity, GRC, compliance, and risk professionals.

10. What is the difference between IT Audit Training and cybersecurity audit training?
IT Audit Training can cover broader information technology controls, systems, applications, infrastructure, and IT governance. Cybersecurity audit training focuses more specifically on security risks and controls, including access management, vulnerability management, incident response, network security, data protection, cloud security, and related cybersecurity processes. There is significant overlap between the two disciplines.

11. What about HST?
HST is included in the marked price. For Canadian customers, the HST will be shown as a separate line item on your receipt. (For instance, customers in Ontario pay 13% HST; this is deducted from the price of the service on your receipt.) For non-Canadian customers, the marked price does not change.

You can contact me if you have suggestions or questions or want to book an appointment with me.

Courses and Books

Courses: Audit Findings That Land and the rest of the course catalogue — instructor-led, online, built on real audit experience.

Book: Audit Reports Reference Guide — the course content and reference material in one place, on Kindle.

You can contact me if you have suggestions or questions or want to book an appointment with me.

Still unsure if this training is for you?
Check out this detailed description.

Why trust me?

My approach is grounded in decades of hands-on experience, beginning with early personal computing and evolving with modern enterprise environments. From implementing practical access controls in shared systems to advising on governance and risk, my focus has remained consistent: understand systems at a fundamental level, and apply that understanding to solve real-world problems — the kind the Body of Knowledge (BOK) doesn't cover.

I have been teaching certification courses, including CISA, CISM, CISSP and related subjects. The course material is taken from the BOK sources for these credentials, plus my own experiences (24 years as a security consultant, 10 years as Internal Auditor, 5 years as systems administrator & programmer, 6 years as instructor) — but the BOKs stop short of showing how to actually put the credentials into practice. A newly certified professional can pass the exam and still have no idea how to write an audit report that survives management scrutiny. A new manager can receive that report and have no idea what to do with it. That gap is what my work fills.