ISO/IEC 27001 Lead Auditor

Customers, partners and regulators want proof that an organization protects its information well, and an audit provides that proof. An auditor reviews the organization's records, interviews its staff and reports whether its security meets the agreed requirements.

ISO/IEC 27001 is the international standard for managing information security. It sets out how an organization finds the risks to its information and chooses safeguards, called controls, to reduce them. The organization then checks and improves its approach over time. This way of working is called an information security management system, or ISMS. When an auditor finds a requirement the organization has yet to meet, the auditor records it as a nonconformity.

The PECB ISO/IEC 27001 Lead Auditor training course enables you to plan, conduct and close audits of an information security management system against ISO/IEC 27001. You develop the skills to evaluate evidence, identify nonconformities and report findings, whether you perform audits or manage an audit program.

Course Summary

Delivery format: eLearning and self-study, both included
Language: English
Suggested study schedule (The Tech Academy): 14 days at 3 hours a day, about 42 hours in total. Plan more time if the subject is new to you or you want extra practice and revision. PECB plans this course as five days of study, including the exam.
Included: More than 450 pages of PECB course material, the exam and certification fees and an attestation of course completion worth 31 CPD credits
Credential: Passing the exam lets you apply for a PECB ISO/IEC 27001 Auditor credential. PECB awards the level that matches your experience, starting at Provisional Auditor for people new to the field. Certification Requirements, farther down this page, lists every level
Support: Exam support from The Tech Academy, including office hours every two weeks for 90 days from enrollment, comes with this course. Details are under How You Study & What Your Price Covers.

Training Mode: eLearning and Self-Study

This PECB course includes both training modes for one price, so you can use either or both. You find them in your myPECB account.

eLearning

Video lessons

Recorded video lessons from PECB Certified Trainers
Quizzes to check your progress, and extra reading
Watch on any device, wherever and whenever suits you
Best if you like a trainer to take you through the subject

Self-Study

Course material

PECB’s course material, more than 450 pages: explanations, examples, exercises and quizzes
No lessons: you read and work through it on your own
Study at your own pace, wherever you are
PECB suggests it for people who already know the subject well

Both lead to the same PECB exam and credential.

Why Should You Attend?

Organizations need skilled auditors to check their ISMS, both from inside the organization and from independent certification bodies. This course prepares you to plan and carry out internal and external ISMS audits following ISO 19011, the guidelines for auditing management systems, and ISO/IEC 17021-1, the requirements for certification bodies.

Practical exercises cover managing an audit program and an audit team, communicating with the audited organization and resolving conflicts. After the course, you can sit the exam and apply for the PECB Certified ISO/IEC 27001 Lead Auditor credential, or the level that matches your experience.

Who Should Attend?

Career changers moving into governance, risk and compliance (GRC) roles, such as GRC Analyst
Graduates who want to show proof of their skills at interviews with a PECB certificate
Auditors who perform or lead ISMS audits
Managers or consultants who want to master the ISMS audit process
People responsible for keeping an organization in conformity with ISMS requirements
Technical experts who prepare for ISMS audits
Expert advisors in information security management

New to ISO/IEC 27001? Start with the ISO/IEC 27001 Foundation course, then move on to this one.

Learning Objectives

By the end of this course, you will be able to:

Explain the concepts and principles of an ISMS based on ISO/IEC 27001
Interpret the requirements of ISO/IEC 27001 from an auditor's point of view
Evaluate an ISMS's conformity to ISO/IEC 27001 using audit concepts and principles
Plan, conduct and close an ISO/IEC 27001 audit following ISO/IEC 17021-1, ISO 19011 and other audit best practices
Manage an ISO/IEC 27001 audit program

Educational Approach

Theory combined with the best practices used in ISMS audits
Explanations illustrated with examples from a case study
Case study exercises
Practice tests similar to the certification exam

Prerequisites

A fundamental knowledge of ISO/IEC 27001 and a thorough knowledge of audit principles.

Course Agenda

The topics follow PECB's five-day plan for this course. At your own pace, you work through them in this order.

Day 1: Introduction to the information security management system and ISO/IEC 27001
Day 2: Audit principles, and preparing for and initiating an audit
Day 3: On-site audit activities
Day 4: Closing the audit
Day 5: Certification exam

Examination

Exam: PECB Certified ISO/IEC 27001 Lead Auditor exam
Length: 3 hours
Questions: 80 multiple-choice questions
Format: Open book: you can use the course material and your own notes
Pass mark: 70%
Languages: English, Arabic, Czech, French, German, Italian, Japanese, Korean, Mongolian, Polish, Portuguese (Brazil), Russian Kazakh, Spanish, Thai, Turkish, Ukrainian
Where: Online from anywhere, in the PECB Exams app, with a PECB invigilator watching through your camera

Taking the exam in a language that is not your first? Ask on the day, and PECB gives you 30 extra minutes.

What the Exam Covers

The PECB ISO/IEC 27001 Lead Auditor exam covers seven competency domains:

Domain 1: Fundamental principles and concepts of an information security management system
Domain 2: Information security management system
Domain 3: Fundamental audit concepts and principles
Domain 4: Preparing an ISO/IEC 27001 audit
Domain 5: Conducting an ISO/IEC 27001 audit
Domain 6: Closing an ISO/IEC 27001 audit
Domain 7: Managing an ISO/IEC 27001 audit program

Exam details from PECB's list of exams.

Certification Requirements

After you pass the exam, you apply for the credential that matches your experience. Every level requires a pass on the PECB ISO/IEC 27001 Lead Auditor exam, or an equivalent, and a signed PECB Code of Ethics.

Credential	Professional experience	Audit experience
PECB Certified ISO/IEC 27001 Provisional Auditor	None	None
PECB Certified ISO/IEC 27001 Auditor	2 years, including 1 year in information security management	200 hours of audit activities
PECB Certified ISO/IEC 27001 Lead Auditor	5 years, including 2 years in information security management	300 hours of audit activities
PECB Certified ISO/IEC 27001 Senior Lead Auditor	10 years, including 7 years in information security management	1,000 hours of audit activities

Audit activities can include planning an audit, conducting interviews and on-site audits, reviewing documentation, drafting audit reports, nonconformity reports and working documents, following up on nonconformities, managing an audit program and leading an audit team.

How You Study & What Your Price Covers

USD $797 · eLearning and self-study · English

Work through the PECB materials and exercises at your own pace, using the course agenda on this page to guide your study. Kudzai Consulting Group arranges your PECB enrollment after purchase.

Your price covers the PECB training materials, examination and grading, course-completion attestation, and the applicable certificate or certification fees. Earning a credential requires passing the exam and meeting PECB’s requirements.

Exam support included: Your course price includes a study plan, practice questions with explanations, a practice assessment, an exam-day checklist, and live office hours with Dr. Rose Shumba every two weeks for 90 days from enrollment.

Exam attempts: Under PECB’s rules for eLearning and self-study, your price covers your first exam attempt, one free retake if you need it, the certification application fee and the first year of PECB’s annual maintenance fee. Use them within 12 months of buying the course.

Take Your Next Career Step

Optional add-on: Get Hired in GRC · USD $197

Turn your learning and completed work into a tailored résumé, LinkedIn profile, interview answers and a portfolio link. Study eight short sections at your own pace, with videos, guides, templates, a workbook and AI review prompts. Six months of access.

Add it at checkout with any course or portfolio purchase. The $197 is separate from your program price.

Explore Get Hired in GRC

Questions About Enrolling

Does passing the exam make me certified?

Passing the exam lets you apply for a PECB credential, and PECB reviews your application. Foundation credentials are open to everyone who passes the exam and signs the PECB Code of Ethics. For Lead Implementer, Lead Auditor and Lead Manager courses, PECB awards the level that matches your experience. If you are new to the field, you start at the Provisional level and can apply to upgrade as you gain experience. Each course page lists the requirements for every level.

Can I add a portfolio program?

Yes, with ISO/IEC 27001 Foundation, ISO/IEC 27001 Lead Implementer and ISO/IEC 42001 Lead Implementer. Each portfolio program is a separate Tech Academy program with its own price and enrollment.

Explore the portfolio programs and find the one for your course

Do I need a portfolio program to get exam support?

Exam support, including office hours every two weeks for 90 days from enrollment, comes with every PECB course, including this one. Portfolio programs are an optional extra, sold separately.

Can I join a portfolio program if I trained with another provider?

Yes. Each portfolio program is sold on its own, for anyone who is taking or has completed the matching training.