The CQI and IRCA ISO 27001 Lead Auditor examination is a 40-question, 80-mark, open-book paper sat online and remotely proctored. It runs across five domains and lasts 1 hour 45 minutes. To pass you need 40 marks overall and the minimum mark in every domain.

This is the examination attached to PR373, the CQI and IRCA course specification for the ISO/IEC 27001:2022 Lead Auditor course. Book an ISMS lead auditor course from an Approved Training Partner and this is the paper at the end of it.

The examination is set, delivered and marked by CQI and IRCA, not by your training provider. 3FOLD TRAINING prepares you for it and registers you to sit it; it does not write or mark the paper. Nobody selling you a course can change the paper to suit their teaching. But there is a second thing to establish before you read any description of this exam, including this one.

Why some sources say two hours, or closed book

Published descriptions of “the CQI and IRCA lead auditor exam” often disagree with each other, and the reason is that two different examinations exist.

CQI and IRCA also operate a paper-based written exam. Its rules are different throughout: four sections, 90 marks, a 70 per cent pass mark and two hours. It is closed book, with only the course standard and a bilingual dictionary permitted.

ISO/IEC 27001 is not one of them. CQI and IRCA publish the list of schemes with online exams, and ISMS ISO/IEC 27001:2022 is on it at both Lead Auditor and Auditor Conversion level. The paper format persists only where a scheme or a course language has no online exam. Neither applies to an English-language ISO/IEC 27001 course.

Everything below describes the online exam, which is the one you will sit.

That explains a discrepancy you may meet. PR373 describes “a two-hour examination”, and some published material describes a closed-book paper. Both describe the paper format.

What is the CQI IRCA ISO 27001 Lead Auditor exam?

Successful completion of the course, examination included, satisfies the training requirement for IRCA auditor certification. What else that certification takes is a separate question.

PR373 sets three conditions. You must attend all elements of the course, be judged competent across the assessed activities during it, and pass the CQI and IRCA examination afterwards. Meet all three and you receive a Certificate of Achievement; attend and take part but fall short on the assessment and a Certificate of Attendance may be issued instead. It is successful completion of the whole course, not the exam on its own, that satisfies the IRCA training requirement.

The paper tests what you can do with the standard, not what you can recite from it. Domain 1 asks you to understand; every other domain asks you to apply or evaluate.

Who can sit it, and what does it assume you already know?

You sit it as part of a CQI and IRCA certified course, not as a standalone paper. PR373 assumes you arrive with a working knowledge of information security management and familiarity with ISO/IEC 27001 and ISO/IEC 27002.

This is not a formality. A lead auditor course is a skills course. Most of its time goes on practical audit activities and a simulated audit, not on working through the standard clause by clause. Turn up needing to learn what Clause 6.1.2 requires and you will spend the course catching up.

What does the exam not test?

Three things worth ruling out, because candidates spend revision time on all of them:

• Memorised text. It is open book, and no domain is set at the level of recalling a definition. Learning clause numbers by heart is the least efficient revision available.
• How many Annex A controls you can list. Annex A is a reference set, selected on the basis of risk and recorded in the Statement of Applicability, not a checklist every organisation implements in full. Questions test whether you understand that relationship.
• Your training provider's material. The paper is written by CQI and IRCA against PR373, not against any provider's slides.

How is the exam structured?

40 questions. 80 marks. Five domains. The marks are not spread evenly, and that is the single most useful thing to know before you start revising. There is a short answer on how many questions are on the ISO 27001 Lead Auditor exam if that is all you need.

Read the marks column, not the questions column. Domains 4 and 5 together carry 56 of the 80 marks, 70 per cent of the paper, from 22 of the 40 questions. Domains 1, 2 and 3 carry 24 marks across 18 questions.

Question values are fixed by domain. Domains 1 to 3 each hold two 2-mark and four 1-mark questions. Domain 4 holds eight 3-mark and six 2-mark. Domain 5 holds four 3-mark and four 2-mark.

A second rule shapes how the paper reads. Domains 1 to 3 may use a situation: a short description tied to a single question. Domains 4 and 5 use scenarios only, a longer context several questions may draw on, each question standing on its own. There is more on how the five domains differ.

How long is the exam?

The CQI and IRCA Lead Auditor Exam Framework gives the exam a base duration of 1 hour 45 minutes.If you are taking the exam in English and English is not your first language, you can request an additional 30 minutes, making the total 2 hours 15 minutes . It is requested through your training provider before the course rather than on the day, and CQI decides it.

The framework publishes a suggested split: 10 minutes each for Domains 1, 2 and 3, 45 for Domain 4 and 30 for Domain 5. That adds to 105 minutes. Follow it, or you will over-spend early and rush the two domains carrying 56.

What is the pass mark?

You must score at least 40 of the 80 marks overall, and reach the minimum mark set for every one of the five domains. Miss either test and you have not passed.

The minimum marks are absolute numbers, not percentages: 3, 3, 3, 14 and 8, in domain order. Add them and they come to 31 — well short of the 40 you need overall. Clearing every domain floor is not the same as passing, and a strong overall score does not rescue you from one weak domain. The pass mark and how the two tests interact is worth reading properly before you plan your revision, because it decides where your time should go.

What kinds of question appear?

All questions are computer-marked, and the guidance CQI issues to learners describes five formats:

• Multiple choice — choose one correct answer.
• Multiple response — choose several correct answers.
• Fill in the blanks — drag the correct words into a sentence.
• Matching — drag responses to match them to items.
• Sequencing — drag responses into the correct order.

Partial marks are given for all questions, so a partly-correct multiple-response answer earns something rather than nothing. CQI publishes no rule deducting marks for a wrong selection. On any question that asks you to choose several answers, select exactly the number asked for — no more and no fewer.

Before you sit, work through the official practice questions CQI provides — 24 of them for the Lead Auditor exam. They sit on a separate practice portal with separate login details, so watch for two emails. They exist to familiarise you with the question types and how the exam system works.

Is the exam open book?

The exam is open book. CQI's guidance for learners states that you may refer to notes from your training course. You will also need a copy of the ISO management systems requirements standard for your course, which here means ISO/IEC 27001. You may not use the internet.

ISO 19011 is a different matter. The Approved Training Partner Handbook says a copy should be available to learners during the course “except during the exam where it is not permitted to be used”. Some course material still tells learners to bring it. Take ISO/IEC 27001.

You may also use a second screen to read a digital copy of the standard or your notes. You may not have unauthorised electronic devices with you — phones, tablets, smart watches, headphones — and possession alone counts, whether or not you use them. There is more on what you can and cannot take into the exam.

You cannot go back

CQI's guidance for learners states that once you have answered a question and clicked Next, you cannot navigate backwards to review or change your answer. There is no final sweep and no coming back to a question you left. Decide each one before you move on.

This matters more than the permitted-items list. It rules out the technique most candidates bring from other exams: answer the easy ones, flag the hard ones, come back at the end. There is no end to come back at. Look things up before you click Next.

How and when do you sit it?

You sit the exam separately from the course, online, within 30 days of the last day of training. It is not sat on the last afternoon of training. CQI and IRCA's online exams are remotely proctored, using a webcam, a microphone and a stable internet connection. You sit in a location of your own choosing rather than at a test centre, and there is no live invigilator in the room or on the call. Your provider registers you; you start the exam yourself.

So the exam does not wait for you to feel ready. A 30-day window sounds generous on the last day of a course. It is not, once work resumes. Fix your date before you leave.

See also how CQI IRCA moved its assessments online and the technical issues learners hit with the exam platform.

What you need on the day

• A computer or laptop with a working webcam and microphone. Phones, tablets and hybrid laptops with front and rear cameras are not accepted.
• A stable, wired or strong wireless connection. Mobile data and VPN connections are not suitable, which traps anyone on a corporate-managed machine.
• Government-issued photo identification — a current passport, a photocard driving licence or a national identification card. You hold it to the webcam and take a photograph of your face before the paper opens; the two images are compared afterwards.
• A quiet, private, well-lit room where nobody can see your screen, with a power socket you can reach.
• Your copy of the standard, prepared in advance.

Run the system check a few days beforehand, and again at the time of day you intend to sit. Bandwidth varies through the day, and a better webcam needs more of it, not less.

Conduct during the exam

Your face must stay uncovered and visible, your webcam and microphone stay on, and you stay silent throughout. You are permitted one 10-minute break, taken through the platform's own break function so that it is logged. Leaving the room any other way is recorded and flagged. Food is not permitted; a drink is allowed at your own risk.

The proctoring system reviews the recording afterwards, and it flags behaviour as well as objects. Repeatedly looking away or glancing at your wrist is on the published list. Our guide to what gets candidates disqualified from a CQI IRCA exam covers the conduct rules in full.

What happens after the exam?

If your proctoring recording raises no issues, your result reaches your training provider within 10 UK working days. Heard nothing after 14 working days? Contact your provider, not CQI.

Meet all three conditions and you receive a Certificate of Achievement. It carries your name, a Unique Learner Number issued by CQI, the course title and identification number, and the CQI and IRCA Certified Course logo.Successful completion of the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor course satisfies the IRCA ISMS auditor training requirement when completed within the five years before applying for initial certification. Anyone can check a CQI IRCA certificate online.

Resits are available and your training provider arranges them. CQI charges the training provider a resit exam fee; whether that is passed on is a matter for the provider. Ask your provider what its resit arrangements are before you book your first sitting, not after. The result breakdown tells you which domains cost you the marks.

Passing is not the end of the route. The grade you qualify for depends on the audit experience you build afterwards. For how the schemes fit together, start with what IRCA is and why it matters and the IRCA auditor certification schemes.

Frequently asked questions

Where to go next

This guide covers the shape of the paper. The detail sits in the four articles linked above — the domains, the pass mark, the question count and the open-book rules. 3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING's Approved Training Partner record, and any provider's certified courses can be looked up in CQI and IRCA's own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.