Most candidates who fail this examination do not fail on knowledge. They fail by spreading their effort evenly across five domains that carry 8, 8, 8, 36 and 20 marks, by preparing for a closed-book paper when it is open book, or by missing a single domain minimum on a paper they passed overall.

Where are the marks in the ISO 27001 Lead Auditor exam, really?

Start here, because every other decision follows from it. The paper is 40 questions worth 80 marks, and the marks are not distributed like the questions:

Domains 4 and 5 carry 56 of the 80 marks between them. The three domains at the front of the paper carry 24 between them — less than Domain 4 alone. If your revision time is split evenly across five domains, roughly a third of it is going to a third of the marks, and it is the easy third.

There is a second condition on top of the 40-mark overall pass, and it is the one that catches people out. Each domain carries a minimum, in absolute marks rather than percentages: 3, 3, 3, 14 and 8. Miss one and the paper fails whatever your total. A candidate on 48 out of 80 with 12 in Domain 4 has passed on marks and failed the examination.

What does an open-book ISO 27001 Lead Auditor exam actually change?

The exam is open book. CQI’s guidance for learners states that you may refer to notes from your training course. You will also need a copy of the ISO management systems requirements standard for your course, which here means ISO/IEC 27001. You may not use the internet.

What it changes is what is worth learning. A clause number you can look up in thirty seconds is not a revision priority; being able to find things quickly is. Practise with the standard the way you will have it on the day — if that is a PDF, learn its search behaviour, and if it is paper, learn its structure rather than marking it up, because 3FOLD TRAINING’s rule is that the copy you sit with is clean and unmarked, tabs and sticky markers included. Candidates lose more time hunting than they lose thinking.

What it does not change is the two big domains. Nothing you can look up will tell you whether the evidence in a scenario supports a major or a minor, or whether a proposed corrective action addresses the cause. That judgement is the bulk of the paper and no book contains it.

Which study habits actually move your ISO 27001 exam score?

Answer in marks, not in questions. The paper is marked in marks and the domain minima are measured in marks. A 3-mark scenario question in Domain 4 is worth three times a 1-mark recognition question in Domain 1, and the published time allocation gives it roughly twice as long.

Decide and move on. CQI’s guidance for learners states that once you have answered a question and clicked Next, you cannot go back to review or change your answer. There is no final review and no option to return to a question later. Make your decision before moving on. The usual strategy of skipping difficult questions and returning to them later is not available here. Practice making a decision and moving forward with confidence.

Watch the clock against the front of the paper. The published guidance allows about 10 minutes each for Domains 1 to 3, 45 for Domain 4 and 30 for Domain 5. Running out of time in Domain 4, having spent too long on the smaller domains, is a common and entirely self-inflicted way to lose marks.

Select exactly the number asked for. On any question that asks you to choose several answers, select exactly the number asked for — no more and no fewer.

Name the requirement before you choose. In Domains 4 and 5, most questions resolve once you can say what requirement is engaged and what the evidence actually shows. Answers that sound thorough and answers that are supported by the scenario are different sets, and the paper rewards the second.

What should the last fortnight before your ISO 27001 exam look like?

Two weeks out: find out where you stand. Sit a full paper under real conditions — timed, standard beside you, phone elsewhere, no going back. The free 40-question mock exam is weighted exactly like the real one. Mark it by domain before you look at your total, because the domain scores are what tell you what to do next.

Ten days out: work the weakest domain, not the most interesting one. Take the full set for whichever domain came out lowest. Each set matches the real paper’s count and mark split, and the explanations tell you why every wrong option is wrong, which is where the learning is:

• Domain 1 practice questions — concepts and principles, 6 questions, 8 marks.
• Domain 2 practice questions — audit concepts and auditor responsibilities, 6 questions, 8 marks.
• Domain 3 practice questions — planning the audit, 6 questions, 8 marks.
• Domain 4 practice questions — conducting the audit, 14 scenario questions, 36 marks.
• Domain 5 practice questions — reporting and closing out, 8 scenario questions, 20 marks.
• The sample exam questions and answers — ten questions weighted across all five domains, if you want a spread rather than a domain.

A week out: practise the judgement. If your losses were in grading and reporting rather than in recognising requirements, drill that specifically. The findings grading exercise gives you twelve findings from one audit to grade and justify, which is exactly what Domains 4 and 5 ask for.

Three days out: sit a full paper again. Re-sit the free one cold, or use 3FOLD TRAINING’s graded mock exams if you have access to them. One pass can be luck; two is a pattern, and the second tells you whether the fixes worked.

The day before: stop revising and sort out the logistics. Check your equipment against the published requirements, check the room you will sit in, and check the duration on your own exam confirmation. Nothing you learn on the last evening will be worth what a failed system check on the morning will cost you.

What do the five ISO 27001 exam question formats ask of you?

The paper uses multiple choice, multiple response, fill in the blanks, matching and sequencing. The last three are drag-and-drop and all five are computer-marked. Each has a habit worth practising.

• Multiple choice is the familiar one, and the trap in the two big domains is the option that sounds most thorough. The best answer is the one the evidence in the scenario supports, which is often the more measured of the two you are choosing between.
• Multiple response is the format candidates most often say caught them out, largely because almost nobody practises it. The number wanted is stated in the stem — read it before you read the options, because it is the one instruction the options themselves will not remind you of.
• Fill in the blanks rewards knowing the exact wording of things that have exact wording — clause titles, the parts of a nonconformity, the principles. It is the one format where the open book genuinely earns its keep.
• Matching usually pairs terms with definitions or findings with requirements. Work the ones you are sure of first; each pair you place narrows the rest.
• Sequencing asks for an order — audit stages, the risk trail, the closing meeting. Learn the sequences as sequences rather than as lists, because a list you can recite in any order will not survive the format.

Before you sit, work through the official practice questions CQI provides — 24 of them for the Lead Auditor exam. They sit on a separate practice portal with separate login details, so watch for two emails. They exist to familiarise you with the question types and how the exam system works.

What about sitting the ISO 27001 Lead Auditor exam itself?

CQI and IRCA’s online exams are remotely proctored, using a webcam, a microphone and a stable internet connection. You sit in a location of your own choosing rather than at a test centre, and there is no live invigilator in the room or on the call but, your entire screen will be on record and it will be reviewed before the result announcement. Your provider registers you; you start the exam yourself.

You sit the exam separately from the course, online, within 30 days of the last day of training.

You are permitted one 10-minute break, taken through the platform’s own break function so that it is logged. Leaving the room any other way is recorded and flagged. Food is not permitted; a drink is allowed at your own risk.

If your proctoring recording raises no issues, your result reaches your training provider within 15 UK working days. Heard nothing after 15 working days? Contact your provider, not CQI.

What happens if you do not pass the ISO 27001 Lead Auditor exam?

Resits are available and your training provider arranges them. CQI charges the training provider a resit exam fee; whether that is passed on is a matter for the provider. Ask your provider what its resit arrangements are before you book your first sitting, not after.

The more useful question is what to change. A result that failed on the overall mark and a result that passed on the mark but missed a domain minimum are different failures with different remedies. The first says the preparation was too thin across the board; the second says it was aimed at the wrong domains, which is the more common and the easier to fix. Ask your provider which domain it was before you decide what to do differently.

The examination is set, delivered and marked by CQI and IRCA, not by your training provider. 3FOLD TRAINING prepares you for it and registers you to sit it; it does not write or mark the paper. Rules of this kind are set by CQI and IRCA and can be revised. Confirm the position with your training provider, and read the exam guidance CQI issues to you, before your sitting.

What if English is not your first language when sitting the exam?

The CQI and IRCA Lead Auditor Exam Framework gives the exam a base duration of 1 hour 45 minutes. Where English is not your first language you may request an additional 30 minutes, which takes the sitting to 2 hours 15 minutes. It is requested through your training provider before the course rather than on the day, and CQI decides it.

It is worth planning around rather than treating as a bonus. The extra thirty minutes is roughly what an unhurried pass through Domain 4 costs, so the sensible use of it is to slow down where the marks are rather than to spread it evenly across the paper. And practise in the duration you will actually be given: sitting a mock in 1 hour 45 minutes when you will have 2 hours 15 minutes teaches you a pace you will not need, and the reverse teaches you one you cannot sustain.

What is not worth your time when preparing for the exam?

• Memorising the 93 Annex A controls. You need to know Annex A is a reference set of 93 controls in four themes, that the organisation selects on risk, and that the Statement of Applicability records the decision on every one of them with a justification either way. Being able to find a control quickly matters; reciting them is not tested.
• Exam dumps. Most are written for a different scheme entirely, so the marks, the domains and the pass rule are all wrong. What dumps get wrong sets out the specifics.
• Re-reading the standard end to end. It is open book. Time spent learning to navigate it beats time spent trying to hold it in your head.
• More practice in the domain you are already good at. Comfortable is not the same as useful, and eight marks is eight marks.

Frequently asked questions about passing the ISO 27001 Lead Auditor exam

Where to go next: more ISO 27001 Lead Auditor exam preparation

For the format and the sitting process itself, the complete CQI IRCA ISO 27001 Lead Auditor exam guide covers what happens on the day, and how the pass mark works sets out both conditions in full.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.