IRCA and Exemplar Global divide the same job differently. CQI and IRCA certify the course, against one specification, and set the examination themselves. Exemplar Global certifies training providers against modular competency units, and the certified provider writes and administers the examination, with Exemplar Global monitoring how it does so. That structural difference decides most of the comparison.

A note on how this page is written. Everything said here about another scheme comes from that scheme’s own published material, and where it has a genuine advantage the page says so. We deliver the CQI and IRCA course, so read this as an interested account — and check the linked sources rather than taking ours or anyone else’s word for it.

What do IRCA and Exemplar Global actually certify for ISO 27001 Lead Auditors?

Four questions settle any comparison of this kind. What does the scheme actually certify, who writes and marks the examination, what does the certificate say you have done, and what must you show afterwards to hold a professional grade. On these two schemes the answers diverge from the first one onwards.

CQI and IRCA certify a course. The ISO 27001 Lead Auditor course is delivered against a published specification, PR373, which fixes the learning outcomes, the indicative 40 hours, the assessment and the content boundaries. You buy one thing, it is defined, and it maps onto one credential.

Exemplar Global’s structure is modular. It publishes competency units — auditing, team leadership and an information security unit — and certifies training providers and their examiners against them. A course is then certified as meeting the requirements for the units it delivers, and the lead auditor route is assembled from several units, each attested separately. A learner collects a statement of attainment per unit. Exemplar Global certifies courses across a range of management-system schemes — quality, food safety and occupational health and safety among them — using the same auditing and team-leader units, so those two are not tied to information security.

That modularity is a genuine strength and it is worth naming as one: add a scheme later and you add a unit rather than repeating a course.

The cost of it is that there is no single specified course to hold anyone to. What is defined is each unit and its examination profile; how a provider builds a course around them, and how long that course runs, is the provider’s design.

Who writes and marks the ISO 27001 Lead Auditor examination?

This is the difference we would weigh most heavily, and it is a matter of published scheme design rather than of opinion about anybody’s integrity.

On the CQI and IRCA route the examination is set, delivered and marked by CQI and IRCA rather than by the training provider. This examination is neither administered nor graded by the training provider, who has no role in the result. The provider does conduct continual assessment as part of the course; however, the final examination required to satisfy the training requirement is set and administered by an independent examining body.

Under the Exemplar Global model the certified training provider writes the examination against the competency unit and its published examination profile, and a certified examiner marks it. Its certification requirements for training providers say the examiner should not be the same person as the instructor, and require a provider that combines the roles to demonstrate how the conflict is managed. This is a control the scheme has thought about rather than one it has overlooked. The same document requires a provider to develop and maintain an examination guide for every examination it uses, and Exemplar Global evaluates providers against those requirements. These are deliberate controls, and worth knowing about rather than glossing over.

Reasonable people can weigh that differently. A provider-set examination can be closer to what was taught and is administered without a separate sitting. An externally set examination is harder to align to a single provider’s material, and it puts the conflict outside the arrangement rather than managing it inside.

How are the IRCA and Exemplar Global ISO 27001 Lead Auditor schemes built?

The word “accredited” in ISO 27001 Lead Auditor certification, and who says not to use it

There is a detail here worth more than any argument a training provider could make, and it comes from Exemplar Global’s own rules for its training providers. Its administrative requirements for training providers say: “In all advertising, the word ‘certified’ shall be used; the word ‘accredited’ shall not be used.”

That is a scheme owner instructing its own partners not to describe their courses as accredited. CQI and IRCA publish no such instruction, and are looser with the word themselves. Their page for training partners refers to “courses bearing our accreditation” — exactly the usage Exemplar Global rules out for its own partners. So the honest summary is not that one side is careful and the other is not. The word is used loosely across this market, scheme owners included, and of these two only Exemplar Global has published a rule about it. Which is why the useful question is never “is it accredited” but “accredited by whom, against what standard, for what scope”.

One point about accreditation is worth carrying away from this, and it applies wherever you meet the word. Accreditation is granted to a body, for a named list of schemes. A general claim to be accredited is therefore worth reading against the individual schedule, because a body accredited for one scheme is not thereby accredited for all of them. What that means for an ISO 27001 course is a subject of its own.

What happens after the ISO 27001 Lead Auditor certificate with IRCA or Exemplar Global?

Both schemes have auditor grades behind the training, and both make you earn them. The shapes differ enough to matter. One caution before the detail. Exemplar Global’s published certification requirements for this scheme are some years old and still name the 2013 edition of ISO/IEC 27001, so check the figures with Exemplar Global rather than relying on any summary, ours included.

Exemplar Global’s grades run from an associate grade that asks for work experience but no completed audits, through grades needing audits and audit days, up to grades requiring audits led as team leader and long continuous certification. We have not printed its figures, for the reason just given. There is also a work style assessment in the mix, which Exemplar Global describes as a career and self-coaching development tool measuring personality traits, skills and capabilities, taken at application and every three years. Read that as a development instrument rather than as a second examination.

CQI and IRCA grades are built from complete audits, audit days and days on site, with audits actually led as team leader required at the lead auditor grade. There is no equivalent instrument on that side; the assumption is that leading audits is itself the evidence.

How should you choose between IRCA and Exemplar Global for ISO 27001 Lead Auditor?

Three questions settle it.

• Which name appears in your market? Search the job adverts and tenders in your sector and region for both. That answer outranks every structural argument on this page.
• Will you audit more than one standard? If you expect to move across the schemes Exemplar Global covers, the shared units are a real efficiency. If ISO 27001 is the job, that efficiency is not worth much.
• Does it matter to you who marks the paper? If you will have to defend the qualification to a client, an employer or a procurement team, an externally set and externally marked examination is the easier answer to give.

Whichever route you take, the grade is the part that takes real time. The course and the examination are the training component; what you hold afterwards depends on the audits you go on to do and can evidence.

What does this mean if you are buying an ISO 27001 ISMS Lead Auditor course?

Four practical consequences follow, and they are worth having in mind when you are reading two quotes side by side.

Ask what is fixed and what is the provider’s choice. On the CQI and IRCA route the answer is that the learning outcomes, the indicative duration, the assessment method and the content boundaries are all fixed by the specification. On the Exemplar Global route the units and their examination profiles are fixed and the course built around them is designed by the provider. Neither answer is wrong; you should simply know which one you are getting.

Ask who you complain to if the course is poor. A specified course gives you something to measure a complaint against, and a scheme owner to raise it with. That is worth more than it sounds on the day you need it.

Check the provider on the scheme owner’s own register before you pay, on either route. Both bodies publish one — the CQI and IRCA directory and the Exemplar Global client register — and both are searchable without an account. A provider on either scheme should be able to tell you exactly what to search for.

One difference to know about before you search. Exemplar Global operates two provider programmes: TPECS, under which providers are certified, audited and monitored, and a lighter recognised training provider arrangement. Both are published as leading to its personnel certification, and its register does not distinguish them, so ask which one your provider is on. On the CQI and IRCA side there is a single status, approved training partner, and it is either held or it is not.

Frequently asked questions about IRCA vs Exemplar Global ISO 27001 Lead Auditor certification

Where to go next: more on the ISO 27001 Lead Auditor course

How CQI and IRCA compare with PECB covers the other scheme readers weigh against ours, and what “accredited” really means takes that apart properly. If you have settled on the CQI and IRCA route, who is eligible for the course is the practical next step.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.