Internal auditing is a job the standard requires; lead auditor is a qualification with a professional grade behind it. ISO 27001 obliges you to run internal audits with objective auditors, but names no certificate. The Lead Auditor course is the one that carries the CQI and IRCA examination and the route to a certificated grade.

One disclosure before the comparison: we deliver the CQI and IRCA Lead Auditor course and not an internal auditor course, so we have an interest in this answer. The requirements below come from the standard and from the scheme’s own published material, and both are worth reading rather than taking from us.

What does ISO 27001 actually require for internal audit?

Worth settling before any comparison of courses, because the requirement is narrower and more demanding than it first appears.

ISO/IEC 27001 — the standard itself, which is sold rather than published free — requires an organisation to conduct internal audits at planned intervals, and to plan and establish an audit programme. For each audit it must define the criteria and the scope, and it must select auditors and conduct audits in a way that ensures objectivity and the impartiality of the audit process. Results have to be reported to relevant management and retained as documented information.

Read the requirement carefully and two things follow. The first is that it names no qualification. Competence is dealt with elsewhere in the standard, in terms of appropriate education, training or experience, with the organisation determining what is necessary. No certificate is specified, anywhere.

The second is that the objectivity clause does real work. It is the reason an internal auditor should not audit their own function’s work: someone reviewing a process they run cannot deliver an impartial audit process, whatever their competence. That constraint, rather than any certificate, is what usually decides who audits what in practice.

Why hold an ISO 27001 internal auditor or lead auditor qualification at all?

Three reasons, and none of them is that the standard demands it.

Because the organisation has to justify its choice of auditor. What counts as appropriate education, training or experience is a determination the organisation makes and has to be able to evidence. A certificate from a scheme with published criteria is straightforward evidence to produce, and it can be checked by anyone who wants to.

Because internal audit findings are only worth what the reporting is worth. The skill an audit course teaches is not noticing that something is wrong. It is grading what you find against a requirement, writing it so that it survives challenge, and closing it out. Those are the things the CQI and IRCA examination is built to test.

Because the credential travels and the job does not. An internal audit role is a role in one organisation. A professional grade is portable, is recognised outside it, and is what a tender or a job advert names.

ISO 27001 internal auditor vs lead auditor: the two courses are not two rungs

Here is the comparison, and the framing to discard first: the Internal Auditor course is not a smaller Lead Auditor course, and the Lead Auditor course is not the Internal Auditor course with more days bolted on. The two duration figures below are the ones CQI and IRCA publish for their own course levels.

The row that matters is the examination, and the last row follows from it. A certified internal auditor course is assessed by the provider delivering it. The Lead Auditor course carries an examination set and marked by CQI and IRCA. That is why it is the one satisfying the training requirement for the lead auditor grade, and why the certificate means the same thing wherever it is presented. How that examination is structured sets out the sitting.

Does an ISO 27001 lead auditor qualification cover internal audit work?

Yes. PR373, the course specification, describes the aim of the course as giving learners the knowledge and skills required to perform first, second and third-party audits of information security management systems against ISO/IEC 27001. First-party auditing is internal auditing. Nothing about the qualification is directed away from the internal audit programme; it simply does not stop there. CQI and IRCA’s own course marketing pitches the audience as second and third-party auditors. That is a statement about who they expect to buy it; the specification is the document defining what it covers.

That is the practical answer to the question this page is really about. The lead auditor qualification is the training behind all three kinds of auditing — running your organisation’s internal audit programme, auditing a supplier when procurement asks, and working on a certification body’s team — without a second course. The narrower qualification is the training behind the first of those three and does not reach the other two. Two honest caveats apply to the lead auditor route as well: a certification body still decides its own auditors’ competence, and a professional grade is applied for separately on the experience you build.

What does a certification body look at in your ISO 27001 internal audit?

The reason this question matters practically is that someone external eventually reads your internal audit records. When a certification body audits your ISMS, the internal audit programme is one of the first places it goes, and it is looking at four things.

• Was there a programme, planned at intervals? Not a set of audits that happened, but a programme with frequency, methods, responsibilities and reporting defined, taking into account the importance of the processes concerned and the results of previous audits.
• Were criteria and scope defined for each audit? An audit without stated criteria cannot produce a finding, because a finding is a gap against a criterion.
• Were the auditors objective and impartial? This is where competence evidence and the who-audited-what question meet.
• Were results reported and retained, and did anything happen as a result? An internal audit programme that finds nothing, year after year, tells its own story.

Those four are what a lead auditor course is built around, and it teaches them from the position of the person who has to defend the conclusion rather than the person receiving it. That is the practical case for holding the qualification even if your entire career is spent auditing one organisation: the programme you run is judged by the same standard the external auditor was trained to.

Who should hold the ISO 27001 internal auditor or lead auditor qualification?

Set the course names aside and ask what the next two years look like.

• If information security auditing is going to be part of your professional identity — you will do it repeatedly, you will want it on a CV, you expect to lead audits or supervise others doing them — the lead auditor qualification is the one to hold. It covers everything the narrower course covers and carries the credential.
• If you have been asked to help with one internal audit and will not do it again, a short internal audit course is the proportionate purchase. Be clear about what it is: training rather than a qualification, assessed by whoever sold it, and it does not lead where the other one leads.
• If your organisation is building an internal audit programme, one workable pattern is a single person holding the lead auditor qualification who sets the programme, the findings standard and the reporting, with others contributing audits under it. That person’s judgement is what makes the programme defensible in front of a certification body.

The trap in the middle: two ISO 27001 auditor courses with the same name

One last practical warning, because it is an easy and expensive mistake.

The phrase “internal auditor course” is used for two quite different products. One is a scheme-certified internal auditor course delivered by an approved partner, which sits inside a recognised structure. The other is a generic in-house or open course written by whoever is delivering it, assessed by them, and certified by nobody. Both may be perfectly good training, but only the first is checkable against anything.

The confusion matters because the two certificates can look alike on a CV and mean quite different things to a reader who knows the market. If you are going to hold a shorter qualification rather than the lead auditor one, at least know which of the two you have bought. Ask for the scheme owner by name and the course reference, then look it up.

The same warning applies at the top end, and more expensively. What “accredited” really means on a course page sets out the check to run.

Frequently asked questions about ISO 27001 internal auditor vs lead auditor

Where to go next: more on the ISO 27001 Lead Auditor course

How auditing differs from implementing is the other comparison readers make at this point, and who is eligible for the Lead Auditor course answers the entry question. If you are weighing schemes rather than roles, CQI and IRCA compared with PECB covers that choice.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.