Five years. A Certificate of Achievement is valid for five years for the purpose of the IRCA auditor training requirement: apply inside that period and the course counts. Past it, CQI and IRCA say they will still consider the training where you can evidence recent continuing professional development, relevant work experience and that your auditing skills are current — so it is a window rather than a wall. The certificate remains a record of what you did either way. Your provider must tell you about the five years in writing.

What does the five-year validity of an ISO 27001 Lead Auditor certificate apply to?

The published rule is that a Certificate of Achievement for a CQI and IRCA certified auditing course is valid for five years. What those five years govern is its ability to satisfy the IRCA auditor training requirement: apply for auditor certification inside the period and the course counts as a matter of course. Beyond it, CQI and IRCA say they will consider training completed more than five years before an application where you can also evidence recent and relevant continuing professional development, relevant work experience, and that your auditing skills are current. That is a discretion they exercise rather than an entitlement you hold, which is a reason to apply inside the window rather than to rely on it. One detail the wording leaves open is whether the five years run from the date you completed the course or from the date you passed — those can be up to a month apart, so diary from the completion date, which is the earlier.

The distinction people miss is what the five years bite on. The certificate does not stop being a record of what you did. You attended a certified course and passed both its assessments, and none of that becomes untrue. What lapses is its power to satisfy one specific requirement.

What lapses is its power to satisfy one specific requirement: the training component of an application to the CQI and IRCA auditor certification scheme. That component has a shelf life, and the shelf life is five years.

The five-year rule comes from the rules governing CQI and IRCA approved training partners and from CQI and IRCA’s own guidance on applying for auditor certification.

The written notification your ISO 27001 Lead Auditor provider owes you

There is a duty attached to that, and it sits on the training provider rather than on you. An approved training partner is required to inform learners of the five-year validity in writing. If nothing you were given says it, ask — and keep the answer with the certificate.

This is worth acting on rather than reading past. A five-year deadline you were never told about is a deadline you will miss, and the practical consequence — sitting a Lead Auditor course a second time because the first one aged out while you were accumulating experience — is an expensive way to learn a rule.

So: find the sentence in what you were given. If it is not there, ask your provider for it in writing and keep it with the certificate itself.

Why five years is not as long as it sounds

The five years are not idle time. They are the window in which you build the thing the application is actually assessed on.

One thing to be clear about at the outset, because it is the point most easily blurred. Completing an approved Lead Auditor course, and passing the examination, does not make you a certificated auditor. It satisfies the training requirement, which is one part of an application you make separately to CQI and IRCA, and the grade you can apply for depends on audit experience you build up afterwards.

The grades, and what each one asks of you in audit experience, are published by CQI and IRCA and are theirs to change. Rather than reproduce numbers that may have moved by the time you read this, we point you at the CQI and IRCA grades of auditor certification, which is what your application will actually be assessed against. One thing worth knowing before you go: the grade names on that page have changed since much of what is written about them was written, so check the current names there rather than assuming a route described elsewhere still exists.

So the sequence is: pass the course, then accumulate audit experience, then apply. The five-year limit sits across the middle of that sequence, on the part you have least control over. Audits happen when your organisation schedules them, and a candidate who finishes the course and then waits for their employer to put them on an audit team can lose a year or two without doing anything wrong.

The practical implication is to start the experience side early and deliberately rather than waiting to be asked, and to keep a contemporaneous record of every audit as you do it — dates, scope, your role, days on site. Reconstructing four years of audit history from memory in the fifth year is a miserable exercise and produces a weaker application.

What your ISO 27001 Lead Auditor certificate has to show

The rules set out what an approved training partner must put on the certificate, all of it on a single side. Check yours carries all of it. A certificate missing a required element is one you may have to go back for at exactly the wrong moment.

• The training partner’s name as approved by CQI.
• Your name and the learner identification number required by the current CQI and IRCA certificate requirements.
• The course title exactly as it appears in the specification, and the unique course identification number issued by the CQI.
• The CQI and IRCA Certified Course logo.
• The date you completed the course.
• The name and signature of the training partner’s senior manager responsible for certified courses.
• A statement confirming you have successfully passed all the course assessment requirements.

A replacement certificate must be clearly identifiable as a replacement. Separately, a partner approval and a course certification can be checked against CQI and IRCA’s own directory, which is why the course identification number is worth keeping to hand.

CQI IRCA Certificate of Achievement vs Certificate of Attendance

The five-year rule attaches to the Certificate of Achievement, because it attaches to the training requirement. A Certificate of Attendance — which may be issued to a learner who attended and took part but did not pass the assessment requirements — does not start that clock. What happens if you fail the examination covers the difference.

After CQI IRCA auditor certification, the clock changes shape

The five years are about getting into the scheme. If you already hold an auditor grade, they no longer concern you. What keeps a grade is continuing professional development, on terms CQI and IRCA set and revise; those requirements sit alongside the entry criteria on the grades pages linked above, which is where to read them rather than in any summary.

Diary the date five years from the completion date on your certificate, now, while you are looking at it.

Frequently asked questions about ISO 27001 Lead Auditor certificate validity

Where to go next: more ISO 27001 Lead Auditor exam preparation

• The steps to becoming a certified ISO 27001 Lead Auditor — where the course sits in the whole sequence.
• Applying for CQI and IRCA auditor grade membership — what the application itself involves.
• How long results take — the wait before any of this starts.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.