You sit the CQI and IRCA ISO 27001 Lead Auditor examination online, within 30 days of the last day of training. You log in, show your photo identification to the webcam, photograph your face, accept the regulations and start. Webcam, microphone and screen are recorded throughout, there is one logged ten-minute break, and no going back to an answered question.

The nine steps to sit the CQI IRCA ISO 27001 Lead Auditor exam online, in order

• Your provider registers you; two sets of login details arrive.
• Ask for any reasonable adjustment now, before the course starts.
• Three days out: run the system, camera and microphone checks.
• On the day: re-run the checks and set the room up.
• Log in, show your photo identification, photograph your face.
• Read the instructions and accept the examination regulations.
• Sit the paper: 40 questions, 80 marks, no going back.
• Take your one logged ten-minute break where you planned it.
• Submit, complete the short survey, wait for your result.

How is the ISO 27001 lead auditor examination arranged?

You sit the exam separately from the course, online, within 30 days of the last day of training. That is a window rather than a date, so agree your sitting with your provider once your login details arrive.

The examination is set, delivered and marked by CQI and IRCA, not by your training provider. 3FOLD TRAINING prepares you for it and registers you to sit it; it does not write or mark the paper.

It is online. The examination framework records this paper as sat online and marked by CQI and IRCA rather than by the training provider, delivered through their assessment platform and computer-marked. A paper sitting is not an option on this course.

The detail on this page comes from the examination policies CQI and IRCA issue to learners before the course — the guide for learners, the online exam regulations and the IT requirements document. You are given them; they are not published on a website, so searching will not find them. If you have not had them, ask your training provider for them now rather than the week before you sit.

Step 1 — registration for the CQI IRCA ISO 27001 exam, and your two sets of login details

Your training provider registers you and passes CQI and IRCA the details. You do not book the examination yourself.

What arrives is easy to muddle. There are two separate portals with two separate sets of credentials, arriving in two separate emails. One is the practice portal, which carries the official practice questions; the other is the examination portal, where you sit an exam.

Log into both as soon as they arrive. A credential problem found a fortnight out is an administrative nuisance; the same problem found ten minutes before you meant to start is a lost sitting.

Work through the official practice questions before you sit. They exist to familiarise you with the question types and with how the examination system behaves, which is not something to meet for the first time under a clock.

Step 2 — if you need a reasonable adjustment, ask now

This belongs at the front because it is the one thing you cannot do later. There are two routes and they are not the same. Extra time on the ground that English is not your first language is notified by your provider with your registration details. Every other adjustment — screen reader support, a female proctor to check the identification and recording of a female Muslim learner, an extended schedule where illness prevents sitting inside the 30 days — goes on a request form, may need supporting evidence, and is assessed rather than granted. Either way, raise it before the course starts; CQI processes requests within two UK working days.

Step 3 — three days out

CQI and IRCA publish a short list of things to do at least three days before you sit. Working through it early is the cheapest thing you can do to protect the sitting.

• Run the system check, plus the separate camera and microphone tests, at roughly the time of day you intend to sit — domestic bandwidth is not constant across a day.
• Log into the examination portal and confirm your credentials work and the examination shown against your name is the right one.
• Look at the room you intend to use, at the time of day you intend to use it.
• Check the expiry date on your photo identification.
• Get your copy of ISO/IEC 27001 to hand, in whatever form you are permitted to use.
• Tell the people you live and work with the date and the time. Someone walking into shot is an incident on your recording.
• Work the practice questions.

The online exam IT requirements are a subject of their own, and worth reading before you assume the machine you have in mind will do.

Step 4 — on the day, before you log in

Re-run the systems check. Something that worked three days ago may not today, and it is better to know before you start than halfway through the paper.

Deal with anything that interrupts. Disable your pop-up blocker. Turn off applications that update themselves. Switch off free anti-virus tools or add the examination software to their allowed list. An examination browser fighting a security product is a real failure mode.

Set the room up. Quiet, well lit, private, with a power socket. Light the room from the front and do not sit with a window behind you.

Clear the desk and put your phone in another room rather than in a drawer — possession of a prohibited device counts against you whether or not you touch it. The online exam room rules set out the whole list, including what you may have open in front of you.

Get a drink. A drink is permitted, at your own risk. Food is not permitted.

Step 5 — logging in and proving who you are

You log into the learner home page on the examination portal and click to start. The identity check comes before anything else.

First, your identification. You hold it up to the webcam so that it fits the frame shown on screen and your name and photograph are both legible. That is harder than it sounds with a laptop camera, so practise beforehand: hold the card still, in enough light, and give the camera a moment to focus.

Then your face. You take a photograph of yourself inside the oval frame on screen. Head and face visible, looking at the camera; no hats, hooded tops or sunglasses. A headscarf may be worn if your face is uncovered and your ears show.

You submit both, and the proctoring service compares them afterwards. The photo ID rules for the online exam — what counts, and what happens if you cannot produce it — are worth knowing well before the morning of the examination.

Step 6 — the instructions and the regulations

Next come the navigation and timing instructions for the paper. Read them rather than clicking through: they are the authoritative statement of how the paper behaves.

Then you are asked to accept CQI’s online examination regulations. Declining means you cannot sit. This is also the moment the conduct rules become something you have personally agreed to — which is why they are worth reading in advance, and why they, rather than anyone’s summary of them, are what you are held to. Accept, and the examination begins.

Step 7 — the paper itself

These figures come from the examination framework CQI and IRCA issue with the examination policies before the course. It is a document learners are given rather than one published on a website, so you will not find it by searching. It is not a secret, though, and knowing the shape of the paper is part of preparing for it.

The CQI and IRCA Lead Auditor Exam Framework gives the exam a base duration of 1 hour 45 minutes. Where English is not your first language you may request an additional 30 minutes, which takes the sitting to 2 hours 15 minutes. It is requested through your training provider before the course rather than on the day, and CQI decides it.

You must score at least 40 of the 80 marks overall, and reach the minimum mark set for every one of the five domains. Miss either test and you have not passed. The domain breakdown sets out the marks and the minimum for each; that distribution is the most useful thing to know about pacing, because the last two domains carry more than twice the marks of the first three.

The rule that changes how you sit it: CQI’s guidance for learners states that once you have answered a question and clicked Next, you cannot navigate backwards to review or change your answer. There is no final sweep and no coming back to a question you left. Decide each one before you move on. Any technique that depends on coming back to an answered question is unusable here. What that changes about exam technique is worth reading before you sit, particularly if you have been taught to flag questions and return to them.

Partial marks are given for all questions. On any question that asks you to choose several answers, select exactly the number asked for — no more and no fewer. How the marking actually works sets out what is published and what is not, because the marking of multiple-response items is the one point on which the sources are not complete.

Step 8 — the break

You are permitted one ten-minute break, taken through the on-screen button so that the platform logs it. Where in the paper to take it, and what is still unresolved about the clock, are covered with the rest of the desk and room conditions.

Step 9 — submitting, and afterwards

When you finish, you submit. A short learner experience survey follows; it is CQI’s, and not part of the assessment.

You are not told your result on screen. Your result is available for your training provider to download within 14 UK working days. Heard nothing after 14 working days? Contact your provider.

Resits are available and your training provider arranges them. CQI charges the training provider a resit exam fee; whether that is passed on is a matter for the provider. Ask your provider what its resit arrangements are before you book your first sitting, not after.

PR373, the CQI and IRCA specification for this course, sets three conditions. You must attend all elements of the course, be judged competent across the assessed activities during it, and pass the CQI and IRCA examination afterwards. Meet all three and you receive a Certificate of Achievement; attend and take part but fall short on the assessment and a Certificate of Attendance may be issued instead. It is successful completion of the whole course, not the exam on its own, that satisfies the IRCA training requirement.

One thing to be clear about at the outset, because it is the point most easily blurred. Completing an approved Lead Auditor course, and passing the examination, does not make you a certificated auditor. It satisfies the training requirement, which is one part of an application you make separately to CQI and IRCA, and the grade you can apply for depends on the audit experience you build up afterwards. One deadline worth diarising. The training requirement is satisfied for five years: apply to CQI and IRCA within that period and the course counts automatically.

What if the software fails during your CQI IRCA ISO 27001 online exam?

If the examination software fails, do not click submit. Close the examination browser and contact your training provider immediately — submitting an unfinished paper to escape a technical fault turns the fault into a result. What that means for a resit, and how to avoid getting there at all, is covered with the IT requirements linked above.

What if something outside your control affected your ISO 27001 Lead Auditor exam?

CQI has a special consideration policy, and it is narrower than people assume. It covers an unexpected illness, injury or indisposition, or an event outside your control such as a bereavement shortly before the sitting or a serious disturbance during it, where your performance was significantly affected. It does not cover insufficient preparation, and it does not cover problems with your own equipment or internet connection.

Two limits are worth knowing before you spend time on an application. The mark adjustment is capped at 5 per cent of the total marks, and it will not be used to move a learner from a fail to a pass. Applications must reach CQI within 14 calendar days of the result being issued to your provider, and a learner who has already had a reasonable adjustment cannot claim special consideration for the same circumstances.

Frequently asked questions about sitting the CQI IRCA ISO 27001 exam online

Where to go next: more ISO 27001 Lead Auditor exam preparation

Three companion pages are linked at the steps above — the IT requirements, the photo ID rules and the room rules. The fourth is what the remote proctoring records, and why: the three things captured, and what a flag actually means.

The full exam guide covers the paper itself, and the two assessments you must pass explains why the examination is not the only thing between you and the certificate.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.