No accreditation body accredits an ISO 27001 Lead Auditor course. Accreditation attaches to a body that assesses other people, within a published scope. Related things can be accredited — the body that certificates people, or a certificate programme — but not a course. What a genuine course has is scheme certification and an approved provider.

One disclosure before the argument: we sell a CQI and IRCA certified course, so we have an interest in how this word is used. Everything below is checkable on the accreditation bodies’ and scheme owners’ own pages, which are linked. Where a link goes to an ISO catalogue entry, note that the standard itself is behind a paywall, so the entry confirms the title and status rather than the text.

What does accreditation actually mean for an ISO 27001 Lead Auditor course?

The confusion here is not the reader’s fault. Two words that mean different things are used as though they were interchangeable, and very little course marketing does anything to resolve it.

The national accreditation bodies define it themselves, and the UK body sets both terms out side by side. Accreditation, in their account, is formal recognition of the technical and organisational competence of a conformity assessment body — a laboratory, an inspection body, a certification body. It is granted to carry out a specific service, as described in that body’s scope of accreditation. Certification is the different thing: written assurance that a product, process, system or person conforms to specified requirements.

Two consequences follow, and they settle most of the question.

• Accreditation attaches to an organisation that assesses other people, not to a course, a certificate or a person. A course is not a conformity assessment body, so it is not the kind of thing that can be accredited.
• Accreditation is always bounded by a scope. A body is accredited for named schemes, listed on a published schedule. “We are accredited” without a scope is an incomplete statement even when it is true.

The three things confused with accreditation in ISO 27001 Lead Auditor training — and who uses the word loosely

Misuse of the word almost always comes down to one of these three being mistaken for another.

One: accreditation of certification bodies that certify organisations to ISO 27001. When a company says it is “ISO 27001 certified”, a certification body audited it, and that body may itself be accredited by a national accreditation body against the standards for management-system certification. This is the accreditation the word usually refers to elsewhere. It has nothing to do with training.

Two: accreditation of bodies that certify people. A body that certificates individuals can be accredited against the international standard for certifying persons. This is real and it exists in this market: PECB’s ISO/IEC 27001 Lead Auditor scheme is named on the UK accreditation body’s published schedule for personnel certification, which you can read yourself. But note what is accredited — the certifier, for a named list of schemes. Not the training. The point of that separation is structural: the body certificating the person is assessed on how it certificates, not on who taught them. How that scheme compares with ours is a longer question.

Three: certification by a scheme owner. This is what a CQI and IRCA certified course is. A scheme owner publishes a specification, assesses the course against it, approves the provider delivering it and puts both on a register. Other schemes arrange it slightly differently. Exemplar Global certifies the training provider and its examiner against published competency units, and then certifies a course as meeting those units. The principle is the same, and so is the checkability. None of it is accreditation.

That last point is worth evidencing rather than asserting, and the evidence cuts in an unexpected direction. Exemplar Global’s rules for its own training providers state: “In all advertising, the word ‘certified’ shall be used; the word ‘accredited’ shall not be used.” One scheme owner, telling its own partners the word is wrong.

But do not read that as one side being careful and the others careless. CQI and IRCA publish no such instruction, and are looser with the word themselves: their own page for training partners speaks of “courses bearing our accreditation”. The CQI separately accredits university learning programmes and degrees. That is a professional body endorsing a syllabus rather than a national accreditation body recognising a conformity assessment body — a good illustration of how much work this one word is asked to do. We sell a CQI and IRCA certified course, and we are telling you that our own scheme owner uses the word in a way its competitor rules out for its partners.

That is the real state of this market: the word is used loosely almost everywhere, including by people entitled to be precise. Which is why the test below is not “is it accredited”. It is “accredited by whom, against what standard, for what scope” — a question with a good answer, a bad answer or no answer, and you can tell which within a sentence.

Is any part of ISO 27001 Lead Auditor training ever accredited?

Yes, and pretending otherwise would be as misleading as the marketing this page is correcting.

There is a standard for certificate programmes — ANSI/ASTM E2659, covering programmes that assess learning outcomes and issue a certificate — and a body can be accredited against it as a certificate issuer. That is a real accreditation of a real thing, and it is held in this market: PECB lists it alongside its personnel-certification accreditations. The accrediting body itself explains why certification and a certificate programme are two different things. Be precise about what that accredits, because it is the nearest thing in this market to an accredited course. The accrediting body describes it both ways — as accrediting the certificate issuer, and as accreditation for certificate programmes — and what it assesses is how a programme that issues certificates is designed, administered and kept sound. It says nothing about the syllabus, nothing about who marks the paper, and nothing about whether the certificate leads to an auditor credential. If a provider cites it, that is a proper answer to “accredited for what?” — and you can then judge whether it is the assurance you were actually after.

Separately, a training company can hold management-system certification of its own, to ISO 9001 or to a learning-services standard, from a certification body that may itself be accredited. That says something about how the company is run. It says nothing about whether the course leads to a recognised auditor credential, which is the question you were asking.

The test that cuts through all of it: ask what the accreditation is of, and for which scope. A provider who cannot answer that in one sentence is not describing an accreditation.

ISO 27001 Lead Auditor course accreditation claims you will actually see, decoded

Four phrases do most of the work in this market. None is necessarily wrong, but all of them are easy to misread.

• “Accredited course” — not a thing, as above. Ask what body, what standard, what scope. Where there is an answer at all, it is often scheme certification — worth having, and not accreditation.
• “Internationally recognised” — means nothing on its own, because no one issues international recognition. Recognition is what employers, tenders and certification bodies do, and the way to test it is to search the job adverts and tenders in your own sector.
• “CPD accredited” or “CPD certified” — points to a commercial CPD service having reviewed the course so that attendance can be logged for professional development. It is a real service, and it says nothing about whether the course leads to an auditor credential.
• “ISO certified course” — ISO writes standards and certifies nobody. If the provider means it holds ISO 9001 certification as a company, that is about how the business is run, not about the course.

How to check an ISO 27001 Lead Auditor course is genuine?

Four questions, in order. Any provider selling a genuine course answers all four without hesitation, and you can verify every one of them yourself.

• Who owns the scheme, and is the course certified by them? For our course the answer is CQI and IRCA. Ask for the scheme owner by name, not for a logo.
• What is the course identification number, and what is the full course title in the specification? A certified course has both, and an approved partner should be quoting them. A vague answer here is the clearest warning sign on the list.
• Is the provider an approved partner, and what is its partner number? Then look it up. CQI and IRCA publish a searchable directory of certified courses and approved partners; you can search it by provider name or by course reference without an account.
• Who sets and marks the examination? On the CQI and IRCA route the answer is CQI and IRCA, not the training provider. If the answer is the provider, that may still be a legitimate scheme — but you should know it before you book, not after.

What a non-certified ISO 27001 Lead Auditor course does and does not get you?

A course that is not certified by any scheme owner is not automatically a bad course. It may be taught by someone excellent. The limits are specific, and they are worth knowing before rather than after.

• It does not satisfy the training requirement for a professional auditor grade. Each scheme names the training that satisfies its own requirement, and a course certified by nobody is not on any of those lists — and even a certified course only satisfies the training component. Passing does not make you a certificated auditor; the grade is applied for separately, on experience.
• Nobody has checked the content against a specification, so the syllabus, the hours and the assessment are whatever the provider decided.
• The certificate means what the provider says it means, which is a different thing from meaning the same to everyone who reads it.
• You cannot verify it on anyone’s register, because there is no register to verify it on.

If what you want is knowledge, none of that need trouble you. If what you want is a credential a tender or an employer will recognise, all four matter, and the fourth is the one that bites when someone asks you to prove it. How to verify a CQI and IRCA certificate online shows the other end of the same check.

Frequently asked questions about accredited vs non-accredited ISO 27001 Lead Auditor courses

Where to go next: more on the ISO 27001 Lead Auditor course

If you are choosing between schemes rather than checking one provider, IRCA compared with Exemplar Global sets out how those two are built, and the internal auditor comparison covers the other course readers weigh against ours. The full route to certification shows where a certified course sits in the longer journey.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.