Partial marks are given for all items. That is what the CQI and IRCA examination framework says, and it means a question worth three marks can return one or two rather than all-or-nothing. Whether a wrong selection costs you anything is a separate question, and no CQI document answers it.

What partial marking means in the CQI IRCA ISO 27001 exam

The examination framework says it in one line: partial marks are given for all items. Everything useful about this follows from taking that literally.

It means items are not all-or-nothing. The paper is 40 questions carrying 80 marks, so the average item is worth two marks and the heaviest are worth three. On a three-mark question asking you to identify three correct responses, getting two right returns marks rather than zero. That is the whole point of partial marking, and it is the reason a paper of 40 questions can produce a fine-grained score out of 80.

These figures come from the examination framework CQI and IRCA issue with the examination policies before the course. It is a document learners are given rather than one published on a website, so you will not find it by searching. It is not a secret, though, and knowing the shape of the paper is part of preparing for it.

Where the marks actually sit in the ISO 27001 Lead Auditor exam

Partial marking matters most where the marks are concentrated, and they are not spread evenly.

Read the last row carefully: the 40 is an overall pass mark in its own right, not a total of the minima. You have to clear every domain minimum and reach 40.

Two things follow. The domains covering the conduct and reporting of an audit carry 56 of the 80 marks between them, on items worth two and three marks each — so partial marking does most of its work exactly where the paper is heaviest. And because each domain has a minimum of its own, marks scraped together in one domain cannot rescue a shortfall in another. How the pass mark works goes into that.

Does over-selecting answers cost you marks in the ISO 27001 exam?

Here is the honest answer, and it is more useful than a confident one would be.

Course material written for this examination states that on a multiple-response question each wrong answer you select loses marks, with the item never taken below zero. The practical advice attached to it is: select exactly the number asked for, never more, because guessing extra answers reduces your score.

We cannot show you a CQI or IRCA document that says this. The framework says “partial marks are given for all items” and says nothing about deduction, negative marking, or a penalty for over-selection. We have looked. The claim may well be right — it is a common way to mark multiple-response items, and it would explain why the guidance exists — but as far as anything published goes, it is an interpretation rather than a stated rule.

We would rather tell you that than repeat it as fact, because you are about to make a tactical decision on the strength of it.

Why the advice on the ISO 27001 exam is right anyway

This is the part that resolves it, and it is worth doing properly rather than waving at. There are three ways a multiple-response item could be marked, and only one of them rewards over-selecting.

If wrong selections cost marks, over-selecting plainly hurts you. That is the interpretation the preparation material describes, and the one we cannot source.

If they cost nothing but the item is only credited when the count is right, over-selecting throws the item away.

If they cost nothing and the count is not checked, then here, and only here, an extra guess could earn a mark.

So the advice does not follow from certainty; it follows from the odds. Two of the three cases punish over-selection, one rewards it, and no account of this examination — CQI’s or anyone else’s — describes the third. Selecting more than you were asked for is a wager on the only marking scheme nobody has claimed is in use. Count the selections, match the number asked for, and move on.

What partial marking means for how you sit the ISO 27001 Lead Auditor paper

Partial marking and the navigation rule pull in the same direction, and together they set the technique.

Answer the parts you know. Partial marking means a question you cannot fully crack is still worth engaging with, and a blank item earns nothing at all.

Think about the last selection rather than defaulting either way. If a question asks for three and you are confident of two, a third guess is worth a mark if it lands. Whether it costs you anything if it does not is exactly the question above — so treat it as a judgement about how good the guess is, not as a free option.

Never exceed the number asked for, where the question gives one. Two of the three possible marking schemes punish over-selection, and no account of this examination claims the one that would reward it is in use.

Check the count before you commit, because you cannot go back and correct it. Miscounting is an easy way to lose marks you had already earned.

Watch the qualifiers. Best, most, first, not and except change what a correct set looks like, and on a partially marked item a misread qualifier can cost part of a question rather than all of it.

How partial marking interacts with the ISO 27001 exam domain minima

One consequence of partial marking is easy to miss.

Because each domain has a minimum of its own, marks are not fungible across the paper. A learner can be above 40 overall and still fail on a single domain minimum. Partial marking is what makes that arithmetic possible: it produces part-scores on individual items, so a domain total can land just under its minimum rather than obviously above or below it.

Two domains repay attention here. The one carrying the conduct of an audit is the largest, at 14 items and 36 marks against a minimum of 14. That is a lot of items to earn partial credit on, and a correspondingly large gap to fall into. And the reporting domain has the tightest minimum as a proportion of its marks: 8 out of 20. Partial credit spread across either can add up to a respectable contribution to your total while still leaving that domain short, and nothing elsewhere on the paper will rescue it.

What that means in practice is that a partly answered question is not a neutral event. It contributes to your total and to a domain minimum, and the domain minimum is the constraint most easily overlooked while you are watching the total.

Frequently asked questions about CQI IRCA ISO 27001 exam partial marks

Where to go next: more ISO 27001 Lead Auditor exam preparation

The navigation rule is what makes the selection count unforgiving, and the question types determine how you make a selection in the first place. The free mock exam is the place to practise both.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.