PECB certificates the person, examines at the end of a training week or on its own, and its certification credentials are based on the applicable professional experience, information security management experience, and audit activity requirements. .

A note on how this page is written. Everything said here about another scheme comes from that scheme’s own published material, and where it has a genuine advantage the page says so. We deliver the CQI and IRCA course, so read this as an interested account — and check the linked sources rather than taking ours or anyone else’s word for it.

What are you comparing when you compare CQI IRCA and PECB ISO 27001 Lead Auditor certification?

Start with the thing most comparisons skip. A training course and a credential are two different products, and the schemes divide them differently. Ask for any option: who writes the examination, who marks it, what the certificate actually says you have done, and what you must show afterwards to hold a professional grade. Answer those four and the comparison stops being a matter of taste.

On both routes those four answers are published, and they are not the same answers. Set out side by side, the differences are structural rather than cosmetic.

What does each scheme guarantee about the ISO 27001 Lead Auditor course?

This is the difference that gets least attention and matters most, because it decides how much of what you are sold is fixed and how much is up to the provider.

On the CQI and IRCA route the course is the certified object. The ISO 27001 Lead Auditor course is delivered against PR373, the course specification issued by CQI and IRCA. That document sets the learning outcomes, the indicative duration of 40 hours, the assessment method, and what the course is and is not permitted to teach. A partner cannot shorten it, restructure the assessment, or turn it into a walk through the standard, because those things are specified rather than suggested. Separately, the partner itself is approved and holds an identification number, and both the approval and the course certification can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners.

PECB’s structure inverts that. What PECB certifies is the person. Its published position is that no specific course or curriculum is required as part of the certification process, and its handbook lists the examination as a standalone purchase. Training exists to prepare you for the examination rather than as the certified object in its own right.

Neither design is wrong, and they answer different questions. If your concern is what will I be taught, and can the provider vary it, a specified course answers that directly. If your concern is can I be examined without buying training, the other design answers that instead.

How do the CQI IRCA and PECB ISO 27001 Lead Auditor exams compare?

On the CQI and IRCA route the examination is set, delivered and marked by CQI and IRCA rather than by the training provider.It is taken online after the course within 30 days, with the current examination format, scoring and pass requirements set out in CQI and IRCA’s examination guidance provided for the course. It is an open book, and it is closed to going back: once a question is answered it cannot be revisited. Those figures come from the examination framework CQI and IRCA issue with the examination policies before the course, rather than from a public page, so you will not find them on their website. How the exam is structured sets out the sitting in full, and how the pass mark works explains the domain minima.

PECB publishes its format in its own candidate handbook: an 80-question, open-book examination with a 70% pass mark. Its course page places the examination on the final day of the training week, and the handbook adds that candidates may take it without attending the course at all.

One thing worth knowing if you are comparing published figures. This examination has been moving from an essay format to multiple choice, and the earlier handbook is still published alongside the newer one, describing a different paper. Neither is hidden, and each is right for the format it describes. If a number matters to your decision, take it from the handbook matching the format you will sit, and confirm it with the provider before you book.

Two structural points follow from the timing. Sitting the examination on the last day of the course means the material is at its freshest, which is a real advantage. Sitting it in a separate window afterwards means you can prepare deliberately and choose your day inside that window. Which suits you is a matter of temperament, and neither is the harder arrangement in itself.

What a failure costs differs too, and here PECB’s published terms are the more generous: its course page offers a free retake inside twelve months. On the CQI and IRCA route the 30-day window from the last day of training is the constraint to plan around, and a resit is a separate sitting. If you think a first attempt may not go well, that difference is worth pricing.

CQI IRCA vs PECB ISO 27001 Lead Auditor grades: hours, or audits led?

Here the two schemes measure genuinely different things, and this is the part of the comparison most likely to matter to whoever is paying.

PECB publishes its grades on the same page as its course, which makes them easy to check. They run from a provisional grade needing no experience at all, through grades requiring stated years of professional experience and of information security experience, together with a stated total of audit activity hours. The qualifying activities are broad. Planning, interviewing, managing an audit programme, drafting reports and non-conformity reports, reviewing documented information, on-site auditing, following up non-conformities and leading an audit team all count towards the same total. PECB describes its certification process as a separate application made after the examination, with referees contacted to validate the experience claimed.

CQI and IRCA count differently. Their auditor grades are expressed in complete audits covering the whole audit cycle, audit days and days on site, rather than in a single pooled figure. At the lead auditor grade they additionally require a number of full audits conducted as leader of an audit team, each with its own minimum days. The effect is that the record has to show whole audits, the required proportion of audit days counted as on-site time, and — to lead — responsibility actually taken. Leading an audit team and auditing on site both count towards PECB’s total, but neither has a minimum of its own, so the required hours can in principle be reached without either.

We think counting whole and led audits is the stronger design for a lead auditor credential, and it is worth saying why rather than asserting it. What an audit client is buying is judgement exercised across a whole engagement — opening meeting to closing meeting, with the awkward conversations in between. A measure built from complete audits and from audits actually led tests that directly. Both sets of criteria are published: PECB’s on the page linked above, and CQI and IRCA’s on their own pages for the lead auditor grade and the auditor grade. The argument is checkable rather than something you have to take from us.

One thing is common to both, and it is the point that most often gets lost. Passing does not make you a certificated auditor on either route. The course and the examination are the training component; the grade is applied for separately and decided on the experience evidence. How to apply for CQI and IRCA auditor grade membership covers the application on our side, and what the course assumes you already know covers the other end of it.

Is CQI IRCA or PECB ISO 27001 Lead Auditor certification accredited? The honest position

This is where a comparison can turn into a shouting match, so here is the accurate version, including the part that favours the other scheme.

PECB’s ISO/IEC 27001 Lead Auditor scheme is named on the United Kingdom Accreditation Service’s published schedule of accreditation for the certification of persons. You can read the UKAS schedule itself rather than taking it from PECB or from us, and it is a real accreditation of the body that certificates the person.

CQI and IRCA operate a different mechanism. They are a professional body rather than a certification body accredited by anyone: they certify courses against a specification, approve the partners that deliver them, and certificate auditors against published criteria. That is not accreditation of a personnel certification body, and it should not be described as though it were. What it gives you instead is a specified course, an approved and identifiable provider, and a professional register, each of which you can check independently.

There is more, and it goes the same way. PECB also publishes an accreditation as a certificate issuer under a standard for certificate programmes — which is the closest thing in this market to a training-related accreditation, and still not an accredited course. That distinction is worth ten minutes before you spend money on either route.

Two things follow. First, be sceptical of anyone on either side who uses “accredited” loosely; the word is doing less work than it appears to. Second, accreditation of a certification body is always scheme-scoped. A blanket claim that a body’s certifications are accredited is worth reading against the individual schedule, because scopes list named schemes and not everything a body offers appears on them.

What does CQI IRCA or PECB ask of you after the ISO 27001 Lead Auditor course?

A comparison that stops at the examination has stopped too early. The credential is the part you live with, so it is worth knowing what maintaining one costs in effort on each side.

PECB publishes a maintenance policy setting out a defined cycle: certification valid for a fixed period, a required volume of continuing professional development inside it, and a charge for maintaining the credential. Having it written down in one document is a genuine advantage — you can see exactly what is expected. Two details in it are worth reading rather than assuming. The charge is described as annual and the rate is tabulated per three-year cycle, so read the table rather than the name. And the policy sets out a consequence most people do not expect. Where the charge goes unpaid, or the development hours are not submitted or are insufficient, the credential can be downgraded to a lower one rather than simply lapsing.

CQI and IRCA also require you to maintain and evidence competence through continuing professional development. Their approach is to ask you for evidence that your competence remains up to date rather than to count points and hours. That is less mechanical and, for some people, less convenient: there is no number to tick off. If you have read a figure for IRCA CPD hours somewhere, check it against what CQI and IRCA publish now rather than relying on it.

What it costs to keep differs too, and this is the one place where a straight comparison is genuinely hard to make. Both bodies charge to apply and to maintain; the amounts vary by grade and by country, they change, and on neither side are they published alongside what the course itself costs. Ask for the whole three-year total in writing before you choose, on either route.

Which ISO 27001 Lead Auditor certification does your market ask for: CQI IRCA or PECB?

This is the question that decides it in practice, and it is one you can answer yourself.

• Look at the job adverts and tender documents in your own sector and region. Search them for the credential names. Whichever one appears is the one your market is asking for, and no argument about scheme design outranks that.
• Ask the certification body you hope to audit for, if that is your aim. Under the standards governing them, certification bodies determine their own auditors’ competence, so their published requirements are the authority on what they will accept.
• Check what your employer already recognises. If there is an existing management-system programme, there may already be a house answer, and matching it is worth more than a marginal difference in scheme design.

We are not going to name the winner of that search, because we sell one of the two and because the answer differs by region and by sector. Run it yourself. It settles the question more reliably than anything on this page.

When is PECB the better ISO 27001 Lead Auditor choice?

A fair comparison should be able to answer this, so: if the credential named in the tenders you are bidding for is the other one, take the other one. If you need to be examined without buying training, our route cannot do that and theirs can. And if a single training week with the examination inside it is the only way you will get the time signed off, that is a practical reason and not a small one.

Where we would argue for our own route is on how it is built. A course specified so that a provider cannot vary what you are sold. An examination set outside the organisation you paid. And a lead auditor grade that asks for audits actually led rather than a pooled figure. All three are checkable before you book.

Frequently asked questions about CQI IRCA vs PECB ISO 27001 Lead Auditor certification

Where to go next: more on the ISO 27001 Lead Auditor course

What “accredited” actually means for a course is worth ten minutes before you spend money either way. How the lead auditor qualification differs from an internal auditor course is the next distinction worth understanding, and the full route to CQI and IRCA certification sets out what follows the course.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.