You can resit, and resits are arranged through your training provider. Without an examination pass no Certificate of Achievement is issued, though a Certificate of Attendance may be. Before you book a resit, check two routes that close in 14 calendar days.

Those two routes are special consideration, if something outside your control affected the sitting, and an appeal, if you believe the result is wrong. Both deadlines are 14 calendar days, and the special consideration clock starts when your provider receives the result, not when you do — so it may already be running. Why the date your result issues matters sets that out.

What follows is drawn from the CQI and IRCA policies issued to learners before the course, from the specification the course is certified against, and from the rules governing approved training partners. Where those documents are silent, this page says so rather than filling the gap.

Your three options after failing the ISO 27001 Lead Auditor exam, side by side

The two with deadlines are also the two least likely to succeed, and it is better to be plain than encouraging. Special consideration can move your mark by at most four marks on an 80-mark paper, and CQI states it will not lift a low mark from a fail to a pass. A free resit is offered only where CQI’s own assessment system failed, not where your equipment or connection did. And connectivity and equipment problems are excluded from the appeal route against a fail result altogether. The full rules on appeals and special consideration set out what evidence carries each.

Can you resit the CQI IRCA ISO 27001 exam? What is published, and what is not

What is published is short. Resits exist. The rules governing approved training partners record that CQI charges the training provider an examination fee for learners registered to resit online, invoiced monthly.

What nothing in the CQI and IRCA documents settles matters more than what they do. There is no published limit on the number of resits, no stated waiting period, no statement of whether the 30-day sitting window restarts, and no statement of whether the continual assessment stands or has to be repeated. Nor do the documents say who arranges the sitting, beyond the fee being charged to the provider. Providers answer these in their own ways, so get yours in writing.

Six questions to put to your provider in writing, now:

• How many resits will you arrange, and is there a limit?
• How soon can I sit again, and does a waiting period apply?
• Does the 30-day sitting window restart, or am I working inside the original one?
• Does my continual assessment result stand, or does any part of the course have to be repeated?
• What does the resit cost me? CQI invoices you for the examination fee — do you absorb it, pass it on at cost, or add an administration charge?
• Will I be told my marks by domain, so I know what to work on?

Which assessment did you fail on your ISO 27001 Lead Auditor course?

Two assessments stand between you and a Certificate of Achievement, and it is worth knowing which one you missed. The continual assessment runs through the course and is judged by your tutor across the assessed activities. The examination is set and marked by CQI and IRCA and sat afterwards. Passing one does not carry the other.

This page is about the examination. If the shortfall was in the continual assessment, that is a conversation with your tutor and your provider rather than with CQI and IRCA, and the remedies are different — what the continual assessment asks of you covers it.

Overall mark or domain minimum: which one did you miss in the ISO 27001 exam?

You must score at least 40 of the 80 marks overall, and reach the minimum mark set for every one of the five domains. Miss either test and you have not passed.

Those are different failures needing different preparation. A candidate can be comfortably over 40 marks overall and still fail on one domain minimum, or a few marks short overall with every domain met.

Ask your provider what your result statement shows. If it reports marks by domain, start there. If it reports only a pass or a fail, say so when you ask — the domain breakdown is the thing worth pressing for, because without it you are guessing at what to change.

The pass mark page sets out both tests and the domain breakdown gives the marks and the minimum for each. These figures come from the examination framework CQI and IRCA issue with the examination policies before the course. It is a document learners are given rather than one published on a website, so you will not find it by searching. It is not a secret, though, and knowing the shape of the paper is part of preparing for it.

Certificate of Attendance: what you get if you fail the ISO 27001 Lead Auditor exam

The rules governing approved training partners provide for a Certificate of Attendance, which may be issued to a learner who satisfied the attendance requirement and participated fully but did not pass the assessment requirements. It must be clearly distinguishable from a Certificate of Achievement. The rules do not spell out what it is worth, but the inference is hard to avoid: the training requirement is met by successful completion, and a certificate that records participation without a pass does not evidence that.

So it is not a lesser version of the credential but a different document, recording that you were there and took part. The Certificate of Achievement is the one that carries the training requirement, for five years.

What none of the published CQI and IRCA documents sets out is a distinct route for a learner who passed the continual assessment and failed the examination, beyond the fact that resits exist and are charged for. That is a gap in the published material rather than a secret, and the practical answer is the same: ask your provider what it does, and get it in writing.

One thing to be clear about, because it is easily blurred in the other direction too: passing the examination does not by itself make you a certificated auditor. It satisfies the training requirement, which is one part of a separate application to CQI and IRCA.

Preparing differently for the ISO 27001 Lead Auditor resit, rather than preparing again

If the first attempt did not work, more hours of the same preparation is an unpromising plan.

Domain 1 is the only one on the paper that tests recall — definitions, structures, principles — and a shortfall there does respond to reading. Domains 2 and 3 are set a level higher: they test whether you can apply the material to a situation rather than restate it, so treat them more like the scenario domains than like reading. The three carry 24 marks between them.

Domains 4 and 5 carry 56 of the 80 marks and are built on scenarios. If your shortfall is there, more reading is unlikely to move it. What tends to move it is timed scenario practice with the reasoning written down — naming the requirement and the objective evidence every time, rather than grading on impression.

• Score in marks, not in questions. The minima are set in marks and questions are worth 1, 2 or 3, so a candidate counting questions right does not know where they stand.
• Pace to the weighting. The published time allocation gives Domains 4 and 5 seventy-five of the paper’s 105 recommended minutes. Time spent at the front is taken from there.
• Practise deciding once. The paper does not let you return to an answered question, so any technique built on revisiting is unusable.

One more thing to check before a second sitting. If English is not your first language and you sat without the additional half hour, the extra 30 minutes is a reasonable adjustment you can request — before the course or the resit is arranged, not after.

A full 40-question mock exam, sat in one go under timed conditions and marked domain by domain, will tell you more about a second attempt than any amount of re-reading.

Frequently asked questions about failing the ISO 27001 Lead Auditor exam

Where to go next: more ISO 27001 Lead Auditor exam preparation

The appeals page, the results page, the certificate validity page and the continual assessment page are all linked at the relevant points above. One more is worth having: the exam guide covers the paper itself.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.