Yes. The CQI and IRCA ISO/IEC 27001:2022 Lead Auditor online exam is open book . CQI’s own guidance for learners states that you may refer to notes from your training course, and that you will need a copy of the ISO management systems requirements standard for your course. You may not use the internet.

That is the awarding body’s position, taken from the guidance CQI and IRCA issue directly to candidates. It is worth stating plainly, because a good deal of published material on this subject is stricter than the rule actually is — including material from training providers.

What may you have with you in the open-book ISO 27001 Lead Auditor exam?

Why does some course material tell you the opposite?

If your training provider has told you that notes are not permitted, you have not been misled. You have been given a house rule rather than the awarding body’s rule.

Some providers, 3FOLD TRAINING among them, have told learners to take in nothing but a clean copy of the standard. The thinking is sound. Candidates who plan to look things up run out of time, and a stack of notes is a temptation to search rather than think. But it is stricter than what CQI and IRCA publish.

CQI’s published exam regulations define the CQI exam requirements, while your training provider may give you additional instructions for your particular sitting. Where a provider is stricter, ask whether that is the exam rule or its own advice, and read the exam guidance CQI sends with your login details. Rules of this kind are set by CQI and IRCA and can be revised. Confirm the position with your training provider, and read the exam guidance CQI issues to you, before your sitting.

Does open book make the exam easier?

This is the part candidates underestimate. An open-book exam is designed on the assumption that you have the book. The questions are not written to test whether you can find a clause; they test whether you can apply it.

Of the 80 marks on the paper, 56 sit in Domains 4 and 5, tested at the levels of apply and evaluate. CQI’s guidance confirms the last two sections are built on scenarios you must evaluate before choosing a course of action. No amount of looking things up answers a question about what an auditor should do next when the evidence shows one thing and the auditee says another. There is more on what each domain asks and how it is questioned.

The real risk of open book is time. You have 1 hour 45 minutes, or 2 hours 15 minutes with the additional time available where English is not your first language, for 40 questions. A candidate who looks up three clauses per question runs out of paper long before they run out of questions.

Can you go back and change an answer?

There is one piece of exam mechanics that matters more than anything on the permitted-items list, and it is easy to miss.

CQI’s guidance for learners is explicit: once you have answered a question and clicked Next, you cannot navigate backwards to review or change your answer. It is described as a security measure.

That single rule rewrites the standard exam technique. There is no coming back to a question you flagged and no final sweep at the end. If you are going to look something up, you look it up before you click Next.

It also means your book has to be set up before the day rather than searched on it. Which brings us to the useful part.

How should you prepare your copy of the standard?

Know where things live before you sit. The fastest lookup is the one you never make. Know which clause covers risk assessment, which covers risk treatment, and where the Statement of Applicability requirement sits, and you will barely open the book in Domains 1 to 3.

Know your way around it before the day. You want to reach Clauses 4 to 10 and the four Annex A themes without hunting. No CQI document addresses tabs or sticky markers either way; 3FOLD TRAINING’s own rule is that the copy you sit with is clean and unmarked, tabs included, so learn the structure rather than flagging it.

Keep annotations out of the standard. Your notes are permitted separately, so there is nothing to gain from writing in the margins — and some providers ask for a clean copy. Put the annotations in your notes.

Decide paper or digital in advance, and test it. A digital copy on a second screen is permitted. Check it opens without an internet connection and does not sit behind a login. You will not be able to go online to fetch it.

Bring less than you think. Permitted is not the same as useful. 200 pages of course handouts you have never indexed will cost you more time than they save.

What is definitely not allowed in the ISO 27001 Lead Auditor exam?

• Searching the internet for an answer.
• Mobile phones, tablets, smart watches, headphones or earphones in the room — possession alone is treated as malpractice.
• Communicating with anyone, in the room or outside it.
• Copying, photographing, recording or sharing any part of the exam, during or afterwards.
• Having exam questions or answers in your possession beforehand.

The exam is remotely proctored and the recording is reviewed afterwards. Our guide to what gets candidates disqualified from a CQI IRCA exam goes through the conduct rules in full, including the ones people break by accident.

Frequently asked questions about the open-book ISO 27001 Lead Auditor exam

Where to go next: more ISO 27001 Lead Auditor exam preparation

The complete CQI IRCA ISO 27001 Lead Auditor exam guide covers structure, timing and the sitting process. There is also a breakdown of how the ISO 27001 Lead Auditor exam pass mark works across the five domains.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.