There are two assessments on the ISO 27001 Lead Auditor course, not one. Continuous assessment — the specification calls it continual — runs through the course and is judged by your tutor. The CQI and IRCA examination is sat separately afterwards. You must pass both, alongside full attendance, for a Certificate of Achievement.

What the CQI IRCA specification actually requires for an ISO 27001 Lead Auditor course

PR373, the course specification CQI and IRCA publish for this course, sets out what completing it means. It is three conditions rather than one.

Attend the whole course.

Pass the continual assessment, which is directed at the course’s learning objectives.

Pass the examination. The specification does not set the window; CQI and IRCA’s guide for learners does, and it gives you 30 days from the last day of your course.

Notice which of those attracts the attention. The examination does, because it happens on a date and it produces a mark. The assessment running through the course is the one nobody warns you about, and it is the one you are being judged on while you think you are just doing the exercises.

What continuous assessment on the ISO 27001 Lead Auditor course involves

The word in the specification is continual, and you will also see continuous — including on the record sheet the outcomes are kept on. They mean the same thing here: assessment distributed through the course rather than concentrated at the end.

In practice it is a series of assessed activities across the course, each with a defined brief, each producing an outcome recorded against your name. On our ISO 27001 Lead Auditor course there are seven, and they follow an audit rather than sampling a syllabus. An audit initiation checklist. A review report from the first stage. An audit plan and checklist for the second. A simulated audit, run over two parts. Writing nonconformity reports. A simulated closing meeting. Evaluating a corrective action response. A simulated opening meeting is assessed alongside the seven.

Three things about how it is run are worth knowing before you arrive.

It is not a paper exercise you can coast through. Each activity is built with a marking scheme and a model answer released afterwards, so there is a defined standard and a record of whether you reached it. It is judged, not merely observed.

Participation is part of it. Some activities produce a working document of your own and some are team simulations. The specification asks that courses be designed so individual and team activities together cover the elements of the standard, which is why both appear. A learner who attends but contributes nothing to the simulations is not evidencing the things being assessed, and the record will show that.

There is a review at the end. The course closes with the tutor going through each learner’s outcomes on the record and agreeing any remediation. You should not leave the course uncertain where you stand; if you are, ask.

Why the ISO 27001 Lead Auditor course is assessed this way

Not arbitrarily. The examination is machine-marked, so there are things it structurally cannot test.

It cannot watch you conduct an opening meeting. It cannot see whether you ask a follow-up question when an answer sounds plausible, whether you stay on the evidence when an auditee pushes back, or whether you can write a finding a director will argue with. The question types are the ones a computer can score, and that is a real constraint on what 80 marks can measure.

Continual assessment is where those things are assessed instead. Which means the two assessments are not duplicates with different formats — they test different halves of the same competence, and that is why passing one does not substitute for the other.

Which ISO 27001 Lead Auditor certificate each outcome earns

This is the part worth reading carefully, because the certificates are different documents that mean different things.

Attend the whole course and pass both assessments and you receive a Certificate of Achievement. That is the certificate satisfying the CQI and IRCA training requirement, and the one that matters for a later application. It is worth being clear about what it is not: the course and the examination are the training component, and passing does not make you a certificated auditor. The grade is applied for separately and decided on the audit experience you build afterwards.

A learner who attends and participates fully but does not pass the assessment requirements may be issued a Certificate of Attendance instead. The rules require it to be clearly distinguishable from a Certificate of Achievement, and the reason is obvious: it records that you were there, not that you met the standard. It does not satisfy the training requirement.

There is a limit on the Certificate of Achievement that people miss. It is valid for five years for the purpose of meeting the training requirement, and the training partner is obliged to tell you so in writing.

What is not written down anywhere about ISO 27001 Lead Auditor assessment

Two questions have no published answer, and we would rather say so than invent one.

What happens if you pass the continual assessment and fail the examination? The certificate rules cover it in one direction: a Certificate of Attendance may be issued where the assessment requirements are not met. What they do not set out is what a learner in that position should do next, beyond the fact that resits exist and carry a fee.

And what happens to the assessment if you resit? Nothing we can find states whether the continual assessment stands or whether the 30-day window restarts. On the number of resits there is a published rule, but it is written for the paper-based examination — one retake, within twelve months, with a failed resit meaning the whole course again. This course uses the online examination, which is governed separately and carries no equivalent rule we can point to.

Ask your provider before you book, and ask for the answer in writing. It is a fair question and the answer should not have to be improvised.

How continuous assessment and the exam differ in practice

Set side by side, they test different things in different ways, and knowing which is which tells you how to prepare for each.

The examination figures above come from the framework CQI and IRCA issue with the examination policies before the course.

How to prepare for ISO 27001 Lead Auditor continuous assessment

Preparation for the examination is well covered; preparation for the assessment is not. It comes down to four things.

Arrive knowing the standard. The first assessed activity comes early, in the second module, so a learner still learning ISO/IEC 27001 at that point is being assessed on work they are not yet equipped for.

Attend all of it. Full attendance is a condition in its own right, and the activities follow one audit from initiation to corrective action, so missing a session can mean missing an assessed activity. The specification does require tutors to provide an opportunity to complete further tasks where a learner has not met the standard, but that is a remedy rather than a plan.

Contribute to the simulations. They are where the interviewing, the evidence-gathering and the closing meeting are assessed, and none of that can be judged from someone who watched.

Read the model answers when they are released. They are the standard the activity was marked against, made visible — the clearest statement you will get of what a good audit output looks like, from someone who has just seen yours.

That last point is the one worth acting on. The continual assessment is not only something to get past: it is the one place where somebody tells you where your audit work falls short while there is still time to do something about it.

Frequently asked questions about ISO 27001 Lead Auditor continuous assessment

Where to go next: more ISO 27001 Lead Auditor exam preparation

What the course assumes you already know is what the assessed activities are built on, and the navigation rule is where preparation for the other half starts. The full route to certification shows what the Certificate of Achievement is for.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.