You pass the CQI and IRCA ISO 27001 Lead Auditor exam by scoring 40 of the 80 marks, which is 50 per cent. You must also reach the minimum mark set for each of the five domains. Those are two separate tests, and clearing one while missing the other is a fail.

Most published summaries stop at 50 per cent. That is the half of the rule that is easy to remember and the half that is least likely to catch you out.

What are the two tests you have to pass in the ISO 27001 Lead Auditor exam?

You must score at least 40 of the 80 marks overall, and reach the minimum mark set for every one of the five domains. Miss either test and you have not passed.

The domain minimums are set out in the CQI and IRCA Lead Auditor Exam Framework as absolute marks, not percentages:

Notice that the domain floors are not all 40 per cent. Three sit at 37.5 per cent, one at 38.9 and one at 40. Some course material rounds all five to “40 per cent in each domain”. That is a fair shorthand, but it is slightly harsher than the published rule in four of the five domains. Work from the marks.

Do the domain minimums add up to a pass?

Add the five minimums together: 3 + 3 + 3 + 14 + 8 = 31 marks.

You need 40.

So a candidate who scrapes the floor in every single domain finishes on 31 of 80 and fails, 9 marks short, having technically satisfied every domain requirement. The domain minimums are not a route to a pass. They are a check that you are competent across the whole audit process rather than strong in one part of it.

Two worked examples of the ISO 27001 Lead Auditor pass mark

Candidate A scores 5, 5, 5, 20 and 10 — 45 marks. That is above 40 overall, and every domain is above its floor. Pass.

Candidate B scores 7, 7, 7, 12 and 15 — 48 marks. That is a better overall score than Candidate A. But Domain 4 needed 14 marks and B managed 12. Fail, on a single domain, while sitting 8 marks clear of the overall pass mark.

Candidate B’s shape is the one to guard against, and Domain 4 is where it happens. Not because Domain 4 is harder. It carries 36 of the 80 marks, and its floor is the largest single block you have to find anywhere on the paper. You cannot compensate for Domain 4 elsewhere. CQI and IRCA publish no outcome data, so treat that as reasoning from the mark structure, not as a statistic.

Where do the marks actually sit?

Domains 4 and 5 carry 56 of the 80 marks between them — 70 per cent of the paper. Domains 1, 2 and 3 carry 24 marks in total. If you sat the paper and answered Domains 1 to 3 perfectly and nothing else, you would score 24 and fail on every count that matters.

This is why the published time guidance gives 45 minutes to Domain 4 and 10 minutes each to Domains 1, 2 and 3. There is more on what each domain covers and how it is questioned.

How does ISO 27001 Lead Auditor exam marking work?

Questions are worth 1, 2 or 3 marks depending on the domain. Partial marks are given for all questions, so a partly-correct multiple-response answer earns something rather than nothing. CQI publishes no rule deducting marks for a wrong selection. A multiple-response question where you identify two of three correct answers earns something rather than nothing.

On any question that asks you to choose several answers, select exactly the number asked for. That is the safe rule whatever the marking scheme does with extra selections.

Because questions carry different values and partial marks apply, there is no number of questions that equals a pass. Two candidates can get the same number of questions right and finish with different marks. Plan in marks.

What else do you have to pass?

PR373 sets three conditions. You must attend all elements of the course, be judged competent across the assessed activities during it, and pass the CQI and IRCA examination afterwards. Meet all three and you receive a Certificate of Achievement; attend and take part but fall short on the assessment and a Certificate of Attendance may be issued instead. It is successful completion of the whole course, not the exam on its own, that satisfies the IRCA training requirement.

Candidates sometimes assume the exam is the only hurdle and treat the course as attendance. It is not. On a CQI and IRCA certified lead auditor course, the assessed activities during the training are a real assessment with a real standard to meet. Your tutor judges them as you go.

What score should you aim for in the ISO 27001 Lead Auditor exam?

Aiming for the pass mark is a bad plan, because the pass mark is the line you fail at if anything goes slightly wrong on the day. A sensible target sits clear of every floor with room for a bad question or two.

That target set is 3FOLD TRAINING’s own guidance for planning revision, not a CQI and IRCA rule. It is built by taking each domain a clear distance above its floor. The useful part is not the numbers but the margin over each floor: 8 marks of it in Domain 4 and 4 in Domain 5. Those are the two domains no other part of the paper can rescue, so that is where the margin has to be real.

Is the pass mark ever adjusted?

Only through CQI’s own special consideration process, and only narrowly. Where a learner’s performance was affected by something outside their control, CQI may make a small post-exam adjustment, capped at 5 per cent of the total marks available. It may also offer a free resit where its own assessment system caused a significant technical problem. CQI states plainly that it will not adjust a low mark far enough to move a fail into a pass. Equipment or internet problems at the learner’s end are not grounds. There is no curve and no scaling.

Frequently asked questions about the ISO 27001 Lead Auditor exam pass mark

Where to go next: more ISO 27001 Lead Auditor exam preparation

The full CQI IRCA ISO 27001 Lead Auditor exam guide covers the sitting process, conduct rules and what happens after your result. If you want the shorter answer on paper size, see how many questions are on the exam.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.