The CQI and IRCA ISO 27001 Lead Auditor exam has 40 questions worth 80 marks, sat in 1 hour 45 minutes. They divide across five domains as 6, 6, 6, 14 and 8 questions. The questions are not worth the same, so the mark split matters more than the count.

The examination is administered by CQI and IRCA and the online exam is computer-marked, not marked by your training provider. 3FOLD TRAINING prepares you for it and registers you to sit it; it does not write or mark the paper.

How do the 40 questions divide up?

Five domains, and a deliberately uneven split:

That table is the whole answer, but the interesting column is not the one most people look at.

Why is the question count the wrong number to plan around?

40 questions carry 80 marks, so the average is 2 marks a question. But the values are fixed by domain, not spread evenly: 12 questions are worth 1 mark, 16 are worth 2, and 12 are worth 3.

Question values are fixed by domain and published in the exam framework:

• Domains 1, 2 and 3 — each contains two 2-mark questions and four 1-mark questions.
• Domain 4 — eight 3-mark questions and six 2-mark questions.
• Domain 5 — four 3-mark questions and four 2-mark questions.

So a Domain 4 question can be worth three times a Domain 1 question. Put another way: 18 of the 40 questions decide only 24 of the 80 marks, and the 22 questions in Domains 4 and 5 decide 56.

Candidates who plan by question count end up giving equal attention to every question. Candidates who plan by marks give Domain 4 the time it is worth. The published time guidance agrees with the second group: 10 minutes each for Domains 1 to 3, 45 minutes for Domain 4, 30 minutes for Domain 5.

What does a question actually look like?

The format changes across the paper, and it changes for a reason.

In Domains 1 to 3 a question may be attached to a situation — a brief description of an event, tied to that one question. Scenarios are not used in these domains.

In Domains 4 and 5 every question is built on a scenario: a longer description with real context, which several questions may draw on. Each question still stands alone. You never need to have answered an earlier question correctly to answer a later one, and there is no running thread you can lose.

Across the whole paper, questions come in five computer-marked formats: multiple choice, multiple response, fill in the blanks, matching, and sequencing. The last three are drag-and-drop.

How are the questions marked?

Partial marks are given for all questions, so a partly-correct multiple-response answer earns something rather than nothing. CQI publishes no rule deducting marks for a wrong selection. All questions are computer-marked.

So the safe approach is simple. On any question that asks you to choose several answers, select exactly the number asked for. If a question asks for three, give three.

One further rule shapes how you work through the paper: once you answer a question and click Next, you cannot go back to it. There is no final review pass. That is worth knowing before you sit rather than discovering on the day.

Is the question count the same for everyone?

For the current online ISO/IEC 27001:2022 Lead Auditor exam, the published structure is 40 questions worth 80 marks.

There is one related paper with a different shape. The Auditor Conversion exam is taken by auditors already qualified in another management-system scheme. It runs to 34 questions and 72 marks in 1 hour 35 minutes.The Auditor Conversion exam has a separate structure of 34 questions worth 72 marks, with Domain 2 not included because generic audit requirements are excluded from the conversion assessment. The overall pass mark moves with it, to 36 of 72 — still 50 per cent.

If you are sitting the full Lead Auditor course, the conversion figures do not apply to you.

How many questions do you need to get right?

The question is natural and it does not have an answer, because the exam is not marked by question. It is marked by mark. You need 40 of the 80 marks and the minimum in every domain. Questions are worth 1, 2 or 3 marks and partial marks apply, so there is no fixed number of questions that gets you there. Two candidates can answer the same number of questions correctly and get different results.

That is why the pass mark article is the more useful page if you are trying to work out what a pass actually requires.

Frequently asked questions

Where to go next

The complete CQI IRCA ISO 27001 Lead Auditor exam guide covers timing, the sitting process, conduct rules and what happens afterwards. There is also a breakdown of what each of the five domains asks.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING's Approved Training Partner record, and any provider's certified courses can be looked up in CQI and IRCA's own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.