Becoming a certified ISO 27001 Lead Auditor takes five things: the prior knowledge the course assumes, an approved Lead Auditor course, the CQI and IRCA examination, logged audit experience, and an application to CQI and IRCA that they assess. The course and exam take weeks. The experience is the part that decides how long the whole thing takes.

What does the ISO 27001 Lead Auditor course actually give you?

One thing to be clear about at the outset, because it is the point most easily blurred. Completing an approved Lead Auditor course, and passing the examination, does not make you a certificated auditor. It satisfies the training requirement, which is one part of an application you make separately to CQI and IRCA, and the grade you can apply for depends on audit experience you build up afterwards.

Put positively: what an approved course and a passed examination give you is the training requirement for initial certification as an IRCA ISMS auditor. No training provider — including this one — can certify you. Only CQI and IRCA can, and they do it on evidence you supply.

How long is the ISO 27001 Lead Auditor course certificate valid?

There is a clock on it. For IRCA certification purposes, the relevant training must have been completed and passed within the five years preceding your application, and your training provider is required to tell you so in writing. One point of detail worth having right: the specification and the Approved Training Partner Handbook both anchor that five years to completing the course. If you have seen it described as running from the date you passed the exam, that is a different anchor. Because the exam is sat up to 30 days after training, it gives a later expiry — so a learner working to it could believe they have up to a month more than they have. Work to the earlier of the two and the discrepancy cannot cost you anything.

How do you become an ISO 27001 Lead Auditor? The steps, in order

Step one: get the prior knowledge the course assumes

PR373, the course specification, lists recommended prior knowledge in two parts: an understanding of information security management principles and the Plan-Do-Check-Act cycle, and knowledge of the requirements of ISO/IEC 27001 with ISO/IEC 27002 and the terms defined in ISO/IEC 27000. It says that second part “may be gained by” completing the Foundation course FD134 “or equivalent”.

Two lines in the specification give this step its weight. The examination is written on the assumption that the knowledge is already there, The course specification assumes that learners already have the recommended prior knowledge of ISO/IEC 27001 and related information-security concepts.So step one is not optional in any practical sense, whatever the word recommended suggests. A reader who arrives without it does not fail an entry check; they sit through the whole course of audit technique built on a standard they are still learning, and then answer exam questions that assume both. What the course assumes you already know sets out the whole list, and whether to take the Foundation course first covers the decision.

Step two: take an approved Lead Auditor course

It must be a course certified by CQI and IRCA and delivered by an Approved Training Partner — the 3FOLD TRAINING course is one. That is not a quality signal a provider awards itself: the specification and the examination are CQI and IRCA’s, and the partner is approved against the scheme’s own handbook, with its certified courses re-confirmed each year. A course that is not certified may be perfectly good training, but it will not satisfy the training requirement.

Four things to check before you book, all of them requirements on the partner rather than courtesies. The provider should quote the full course title as it appears in the specification. It should give the unique course identification number. It should link to its approval and course certification on CQI and IRCA’s website. And it should tell you the recommended prior knowledge before you enrol.

Step three: pass the examination

The examination is set, delivered and marked by CQI and IRCA, not by your training provider. You need 40 of the 80 marks overall and the minimum mark in each of the five domains. How the exam is structured covers the format and the sitting; how the pass mark works sets out the domain minima, which are easy to overlook when you are watching only the overall total.

You sit the exam separately from the course, online, within 30 days of the last day of training. Your result is available for your training provider to download within 10 UK working days. Heard nothing after 14 working days? Contact your provider rather than CQI and IRCA.

An aside before step four: which kind of auditing are you heading for?

Much of the advice written about this route quietly assumes one destination: a job at a certification body, auditing under supervision before you are allowed to lead. That is a real route, but it is not the one most people are on, and reading it as though it applies to you makes the step below look far more forbidding than it is.

Auditing divides three ways, and the course is the same for all three.

• First-party, auditing your own organisation’s ISMS as part of its internal audit programme. This is where most people start and where most early audit days come from.
• Second-party, auditing a supplier or a partner on your own organisation’s behalf — increasingly common as customers push information security requirements down their supply chains.
• Third-party, auditing on behalf of a certification body so that a certificate can be issued. This is the route with an employer in the middle of it, and the supervised-audit conditions people read about are that employer’s and the scheme’s, not conditions on the course.

Work out which you are aiming at before you weigh what the next step asks of you. A reader whose goal is to audit their own organisation’s ISMS competently has a shorter road than most pages on this subject imply.

Step four: build and log audit experience

This is the step that takes real time, and the one the first three exist to prepare you for. The grade of certification you can apply for depends on the audit experience you accumulate after the course. That experience has to be recorded in a form CQI and IRCA can assess: what you audited, when, for how long, in what role, and against what.

Two things are worth knowing before you start logging. CQI and IRCA may accept internal audits for Auditor and Lead Auditor applications, provided the audits meet their conditions — including covering the full management system and being conducted in an area of the organisation from which you are entirely independent. Remote audits are also accepted where there is equivalent interaction with the auditee.

Start the log on the day you finish the course, not on the day you decide to apply. Reconstructing two years of audit days from memory and diary entries is miserable, and the detail that gets lost is exactly the detail an assessor wants. If your employer runs an internal audit programme, that is the usual place to begin.

Step five: apply, and keep your competence current

The grades, and what each one asks of you in audit experience, are published by CQI and IRCA and are theirs to change. Rather than reproduce numbers that may have moved by the time you read this, we point you at the CQI and IRCA grades of auditor certification, which is what your application will actually be assessed against. One thing worth knowing before you go: the grade names on that page have changed since much of what is written about them was written, so check the current names there rather than assuming a route described elsewhere still exists.

Once you are certified, you keep it by maintaining and evidencing your competence through continuing professional development. One thing to note if you are reading older guidance: CQI has moved away from counting points and hours, so a figure you find quoted in a blog post may be describing a scheme that no longer works that way. Read the current requirement rather than a summary of an old one.

How to apply for CQI and IRCA auditor grade membership sets out the application itself.

Where the route to ISO 27001 Lead Auditor usually goes wrong

Four things get between people and this credential, and the examination is not one of them.

• Arriving without the prior knowledge. Nobody stops you, so it need not feel like a problem until the course is well under way. The course is built on the assumption that you already know the requirements of the standard, and CQI and IRCA will not approve one redesigned around a room that does not.
• Letting the 30 days run out. The examination window opens when training ends and it is short. Meaning to sit it “once work calms down” is how the window gets missed.
• Letting the five years run out. The certificate supports an application for five years from completing the course. Past that, CQI and IRCA say they will still consider the training where you can also evidence recent and relevant continuing professional development, relevant work experience, and that your auditing skills are current — a good deal more to assemble than an application made inside the window.
• Never logging anything. The easiest of the four to put off and the most expensive to repair. The audits happen; the record does not, and two years later there is no way to evidence them to the standard an assessor needs.

Two of the four are calendar problems rather than difficulty problems; the other two are about preparation and record-keeping. That is worth knowing at the point where you are deciding whether the course is hard.

How long does it take to become an ISO 27001 Lead Auditor?

The training and examination are quick. PR373 gives the course a duration of 40 hours, and CQI and IRCA’s public listing for the course puts that figure as a minimum. How the hours are delivered is the partner’s choice: ours runs either as consecutive full days or as a series of shorter evening sessions. The exam is then sat separately, within 30 days of the last day of training.

Build the calendar backwards from the examination rather than forwards from the booking. The sitting has to fit inside the 30-day window, results take 10 UK working days from there, and if a resit is needed there is a further wait and a further sitting. Someone who sits the exam in the week after training can be holding a result about three weeks after the course ends; someone who uses the full 30-day window will be closer to six. If something depends on the outcome — a role, a tender, a customer requirement — plan on the longer of those rather than working to the 30-day window alone.

The experience is what stretches the timetable, and how long it takes depends entirely on how much auditing you actually do. Somebody auditing regularly as part of their job will accumulate it far faster than somebody who audits once a quarter. That is not evasion — it is the honest answer, and any page that gives you a single number for it is guessing.

What if you are starting from outside information security?

People arrive at this qualification from quality management, from internal audit, from compliance and from IT, and the route through the course and the examination is the same for all of them. The gap is different, though. Somebody with an audit background needs the information security knowledge; somebody from an information security background needs the audit discipline instead. Whether you need an IT background deals with the version of this question that comes up most.

Frequently asked questions about becoming an ISO 27001 Lead Auditor

Where to go next: more on the ISO 27001 Lead Auditor course

If you are working out whether to start, who is eligible for the course is the place to begin, and what actually moves marks in the examination is worth reading before you sit it. When you get there, the free 40-question mock exam runs to the same number of questions as the real paper and is built to the same domain weighting.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.