Eligibility is not the obstacle. There is no formal entry requirement for the CQI and IRCA ISO/IEC 27001:2022 Lead Auditor course: no qualification, no minimum experience, no IT background, no membership. What the specification sets out instead is recommended prior knowledge, which your provider must check you have before the course starts.

What does the ISO 27001 Lead Auditor course specification require?

PR373 is the course specification. Read it looking for entry conditions and you find none. Here is what it does not ask of you:

• a minimum qualification, academic or professional;
• a minimum period in a role, or any particular type of work experience;
• employer sponsorship;
• an IT, technical or information security background;
• CQI or IRCA membership;
• any age or nationality condition;
• a language test — though the course is delivered in English.

What the specification contains instead is a section headed “Recommend prior knowledge”, and a definition of what completing the course means: attend all of it, pass the continual assessment, pass the examination. That is the entire bar.

What is the recommended prior knowledge for the ISO 27001 Lead Auditor course?

The specification lists it in two parts. The first is an understanding of information security management principles and of the Plan-Do-Check-Act cycle. The second is knowledge of what ISO/IEC 27001 requires, read alongside ISO/IEC 27002, together with the information security vocabulary set out in ISO/IEC 27000. On that second part the specification adds that it “may be gained by completing” the Foundation course, FD134, “or equivalent”.

The verbs matter more than the label. Wherever the specification touches this, the words are recommend, assumes, and designed for learners who have the knowledge. It never uses prerequisite, entry requirement or required about prior knowledge, which is why a page describing prior knowledge as a requirement is not describing this specification.

The examination also assumes this prior knowledge, and candidates need access to the relevant ISO management-system requirements standard to answer some questions.The course is designed on the basis that learners already have the recommended prior knowledge of ISO/IEC 27001 and related information-security concepts.

The full list of what the course assumes goes through both parts in detail, and is the more useful page if you are trying to work out whether you are ready rather than whether you are permitted.

Where do the “four years of experience” figures come from?

Search this question and you will meet numbers.Four years in IT, two of them in information security, three completed ISMS audits, sometimes a degree. They recur so consistently across training-provider pages that they read like entry conditions. They are not, and it is worth being precise about where they come from, because two different things have been run together.

The first is certification rather than training. CQI and IRCA’s grades of auditor certification do set work-experience and audit-experience criteria, and those criteria are real. But they apply to an application you make after the course, they differ by grade, and they say nothing about who may attend a course. A page that reprints them under a heading about course prerequisites has moved a certification rule onto a training page.

The second is a different scheme. Not every course called ISO 27001 Lead Auditor is a CQI and IRCA certified course. Other bodies run their own auditor credentials with their own published requirements, and some providers run courses certified by nobody. Those requirements are binding on their own routes and are not PR373’s.

So when you meet a number, ask two things: is it about the course or about the credential, and whose credential is it? On this route the answer to the first is nearly always the credential — and PR373 itself asks for nothing.

Eligible to attend and eligible to be certificated are different questions

So be clear about this before you book. Passing the course and the examination satisfies the training requirement — one component of an application you then make to CQI and IRCA, who decide the rest on audit experience you accumulate afterwards. A provider that implies the certificate arriving in your inbox is the credential is describing something that does not exist.

We deliberately do not publish a table of the grades and their audit-experience thresholds. Those criteria belong to CQI and IRCA, they are theirs to revise, and your application will be assessed against their published version rather than against ours. CQI and IRCA publish the CQI and IRCA grades of auditor certification, and that is what to read. Expect the labels to have moved since anything you read about them was written.

The attend-or-be-certificated distinction changes what eligibility means in practice. Suppose your aim is to audit your own organisation’s ISMS, or to sit alongside a certification body during a surveillance visit. The course and the examination are then the whole of the training side of it, and no separate certification question arises unless a customer or an employer raises one. If your aim is the certificated grade, the course is the first of several steps and the eligibility questions that matter to you are the ones on the application form, not the ones on the booking form.

If there is no entry requirement, why does prior knowledge matter?

The recommendation does not gate you, but it does bind the provider. Under the Approved Training Partner Handbook, a partner has to satisfy itself that learners hold the recommended prior knowledge before training begins, record that it has done so, and keep documented evidence of it. A partner’s certified courses are re-confirmed each year. So the real question is not whether you are permitted to enrol. It is whether a provider can satisfy itself, and the scheme, that you will be able to follow the course.

The Handbook does not prescribe how a partner does this. Its own worked example is a pre-course questionnaire; what it insists on is documented evidence that whatever process the partner uses is being followed. On our ISO 27001 Lead Auditor course the method is a pre-course assessment, and it is not optional. Before the live course opens you work through three prior-knowledge lessons on our learning platform — about two to three hours — and sit a 25-question quiz, which you have to pass at 70% before you attend. That is our own gate rather than a CQI and IRCA rule; nothing in the specification requires a quiz. It is simply how we discharge the duty the Handbook puts on us, and it is fair to know about it before you book.

It cuts the other way too. The quiz tells you, privately and in advance, whether the assumptions the course makes about you actually hold.

That is the honest way to think about eligibility here. The specification’s door is open. The question behind it is whether you will be able to follow a course that will not stop to teach you the standard.

Who is the ISO 27001 Lead Auditor course written for?

Auditing an ISMS needs two things: the audit discipline, and knowledge of information security and the standard. The four groups the course is marketed to are worth setting out because of how each sits against those two — not as any kind of requirement, and not as a description of a particular cohort.

• Internal auditors and management-system professionals who already audit against ISO 9001 or ISO 45001. Much of the audit discipline carries across; the information security content is the gap.
• Information security and IT staff who know ISO/IEC 27001 well and have never audited. The standard is familiar; auditing to evidence rather than to expertise is the gap.
• Risk, governance and compliance staff extending into information security, often because their organisation is certifying, or has been asked by a customer to certify. They usually have the discipline of working to a requirement, and the gap is the subject matter.
• Consultants and prospective certification-body auditors for whom the certification is a professional credential rather than an internal need. This is the one group that has to be strong on both halves, because the work is done in front of someone else’s organisation.

A course written for all four cannot afford to teach either half from scratch, which is why the specification puts the standard on your side of the line before you arrive.

The hardest starting position is not any of those, and it is a matter of how many gaps have to close at once rather than of anything about the person. It is the reader sent by an employer that has decided it needs a lead auditor and picked whoever was available rather than whoever was prepared — no audit background, and a working rather than a clause-level knowledge of the standard. Nothing in the specification prohibits that booking. But two gaps then have to close in a course designed to close one, and the design is not ours to change. CQI and IRCA will not approve a Lead Auditor course rebuilt around a room that needs the standard taught to it.

What about the ISO 27001 Lead Auditor examination — is that gated?

Not by anything about you. The conditions are practical rather than biographical. You sit it online within 30 days of the last day of training, with government-issued photo identification, on a computer or laptop meeting CQI and IRCA’s published minimum specification and fitted with a webcam and microphone. Phones and tablets are not permitted, and neither are touchscreen devices or 2-in-1 hybrids with front and rear cameras — so check the published list rather than assuming a touchscreen laptop is fine. The exam guide sets out the whole sitting.

Frequently asked questions about ISO 27001 Lead Auditor course eligibility

Where to go next: more on the ISO 27001 Lead Auditor course

If the answer to eligibility is yes and the question is now readiness, Foundation or Lead Auditor settles the course question that usually follows. The full route to certification shows where the course sits in the longer journey, and whether you need an IT background takes on the worry that most often travels with this one.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.