Which document links the organisation's risk treatment decisions to the Annex A controls it has included or excluded?
Domain 2
Answer: B · whyClause 6.1.3 d) requires a Statement of Applicability with justification for inclusions and exclusions.
Accredited personnel-certification bodies, e.g. PECB, or IRCA-certified courses (CQI) · ISO Management Systems - Audit
ISO/IEC 27001 Lead Auditor
Internal and external ISMS auditors, GRC and compliance professionals, consultants and anyone who leads or supports ISO/IEC 27001 certification audits.
Overview
- Prerequisites
- Training course (typically 5 days) then exam. Example (PECB): 'Lead Auditor' credential needs 5 years' professional experience incl. 2 years in information security management, plus 300 hours of audit activity; lower grades exist (Provisional Auditor - no experience; Auditor - 2 years/200 audit hours). IRCA (part of the Chartered Quality Institute, quality.org) certifies ISMS auditor/lead auditor courses that are delivered by approved training partners; course length, assessment style and fees are set by the provider - check official site.
- Maintenance
- PECB certificates are valid for 3 years. Lead Auditor and Lead Implementer holders must report 90 CPD hours over each 3-year cycle (they can be spread unevenly across years) and pay annual maintenance fees (US$390 per 3-year cycle for these certification levels; the first year is included in the application). IRCA and other bodies have their own CPD rules - check official site.
- Outline in effect
- Current standard: ISO/IEC 27001:2022 incl. Amd 1:2024 (climate action)
Exam facts
- Questions
- 80 (PECB multiple-choice version)
- Duration
- 3 hours (PECB)
- Question types
- Multiple choice with 3 options; stand-alone and scenario-based questions
- Passing score
- 70% (PECB)
- Format
- Linear, open-book (hard copy of ISO/IEC 27001, course materials and notes allowed - PECB)
- Delivery
- Usually on the last day of the course or later via PECB's online exam app - check PECB Examination Rules and Policies
Cost
- Notes
- PECB: exam and certification fees are included in the training course price, which varies by training partner and country; one free retake within 12 months. IRCA course fees set by providers - check official site.
Domains
PECB competency domains; PECB does not publish percentage weights per domain (half the questions test knowledge, half test application/analysis).
- 1. Fundamental principles and concepts of an ISMS
- 2. Information security management system (requirements)
- 3. Fundamental audit concepts and principles
- 4. Preparation of an ISO/IEC 27001 audit
- 5. Conducting an ISO/IEC 27001 audit
- 6. Closing an ISO/IEC 27001 audit
- 7. Managing an ISO/IEC 27001 audit programme
Upcoming changes
No announced changes as of 19 Oct 2026.
Study plan
- Week 1
Know the standard
- Read ISO/IEC 27001:2022 clauses 4-10 and Amd 1:2024 twice; summarise each 'shall'.
- Skim Annex A (93 controls in 4 themes: organisational 37, people 8, physical 14, technological 34).
- Week 2
ISO/IEC 27002 + SoA
- Map Annex A to ISO/IEC 27002:2022 guidance; understand the Statement of Applicability and risk treatment plan linkage.
- Practise reading a sample SoA and spotting gaps.
- Week 3
Audit principles (ISO 19011)
- Seven audit principles, audit programme management, auditor competence.
- Audit evidence, sampling, findings and conclusions.
- Week 4
Certification audits (ISO/IEC 17021-1, 27006)
- Stage 1 vs Stage 2, surveillance and recertification cycle, major vs minor nonconformity, opportunities for improvement.
- Write 5 practice nonconformity statements (requirement - evidence - finding).
- Week 5
Mock audit
- Run a mock audit of a sample company: audit plan, checklist, opening meeting, interviews, evidence sampling, closing meeting.
- Write the audit report with graded findings and practise defending each finding against the clause.
- Week 6
Auditing risk and ISMS operation
- Walk through the ISO/IEC 27005:2022 risk process and how an auditor tests it: method, criteria, risk owners, treatment plan, SoA justifications.
- Audit clause 9 evidence: internal audit programme, monitoring and measurement results, management review inputs and outputs.
- Week 7
Course week
- Attend the accredited course; tab your standard (allowed in open-book exam).
- Do every case-study exercise.
- Week 8
Exam practice
- Timed scenario questions; practise finding the relevant clause quickly in your printed standard.
Exam tips
- It is open book: tab the clauses (4.1-10.2) and Annex A themes in your printed standard so you can find them in seconds.
- In scenario questions, locate the exact 'shall' that the evidence relates to before deciding if it is a nonconformity.
- A nonconformity must be evidence-based and traceable to a requirement; opinions or best practice alone are not findings.
- Know the audit sequence: programme - planning - opening meeting - evidence collection - findings - closing meeting - report - follow-up.
Common pitfalls
- Confusing ISO/IEC 27001 (certifiable requirements) with ISO/IEC 27002 (guidance - not auditable on its own).
- Raising nonconformities against Annex A controls the organisation has justifiably excluded in its SoA.
- Forgetting the 2024 climate amendment to clauses 4.1 and 4.2.
- Auditing your own work or a process you designed (independence/objectivity).
Resources & official links
Official
- ISO/IEC 27001:2022 (iso.org)
- ISO/IEC 27001:2022/Amd 1:2024 (climate action)
- PECB ISO/IEC 27001 Lead Auditor candidate handbook
- CQI | IRCA certified courses
Also widely used
- ISO 19011:2018 Guidelines for auditing management systems
- ISO/IEC 27002:2022 controls guidance
- ISO/IEC 27006-1 requirements for ISMS certification bodies
- ISO/IEC 27007 guidelines for ISMS auditing
Sources
- PECB ISO/IEC 27001 Lead Auditor course page (domains, credential grades)
- PECB 27001 Lead Auditor candidate handbook (80 MCQ, 70%, open-book)
- PECB 27001 Lead Auditor brochure (5-day course, 3-hour exam)
- PECB Certification Maintenance Policy (2026)
- ISO/IEC 27001:2022/Amd 1:2024
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Under ISO/IEC 27001:2022/Amd 1:2024, what must the organisation now determine in clause 4.1?
Domain 2
Answer: B · whyThe amendment adds that the organisation shall determine whether climate change is a relevant issue.
How many controls are in Annex A of ISO/IEC 27001:2022?
Domain 1
Answer: B · whyThe 2022 edition has 93 controls in four themes.
Which ISO standard provides guidelines for auditing management systems?
Domain 3
Answer: B · whyISO 19011 gives auditing guidance applicable to all management systems.
The PRIMARY purpose of a Stage 1 audit is to:
Domain 4
Answer: B · whyStage 1 evaluates documented information, scope and readiness to plan Stage 2.
Management review records show no review has taken place for 18 months although the ISMS requires an annual review. This is BEST classified as:
Domain 5
Answer: B · whyClause 9.3 requires management review at planned intervals; failure to perform it is a nonconformity (its grade depends on the scheme's criteria).
Which statement is a well-written nonconformity?
Domain 5
Answer: B · whyA nonconformity states the requirement, the objective evidence and the gap.
Audit evidence must be:
Domain 5
Answer: B · whyEvidence is verifiable information relevant to audit criteria.
Who decides whether to grant certification after an external audit?
Domain 6
Answer: B · whyUnder ISO/IEC 17021-1 the certification decision is made by the certification body, separate from the audit team.
Which audit principle requires auditors to reach conclusions based on evidence?
Domain 3
Answer: B · whyThe evidence-based approach is one of the seven ISO 19011 principles.
A typical ISO management system certification cycle is:
Domain 7
Answer: B · whyCertificates usually run 3 years with annual surveillance and a recertification audit.
Which clause requires the organisation to plan, establish and maintain an internal audit programme?
Domain 2
Answer: B · whyClause 9.2 covers internal audit.