Overview
An ISO/IEC 27001 Lead Auditor certification shows that a person can plan, lead, carry out, and report on an audit of an information security management system (ISMS) against ISO/IEC 27001:2022. ISO publishes the standard but doesn't certify people. Several bodies offer the credential or the training behind it, including PECB, BSI with its CQI and IRCA certified and Exemplar Global TPECS courses, and Exemplar Global's own ISMS auditor certification. Rules vary by body.
This page uses PECB's scheme for detail. PECB has 4 grades, from Provisional Auditor with no experience up to Senior Lead Auditor, and the Lead Auditor grade asks for 5 years of work experience, 2 of them in information security management, plus 300 hours of audit activity. Exemplar Global's ISMS Lead Auditor grade, by comparison, asks for 7 complete management system audits and 35 audit days, including 3 audits and 15 days as team leader. The Lead Implementer credential covers building an ISMS rather than auditing it. ISACA's CISA is broader and isn't tied to one standard, and the PCI Security Standards Council accepts a certified ISO 27001 Lead Auditor as one of its audit prerequisites for QSA candidates.
What the exam covers
Each body sets its own syllabus. PECB's Lead Auditor exam has 80 questions across 7 competency domains, with the share of the exam published for each.
| Domain | Weight |
|---|---|
| Fundamental principles and concepts of an information security management system (ISMS) | 16.25% |
| Information security management system (ISMS) and ISO/IEC 27001 requirements | 10% |
| Fundamental audit concepts and principles | 17.5% |
| Preparing an ISO/IEC 27001 audit | 15% |
| Conducting an ISO/IEC 27001 audit | 22.5% |
| Closing an ISO/IEC 27001 audit | 8.75% |
| Managing an ISO/IEC 27001 audit program | 10% |
Requirements
Requirements differ by body. For the PECB Certified ISO/IEC 27001 Lead Auditor grade, candidates need 5 years of work experience (2 in information security management) and 300 hours of audit activities, and a Provisional Auditor grade is available with no experience.
- Format
- Open-book, multiple-choice exam with stand-alone and scenario-based questions (PECB)
- Questions
- 80 (PECB)
- Time
- 3 hours (PECB)
- Passing score
- 70% (PECB)
- Delivery
- Online through the PECB Exams application with a remote invigilator, or on paper at a PECB partner training location (PECB)
PECB candidates sign the PECB Code of Ethics and can take the exam without the course. BSI Canada's ISO/IEC 27001:2022 Lead Auditor (TPECS) course runs 4 days with online competency exams in 3 Exemplar Global units (information security systems, management systems auditing, and leading audit teams).
Cost
Exam fee: USD 1,000 for the PECB Lead exam taken without training, plus a USD 500 certification application fee. PECB prices from its Lead Auditor candidate handbook, checked 2026-10-12. When candidates train with a PECB partner, the training fee includes the first exam attempt, one free retake, the application fee, and the first year of maintenance. BSI Canada listed its 4-day Lead Auditor (TPECS) course at CAD 2,730 on the same date. Prices change.
Keeping it current
- Cycle
- 3 years (PECB)
- Continuing education
- 90 CPD hours per 3-year cycle for the PECB Lead Auditor grade
- Fees
- PECB annual maintenance fee of USD 390 per 3-year cycle
How to verify that someone holds it
Employers should check with the body named on the certificate. PECB's online certificate verification tool takes the holder's name, certificate type, and certificate number, and PECB also issues Credly badges. Use the issuer’s verification page.
On InfoSecHub, a ISO 27001 LA listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.
In Canada
BSI's Canadian site offers an ISO/IEC 27001:2022 Lead Auditor (TPECS) course priced in Canadian dollars, which leads to Exemplar Global certificates of attainment.
Typical roles
- ISMS auditor
- Internal auditor
- Certification body auditor
- IT auditor
- Compliance manager
Related frameworks
Official resources
From Various certification bodies. Links open the issuer’s site.
- ISO 27001 LA official page, Various certification bodies
- ISO/IEC 27001 Lead Auditor candidate handbook, PECBhandbook
- Certificate verification, PECBverification
- ISO/IEC 27001 training courses (Canada), BSI
- Information Security Management System Auditor (ISO 27001), Exemplar Global
References
- ISO/IEC 27001 Lead Auditor candidate handbook, version 1.5, PECB
- Certification maintenance policy, PECB
- Lead Auditor training course, ISO/IEC 27001:2022, BSI
- ISMS qualification-based certification requirements, Exemplar Global
- ISO/IEC 27001:2022 Information security management systems, ISO
Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the Various certification bodies website before you register. InfoSecHub is not affiliated with Various certification bodies.