ISO 27001
Inside the ISO 27001 Lead Auditor role
The ISO/IEC 27001 Lead Auditor is the person who decides, on evidence, whether an information security management system meets the standard and works as described. That decision is what a customer relies on when it accepts a supplier's certificate, what a board relies on before the certification body arrives, and what a certification body relies on when it issues or keeps a certificate. This guide is about who does that work, the audits that create it, what PECB's credential levels mean, and what the exam tests.
The facts here come from ISO's page for ISO/IEC 27001:2022, PECB's ISO/IEC 27001 Lead Auditor Candidate Handbook for the multiple-choice exam, version 1.5, PECB's course page, the Official Journal texts of NIS2 and DORA, and O*NET OnLine, read on 20 October 2026.
What does an ISO 27001 Lead Auditor do?
PECB's course page describes the job through what participants learn to do: explain the concepts of an ISMS, interpret the ISO/IEC 27001 requirements from an auditor's perspective, evaluate an ISMS's conformity, plan, conduct and close an audit in accordance with ISO/IEC 17021-1 requirements and ISO 19011 guidelines, and manage an audit program. The exam weights those tasks through the questions it takes from each of seven domains:
| Domain | Questions | Share |
|---|---|---|
| 1. Fundamental principles and concepts of an ISMS | 13 | 16.25% |
| 2. ISMS and ISO/IEC 27001 requirements | 8 | 10% |
| 3. Fundamental audit concepts and principles | 14 | 17.5% |
| 4. Preparing an ISO/IEC 27001 audit | 12 | 15% |
| 5. Conducting an ISO/IEC 27001 audit | 18 | 22.5% |
| 6. Closing an ISO/IEC 27001 audit | 7 | 8.75% |
| 7. Managing an ISO/IEC 27001 audit program | 8 | 10% |
Of the 80 questions, 59 come from the five audit domains. The standard itself, domains 1 and 2, carries 21. That balance is the defining fact about the credential. It is an audit qualification, and the information security content is there so that the auditor can recognize what conformity looks like. Conducting the audit, at 18 questions, is the largest single domain: the on-site and remote work of interviews, observation, record review and testing that produces the evidence everything else depends on.
Audit, our guide reminds candidates, is a sampling exercise. An auditor cannot examine everything, so the opinion rests on reasonable assurance, a high level of confidence backed by sufficient sampling, not on absolute assurance. That is why the closing meeting includes a sampling disclaimer: the evidence is a sample and carries inherent uncertainty. It is also why the quality of the sample matters as much as the quality of the auditor's questions.
Who sits the ISO 27001 Lead Auditor?
PECB's prerequisites describe the starting point: a fundamental understanding of ISO/IEC 27001 and a thorough knowledge of audit principles. The people who arrive with that background audit in three settings, and the same method serves all three:
| Audit | Who does it | Who relies on the report | What the credential adds |
|---|---|---|---|
| First-party (internal) | Internal auditors, security governance staff, compliance teams | Top management and the ISMS owner | A method that will hold up when the certification body tests the same controls |
| Second-party (supplier) | Customer security, vendor risk and procurement auditors | The customer deciding whether to buy, or keep buying | A recognized basis for judging a supplier's ISMS beyond its questionnaire answers |
| Third-party (certification) | Auditors working for accredited certification bodies | The certification decision, and everyone who later relies on the certificate | Evidence of competence, alongside the body's own ISO/IEC 17021-1 requirements |
Within those settings sit very different careers: an internal auditor moving into technology risk, a security engineer who now audits the controls they used to run, a consultant who performs readiness audits before clients book certification, and a career auditor at a certification body. The method is the same; the independence, the audience and the consequences of a finding differ.
Independence is the part that changes most. An internal auditor works for the organization being audited, so the audit program has to keep them away from auditing their own work. A supplier auditor works for the customer, and the supplier knows it. A certification body auditor works under ISO/IEC 17021-1, which exists to keep the certification decision impartial. In every setting the auditor's duty is the same: stay impartial, and refuse pressure to soften or harden a finding. The setting decides how hard that is.
What the job looks like in numbers
No US occupation code covers ISMS auditing. The two that bracket it are Information Security Analysts, on the security side, and Accountants and Auditors, on the audit side. O*NET gives these figures from Bureau of Labor Statistics data:
| Measure | Information Security Analysts (15-1212) | Accountants and Auditors (13-2011) |
|---|---|---|
| Employment | 192,900 | 1,595,200 (2025) |
| Median annual wage, 2025 | $129,180 | $83,680 |
| Projected growth, 2025 to 2035 | Much faster than average (7% or higher) | Faster than average (5% to 6%) |
| Projected job openings, 2025 to 2035 | 14,100 | 115,300 |
The second occupation is dominated by accountants and financial auditors. The table shows the two professions an ISMS auditor sits between, not the size of the ISMS audit market, for which we found no official figure.
When does the audit work arrive?
Every certified ISMS generates audit work on a fixed rhythm, and several rules add more.
An organization decides to certify
Certification against ISO/IEC 27001 is awarded by an accredited certification body after a stage 1 and a stage 2 audit, and then kept through surveillance audits. Our guide is clear that the objectives differ: a stage 2 certification audit is about whether the ISMS conforms and is effective, while a surveillance audit verifies that a previously certified system remains effective. Before any of that, the organization's own internal audits have to show the system working, because the standard requires an internal audit program.
A customer will not buy without assurance
A customer that cannot simply accept a certificate can audit a supplier itself. Second-party audits are one way buyers check that a supplier's ISMS covers the services it actually provides, and an early step is to read the supplier's Statement of Applicability, with its version number and date, to see which controls it says apply and why.
NIS2 asks for assessed effectiveness
The NIS2 Directive's list of minimum cybersecurity measures, in Article 21(2), includes "policies and procedures to assess the effectiveness of cybersecurity risk-management measures." For an in-scope entity that runs an ISMS, internal audit is one of the most direct ways to meet that measure, and the audit has to be good enough to show a regulator the measures work.
DORA requires ICT internal audit
DORA, Regulation (EU) 2022/2554, is more explicit. Article 6(6) says the ICT risk management framework of financial entities, other than microenterprises, "shall be subject to internal audit by auditors on a regular basis in line with the financial entities' audit plan," and that those auditors "shall possess sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence." A financial entity that runs its ICT risk framework through an ISMS puts its ISMS auditors directly inside that requirement.
The certification cycle turns
A certificate is not a one-off. After the initial certification, the certification body returns for surveillance audits, and at the end of the certification cycle the organization is audited again for recertification. ISO describes certification cycles elsewhere as typically around three years. Every stage of that cycle needs an internal audit program behind it, so that the organization finds its own nonconformities before the certification body does. For an in-house auditor, that rhythm is the job.
Something goes wrong
After a security incident, management wants to know whether the ISMS failed and where. That is an audit question, and the answer depends on objective evidence rather than on what people remember. The same skills that grade a nonconformity at a routine audit are the ones that establish what happened.
What each audit asks of the auditor
Here is the same ground turned into the work it creates. For each trigger, the second column is what the auditor delivers, and the third is the PECB domain that teaches it.
| Trigger | What the auditor delivers | PECB domain | Source of the requirement |
|---|---|---|---|
| The annual internal audit program | A risk-based program covering the ISMS over the cycle | 7. Managing an audit program | ISO/IEC 27001's internal audit requirement |
| A stage 1 certification audit | A readiness review of the documented ISMS, with concerns to resolve before stage 2 | 4. Preparing an audit | ISO/IEC 17021-1 |
| A stage 2 certification audit | Evidence that the ISMS conforms and is effective, and graded findings | 5. Conducting; 6. Closing | ISO/IEC 17021-1 |
| A surveillance audit | Verification that the certified system remains effective | 5. Conducting | ISO/IEC 17021-1 |
| A supplier audit | A scope tied to the services bought, findings the customer can act on | 4. Preparing; 5. Conducting | The customer's contract |
| NIS2 effectiveness assessment | Audit evidence that the cybersecurity measures work | 5. Conducting; 6. Closing | NIS2 Article 21(2)(f) |
| DORA ICT internal audit | A regular, independent audit of the ICT risk management framework | 3. Audit principles; 7. Audit program | DORA Article 6(6) |
We have turned the planning steps behind every one of these into an audit plan starter you can copy or download below.
ISMS audit plan starter
ISMS audit plan starter
Use this when you plan an ISO/IEC 27001 audit, internal, supplier or certification. It follows the audit stages PECB's ISO/IEC 27001 Lead Auditor exam is built on: preparing, conducting and closing an audit, and managing the audit program. ISO/IEC 27001 is sold rather than published, so check requirement wording against your own copy of ISO/IEC 27001:2022.
Before the audit
- Who commissioned it, and what kind it is: first-party, second-party or third-party
- Audit objectives: ____________ (a stage 2 certification audit and a surveillance audit have different ones)
- Audit scope, inside the ISMS scope, with sites and processes named
- Audit criteria: ISO/IEC 27001:2022 and the organization's own documented information
- The Statement of Applicability, with its version number and date, received and read
- Previous audit findings and the corrective actions taken
- Team members, any technical expert, and who leads
- Remote or on-site techniques, and how evidence will be gathered either way
During the audit
- A sampling plan you could defend to another competent auditor
- Objective evidence recorded for each conclusion: documents, observation, interviews with named roles
- Nothing accepted on a manager's assurance alone
Writing findings
- Each nonconformity report states the exact requirement, the objective evidence and a clear statement of
what is not met
- Major or minor graded on the evidence: a complete failure of a required process, or significant doubt
that the system can achieve its outcomes, is major
- A correction (fixing the immediate problem) kept distinct from corrective action (removing the root cause)
Closing
- Closing meeting held, with the sampling disclaimer explained: evidence is a sample and carries uncertainty
- Audit report with objectives, scope, criteria, findings and conclusions
- Follow-up agreed for each nonconformity
Where does the credential apply?
ISO/IEC 27001 is an international standard, published by ISO and the IEC, and certificates are recognized wherever accredited certification bodies operate. PECB's certification scheme is specified in compliance with ISO/IEC 17024, the standard for bodies that certify people. PECB runs the exam online through the PECB Exams application, supervised remotely, or on paper through a partner; online multiple-choice results arrive instantly.
The same is true of the people who hold it. The audit method does not change at a border; what changes is the local law and regulation the audit criteria have to include, which the audit plan should name before fieldwork starts.
The rules that create audit work differ by region. In the EU, NIS2 and DORA add legal reasons to audit an ISMS on top of the commercial ones. Elsewhere, customer contracts and sector regulators do the same job. The audit method is the same in each case, which is why the credential travels.
What the credential is not
It is not an implementer credential. The Lead Auditor checks a system; the Lead Implementer builds one. The standard is shared, but the exams are not interchangeable, and an organization hiring for one should not accept the other.
It is not an appointment to audit for a certification body. Certification bodies operate under ISO/IEC 17021-1 and set their own competence requirements. The credential is evidence they can take into account.
It is not absolute assurance. An audit samples. A clean audit means no nonconformity was found in what was examined, not that none exists, and a good auditor says so at the closing meeting.
It is not a copy of the standard. ISO/IEC 27001 is sold rather than published. PECB lets you take a hard copy into the exam, and you will need your own.
Which credential level can you claim?
| Credential | Exam | Professional experience | Audit activities |
|---|---|---|---|
| PECB Certified ISO/IEC 27001 Provisional Auditor | ISO/IEC 27001 Lead Auditor exam or equivalent | None | None |
| PECB Certified ISO/IEC 27001 Auditor | Two years, one of them in information security management | 200 hours | |
| PECB Certified ISO/IEC 27001 Lead Auditor | Five years, two of them in information security management | 300 hours | |
| PECB Certified ISO/IEC 27001 Senior Lead Auditor | Ten years, seven of them in information security management | 1,000 hours |
Every level also requires signing the PECB Code of Ethics. PECB checks the audit log to confirm the hours, and counts audit activities that include planning an audit, managing an audit program, drafting audit reports and drafting nonconformity reports. Certifications are valid for three years, and keeping one means completing the required CPD hours and paying the annual maintenance fee. When you have the experience for a higher level, you can upgrade online through your PECB dashboard.
The levels protect the people who rely on the title. A Provisional Auditor has passed the exam; a Lead Auditor has also led real audits for at least 300 hours. If your audit log is short, claim the level you hold and upgrade when the hours are there.
How does it compare with the credentials around it?
| ISO/IEC 27001 Lead Auditor | ISO/IEC 27001 Lead Implementer | CISA | |
|---|---|---|---|
| Awarded by | PECB | PECB | ISACA |
| The job | Auditing an ISMS against ISO/IEC 27001 | Building and running an ISMS | Auditing information systems and IT controls generally |
| Exam | 80 multiple-choice questions, 70% to pass, open book | 150 questions, 4 hours, 450 on a 200 to 800 scale | |
| Full credential needs | Five years, two in information security management; 300 audit hours | Five years, two in information security management; 300 project hours | Five years in IS audit, control, assurance or security; waivers up to three |
| Upkeep | Valid three years; CPD hours and an annual maintenance fee | 20 CPE hours a year, 120 over three years; annual fee | |
The Lead Auditor and Lead Implementer are the two sides of one standard, and some ISMS professionals take both. The CISA is broader: it covers IT audit across governance, development, operations and asset protection, and it is the credential of the IT audit profession rather than of one management system. An internal auditor who audits ISMSs and much else may want both the CISA and the Lead Auditor. Our ISO 27001 Lead Implementer Exam Guide and the CISA exam page cover the alternatives.
What will the exam expect of you?
The multiple-choice ISO/IEC 27001 Lead Auditor exam has 80 questions, and you need 70%, which is 56 correct answers. Candidates sitting a Lead exam in a language that is not their own can ask for 30 additional minutes. It is open book: PECB allows a hard copy of ISO/IEC 27001, the training course materials and your personal notes. Questions are stand-alone or scenario-based, and PECB's own sample begins with a scenario about an insurance company, followed by five questions on it.
The traps are about evidence, grading and the auditor's role. A complete nonconformity report has three parts: the exact requirement, the objective evidence, and a clear statement of what is not met. A major nonconformity indicates a complete failure of a required process or significant doubt that the system can achieve its intended outcomes. A correction eliminates the immediate nonconformity, while a corrective action eliminates the root cause, and an option that swaps them is wrong. When an auditee disputes a finding, the lead auditor presents the objective evidence and the specific criteria and defends the conclusion on that basis, not on authority.
The Statement of Applicability deserves its own attention. It is the organization's statement of which Annex A controls apply, with the reason each one is included or excluded, and it ties the risk treatment to the controls the auditor will test. An auditor who skips it tests the wrong controls, or tests the right ones without knowing why the organization chose them. Read it first, note its version and date, and come back to it whenever a control looks out of place.
The audit-principle questions test the same thinking from another angle. Reasonable assurance, not absolute assurance, is the standard an audit works to. A stage 2 objective is not a surveillance objective. And the Statement of Applicability, with its version and date, is the document an auditor checks first to know which controls the organization says apply. Test yourself with the ISO 27001 Lead Auditor quiz, see the domains on one page in the mind map, and if the credential is part of a job move, the interview questions page covers what employers ask.
How to prepare
Most candidates take the exam after a PECB partner course. PECB's course page says the training is based on theory and best practice in ISMS audits, with case-study lectures, role-playing exercises and practice tests similar to the certification exam, and that participants receive an attestation worth 31 CPD credits and a free retake within 12 months if the first attempt fails. Without a course, PECB's handbook lists the Lead Exam at $1,000 and the application fee at $500.
The ISO 27001 Lead Auditor Exam Guide (Wikidata) has 14 chapters across 440 pages, mapped to all seven competency domains, with each domain's share of the exam printed and every exam claim traced to the handbook. It covers the audit side of the standard, from planning through closing to managing an audit program, and it is written for the 80-question multiple-choice exam.
The ISO 27001 Lead Auditor Practice Exams (Wikidata) has three complete papers of 80 questions each, drawn from each of PECB's seven domains exactly as the exam does: 240 questions in all. Answers and explanations follow each paper, and every rationale says why the right answer is right and why each wrong option fails. It contains no clause text and no control titles.
Three papers suggest a plan, which is our suggestion rather than PECB's. Sit the first before or early in the course, to see which domains are new to you. Sit the second straight after the course, open book as the exam allows, and time yourself. Keep the third for the week before the exam. If you are above 56 out of 80 with time to spare on the third paper, you are ready; if not, the domain counts tell you where to go back to.
Is it current? Both books are written from PECB's Candidate Handbook version 1.5 for the multiple-choice exam, and ISO/IEC 27001:2022 remains the current edition of the standard on ISO's page. Check PECB's site for a newer handbook before you book.
So, should it be you?
Take the Lead Auditor if your job is to judge an ISMS on evidence: internally, at suppliers, before certification or for a certification body. The exam is about the audit method, the levels let you claim the audit hours you have actually logged, and NIS2 and DORA have added legal reasons for organizations to want auditors who can show their competence.
Take the Lead Implementer instead if your job is to build or run the ISMS. Consider the CISA if your audit work ranges well beyond one standard. And if you are new to auditing, start where the credential levels start: pass the exam, log the audit hours, and claim the Lead Auditor title when the hours are real.
Questions people ask about the ISO 27001 Lead Auditor
Who is the ISO 27001 Lead Auditor for?
People who audit information security management systems: internal auditors checking their own organization's ISMS, customers auditing suppliers, consultants doing pre-certification audits, and auditors at accredited certification bodies. PECB's course teaches participants to plan, conduct and close an ISO/IEC 27001 audit in accordance with ISO/IEC 17021-1 requirements and ISO 19011 guidelines.
What is the difference between the ISO 27001 Lead Auditor and Lead Implementer?
The Lead Implementer builds and runs an ISMS. The Lead Auditor checks one against ISO/IEC 27001 and reports on it. Both use the same standard; the auditor's exam spends 59 of its 80 questions on the audit method.
What experience do I need for the full ISO 27001 Lead Auditor?
PECB asks for five years of work experience, two of them in information security management, and 300 hours of audit activities. With less, you can hold the Provisional Auditor (exam only) or the Auditor (two years, one in information security management, and 200 audit hours).
What is the pass mark for the ISO 27001 Lead Auditor exam?
70%. The multiple-choice exam has 80 questions, so 56 correct answers is the pass mark.
Is the ISO 27001 Lead Auditor exam open book?
Yes. PECB allows a hard copy of ISO/IEC 27001, the training course materials and your own notes from the course.
Which edition of ISO 27001 is current?
ISO/IEC 27001:2022, the third edition, published in October 2022. ISO lists it as published and current.
Does the Lead Auditor credential let me audit for a certification body?
It is evidence of competence, not an appointment. Certification bodies work under ISO/IEC 17021-1 and set their own competence requirements for the auditors they use.
How much does the ISO 27001 Lead Auditor exam cost?
If you sit without a course, PECB's handbook lists the Lead Exam at $1,000 and the certification application fee at $500. A PECB partner course includes the first exam attempt, one free retake, the application fee and the first year's annual maintenance fee.
ISO 27001 Lead Auditor or CISA?
The ISO 27001 Lead Auditor audits one management system standard. ISACA's CISA covers IT audit across governance, acquisition, operations and protection of information assets. An auditor who certifies ISMSs needs the first; an IT auditor in an internal audit function often takes the second.
How long is the certification valid?
Three years. To renew, you complete the required CPD hours and pay the annual maintenance fee.
ISO/IEC 27001 Lead Auditor: test yourself in five minutes
Which books prepare you for the ISO 27001 Lead Auditor exam?
ISO 27001 Lead Auditor Exam Guide
PECB Certified ISO/IEC 27001 Lead Auditor. 14 chapters, 440 pages.
ISO 27001 Lead Auditor Practice Exams
Three complete practice papers with model answers and marking schemes. 319 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISO, ISO/IEC 27001:2022, edition 3, published October 2022
- PECB, ISO/IEC 27001 Lead Auditor Candidate Handbook, multiple-choice exam, version 1.5
- PECB, ISO/IEC 27001 Lead Auditor course: learning objectives, approach, prerequisites, retakes
- ISO, ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems
- Directive (EU) 2022/2555 (NIS2), OJ L 333, 27 December 2022, Article 21
- Regulation (EU) 2022/2554 (DORA), OJ L 333, 27 December 2022, Article 6
- O*NET OnLine, 15-1212.00 Information Security Analysts (BLS data)
- O*NET OnLine, 13-2011.00 Accountants and Auditors (BLS data)
- ISACA, Certification Exams Candidate Guide, version 1.26 (CISA)
Credential Press is not affiliated with, endorsed by or authorized by PECB, ISO, the IEC or ISACA. Exam names and trademarks belong to their owners.