Independent guide · United Kingdom · Edition 2026-10
ISO qualifications, set out clause by clause — and how to prepare for them
Every common ISO management-system qualification in one place: what each standard covers, what foundation, internal auditor, lead auditor and lead implementer courses involve, who runs them in the UK, and a study plan to get you through.
0 Introduction
ISO writes the standards, but it does not train or certify people. An “ISO qualification” is really a course certificate from a training provider — often certified by a scheme such as CQI and IRCA or PECB — for one standard at one level. Some people then go on to register as an auditor with a scheme, which also needs audit experience.
So choosing a qualification means choosing three things: the standard, the level, and the scheme behind the certificate.
- 1Pick the standard your work uses — quality, environment, safety, information security…
- 2Pick the level — foundation to understand it, internal auditor to audit your own organisation, lead auditor to lead audits, lead implementer to build the system.
- 3Compare courses by scheme, length and format, then prepare with a study plan and practice questions.
1 Qualification matrix
Standards down the side, levels across the top. Numbers show how many UK courses we list for each.
| Standard | Foundation | Internal auditor | Lead auditor | Implementer | Conversion | Transition |
|---|---|---|---|---|---|---|
| ISO 9001Quality management | 10 | 10 | 9 | 5 | 1 | 5 |
| ISO 14001Environmental management | 6 | 8 | 6 | 4 | 4 | 4 |
| ISO 45001Occupational health and safety | 4 | 5 | 6 | 4 | 4 | – |
| ISO/IEC 27001Information security | 6 | 7 | 8 | 7 | 4 | 2 |
| ISO 22301Business continuity | 6 | 3 | 3 | 5 | 2 | – |
| ISO 50001Energy management | 3 | 3 | 2 | 1 | 1 | – |
| ISO 22000Food safety | 1 | 4 | 2 | – | – | – |
| ISO 13485Medical devices quality | 5 | 5 | 3 | 3 | – | – |
| ISO/IEC 20000-1IT service management | – | – | – | – | 1 | – |
| ISO/IEC 27701Privacy information management | 2 | – | 1 | 2 | – | 1 |
| ISO/IEC 42001Artificial intelligence management | 6 | 3 | 4 | 4 | 1 | – |
| ISO 37001Anti-bribery management | 3 | – | – | – | – | – |
| ISO 19011Auditing management systems (guidance) | – | – | – | – | – | – |
| ISO 31000Risk management (guidance) | 2 | – | – | 2 | – | – |
Qualification page — number = UK courses we list (· = none listed yet). – = no qualification of this type that we list.
2 Revision watch
Several standards changed recently. Make sure your course teaches the current edition.
| Standard | Current edition | Status (checked 3 October 2026) |
|---|---|---|
| ISO 9001 Quality management | ISO 9001:2026 | New edition ISO 9001:2026 was published on 16 September 2026. Certified organisations move across during a transition period — LRQA expects about three years; your certification body confirms the dates. |
| ISO 14001 Environmental management | ISO 14001:2026 | New edition ISO 14001:2026 was published in April 2026. UKAS says certified organisations must transition by 30 April 2029. |
| ISO/IEC 27701 Privacy information management | ISO/IEC 27701:2025 | New edition The 2025 edition turned ISO/IEC 27701 into a standalone management-system standard. UKAS expects certification bodies to have moved all certified clients to it by 31 October 2028. |
| ISO 37001 Anti-bribery management | ISO 37001:2025 | New edition Second edition published February 2025. DQS states certified sites must complete transition by 28 February 2027. |
| ISO 19011 Auditing management systems (guidance) | ISO 19011:2026 | New edition ISO 19011:2026 was published in May 2026. As a guidance standard there is no certification transition, but auditor courses are being updated to it. |
| ISO 45001 Occupational health and safety | ISO 45001:2018 | Revision under way iso.org lists ISO 45001:2018 as “to be revised”, with a new edition under development at ISO/DIS (draft international standard) stage. |
| ISO 22301 Business continuity | ISO 22301:2019 | Revision under way iso.org lists ISO 22301:2019 as “to be revised”, with a new edition under development at committee draft (ISO/CD) stage. |
| ISO 22000 Food safety | ISO 22000:2018 | Revision under way iso.org lists ISO 22000:2018 as “to be revised”, with a new edition under development at ISO/DIS stage. |
| ISO 31000 Risk management (guidance) | ISO 31000:2018 | Revision under way iso.org lists ISO 31000:2018 as “to be revised”, with a new edition under development at committee draft (ISO/CD) stage. |
3 Qualification types
The same levels appear across most standards. Typical course length depends on the scheme.
- 3.1 Foundation / requirements An introduction to a standard: what it requires, the vocabulary and how the clauses fit together. Usually one or two days, with a short test or none. The usual first step, and often a recommended prerequisite for auditor courses.
- 3.2 Internal auditor Teaches you to plan, carry out, report and follow up internal (first-party) audits of your own organisation’s management system. Usually two days, assessed by continuous assessment and a short test.
- 3.3 Lead auditor The full auditor course: how to plan, lead and report first-, second- and third-party audits of a complete management system. Usually 4–5 days (about 40 hours) with continuous assessment and an exam. The qualification most auditor job adverts ask for.
- 3.4 Implementer / lead implementer How to design, build and run a management system that meets a standard — from gap analysis and scoping to documentation, risk assessment, internal audit and certification readiness. Shorter “implementation” courses take 1–2 days; lead implementer courses 3–5 days with an exam.
- 3.5 Auditor conversion For people who already hold a lead auditor certificate in one standard and want to audit another — for example a quality lead auditor moving into ISO 14001 or ISO 27001. About three days, with an exam.
- 3.6 Transition (new edition) Short courses explaining what changed when a standard is revised — such as ISO 9001:2026 and ISO 14001:2026 — and how to audit or implement the new requirements. From a few hours to two days.
4 Prepare
Study plans written for working people: what to read, which clauses to know, how the audit process fits together, and what to expect on exam day.
- How ISO qualifications work
- The Harmonized Structure: clauses 4 to 10 explained
- The audit process step by step (ISO 19011)
- Lead auditor: a 4-week study plan
- Internal auditor: a 2-week study plan
- Foundation: getting started with a standard in 2 weeks
- Lead implementer: a 3-week study plan
- Conversion and transition courses: how to prepare
5 Practice
Original questions with explanations. They are for practice only — they are not taken from any real exam.
- Harmonized Structure (clauses 4–10) 9 questions
- Auditing principles and ISO 19011 12 questions
- Audit findings and nonconformities 8 questions
- ISO 9001:2026 quality management 8 questions
- ISO 14001:2026 environmental management 7 questions
- ISO 45001 occupational health and safety 7 questions
- ISO/IEC 27001:2022 information security 8 questions
- ISO 22301 business continuity 6 questions
- ISO 50001 energy management 6 questions
- ISO/IEC 42001 AI management 6 questions
- Certification schemes and auditor registration 9 questions
6 UK training providers
Who runs which courses, with links to their own course pages. We record durations and certification as each provider states them.
| Provider | Courses listed | Certification schemes |
|---|---|---|
| NQA | 38 | CQI and IRCA (internal auditor, lead auditor and conversion courses, with CQI|IRCA course numbers) |
| BSI | 37 | CQI and IRCA (ISO 9001 and ISO 14001 lead auditor courses); other courses carry BSI certificates |
| Bywater | 36 | CQI and IRCA; ISEP (ISO 14001 courses); IOSH (ISO 45001 introduction) |
| LRQA | 27 | CQI and IRCA (lead auditor and conversion courses) |
| Firebrand Training | 20 | PECB |
| Batalas | 16 | CQI and IRCA |
| Amtivo (British Assessment Bureau) | 15 | CQI and IRCA (ISO 9001 lead auditor course) |
| DNV | 14 | IRCA-CQI (as titled by DNV) |
| ISOQAR | 4 | CQI and IRCA |
| GRC Solutions (formerly IT Governance) | 3 | IBITGQ (International Board for IT Governance Qualifications) |
| IMSM | 3 | CPD certificate (as stated) |
| SGS United Kingdom | 0 | IRCA (as stated on the UK training page) |
| Bureau Veritas UK | 0 | — |
7 How we check facts
Editions and revision stages come from each standard’s page on iso.org; course levels, exam formats and auditor grades from the schemes themselves; course names, durations and links from each provider’s own website. Each fact is dated. Courses change, so please confirm details with the provider before you book. More about our method.