Frequently asked questions

No. ISO writes the standards but says it does not perform certification or issue certificates. Qualifications are course certificates from training providers — often certified by a scheme such as CQI and IRCA or PECB — and, separately, auditor registrations from those schemes. See how ISO qualifications work.

If the standard is new to you, a foundation or requirements course. If you will audit your own organisation, an internal auditor course. If you want to audit suppliers or work for a certification body, a lead auditor course — but know the standard well before you start.

CQI and IRCA describe lead auditor courses as approximately 40 hours. In the UK that is usually five days, though some providers run four longer classroom days. PECB lead auditor courses are five days with the exam on day 5. See the lead auditor page.

Pass rates are not published consistently, so we cannot say. People who arrive already knowing the standard and the audit process generally find the course much easier. Exams are scenario-based: you need to apply clauses and auditing principles, not recite them. Our 4-week study plan and practice quizzes help.

Both certify ISO training. CQI and IRCA certify courses run by approved training partners and register auditors in grades from Associate to Principal Auditor. PECB runs its own courses and exams through partners and issues credentials from Provisional to Senior Lead Auditor or Implementer, graded by experience. See certification schemes.

Not on its own. The course certificate is training. To be registered — for example as an IRCA Auditor or Lead Auditor — you also need audit experience: for IRCA Lead Auditor, seven audits totalling at least 35 days (25 on site), three of them as team leader. See auditor career paths.

It depends on the scheme. PECB certifications are valid for three years and are maintained with CPD and an annual fee. IRCA certification lasts five years before recertification. A plain course certificate may not expire, but employers and schemes often look for training on the current edition of a standard.

ISO 9001:2026 was published on 16 September 2026. Your course certificate still shows what you were trained in; for auditing work you may be asked to show you know the new edition, which a short transition course covers. Organisations certified to ISO 9001:2015 have a transition period — LRQA expects about three years.

Yes. Most UK providers run live online (virtual classroom) versions of their courses, and many offer eLearning for foundation-level courses. CQI and IRCA courses normally require full attendance, and exams may be taken online. Check the delivery options in the course finder.

Many people do, but you will need to understand information security risk, the Statement of Applicability and the Annex A control themes. A foundation course or careful study first helps. Courses in the UK carry CQI and IRCA, PECB or IBITGQ certificates — check which one your employer prefers.

Course prices change often and vary with format, dates and offers. We link to each provider’s course page so you can see the current price. We list course names, durations and certification exactly as the provider states them, with the date we checked.

The brief for this site mentioned ISO qualifications offered by “CFA”. We could not identify an ISO training or certification organisation of that name in the sources we checked, so the guide covers the main UK providers and certification schemes instead. If you know which organisation was meant, please contact us.