Information security · Lead auditor
ISO/IEC 27001 Lead auditor
The full auditor course: how to plan, lead and report first-, second- and third-party audits of a complete management system. Usually 4–5 days (about 40 hours) with continuous assessment and an exam. The qualification most auditor job adverts ask for.
1 About this qualification
This is a lead auditor course applied to ISO/IEC 27001, the standard for information security.
Requirements for an information security management system: assessing information security risks, treating them with appropriate controls, and keeping the system effective. Annex A lists 93 reference controls in four themes.
2 UK courses
Course names, certification, duration and delivery as stated by each provider. We do not list prices — they change often; see the provider’s page.
| Course (as named by the provider) | Provider | Certified by | Duration | Link |
|---|---|---|---|---|
| Lead Auditor Training Course - ISO/IEC 27001:2022Classroom; Live online; In-house | BSI | Not stated | 4 days | Course pagechecked 3 October 2026 |
| ISO 27001:2022 Lead Auditor - CQI & IRCA CertifiedClassroom; Virtual classroom; In-house | LRQA | CQI and IRCA certified | 5 days | Course pagechecked 3 October 2026 |
| CQI and IRCA ISO 27001 Lead Auditor Training (A2573)Virtual – tutor led | NQA | CQI and IRCA certified | 5 days | Course pagechecked 3 October 2026 |
| ISO 27001 Lead Auditor Training Course - CQI and IRCA Certified | Bywater | CQI and IRCA certified | 5 days | Course pagechecked 3 October 2026 |
| ISO/IEC 27001:2022 Lead Auditor Course — CQI|IRCA ref PR373 | Batalas | CQI and IRCA certified | 5 days | Course pagechecked 3 October 2026 |
| ISO 27001 Lead Auditor – Online and Classroom TrainingOnline; Classroom | Amtivo (British Assessment Bureau) | Not stated | 5 days | Course pagechecked 3 October 2026 |
| Certified ISO 27001:2022 ISMS Lead Auditor Training CourseLive online; Self-paced online; In-house | GRC Solutions (formerly IT Governance) | IBITGQ CIS LA exam; qualification valid three years | 5 days | Course pagechecked 3 October 2026 |
| ISO 27001 Lead Auditor — Information Security Management System | Firebrand Training | PECB | See provider | Course pagechecked 3 October 2026 |
Certified by: CQI and IRCA certified (4) · Not stated (2) · IBITGQ CIS LA exam; qualification valid three years (1) · PECB (1). What the schemes mean.
3 How it is assessed
| Scheme | Typical length | Assessment |
|---|---|---|
| CQI and IRCA | Approx. 40 hours — usually 5 days (some providers run 4 longer classroom days) | Continuous assessment plus an exam. CQI and IRCA’s course table describes a 2-hour written examination; some providers now use an online multiple-choice exam after the course (Batalas: 1 hour 45 minutes, within 30 days) |
| PECB | 5 days, exam on day 5 | PECB exam — the ISO/IEC 27001 Lead Auditor handbook describes 80 multiple-choice questions, open book, 70% pass mark |
| IBITGQ (GRC Solutions, ISO 27001 only) | 5 days | CIS LA exam; qualification valid for three years |
| Provider-certified (e.g. BSI for some standards) | 4–5 days | Written exam and skills assessment, as stated by the provider |
4 How to prepare
- Lead auditor: a 4-week study planFour weeks of evening study (about 5 hours a week) before a five-day lead auditor course — what to read, what to practise and how to arrive…
- ISO/IEC 27001: structure and key clausesThe clauses to know before day one.
Practice questions
- ISO/IEC 27001:2022 information security 8 questions
- Harmonized Structure (clauses 4–10) 9 questions
- Audit findings and nonconformities 8 questions
- Certification schemes and auditor registration 9 questions
5 Other ISO/IEC 27001 qualifications
- ISO/IEC 27001 Foundation / requirements 6 courses
- ISO/IEC 27001 Internal auditor 7 courses
- ISO/IEC 27001 Implementer / lead implementer 7 courses
- ISO/IEC 27001 Auditor conversion 4 courses
- ISO/IEC 27001 Transition (new edition) 2 courses