Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A plain reference to PECB's ISO/IEC 27001 Lead Auditor credential as of October 2026: the seven exam domains and their weights, the 80-question open-book exam, the four credential levels and the audit hours behind each, fees, maintenance, and how it compares to Lead Implementer and CISA. Written for anyone weighing the credential or trying to understand what it actually covers.
PECB Certified ISO/IEC 27001 Lead Auditor is a personnel certification for auditing an information security management system (ISMS) against ISO/IEC 27001:2022 and leading the team that does it.
PECB, the Professional Evaluation and Certification Board, builds the course and the exam around how certification audits actually run. ISO 19011 supplies the audit principles and ISO/IEC 17021-1 supplies the certification process, so the material moves from planning and the stage 1 and stage 2 audits to the closing meeting, the audit report and follow-up on nonconformities. Knowing the 93 Annex A controls helps, but the exam cares more about whether you can judge the evidence behind them.
Passing the exam makes you eligible to apply, and the level you receive depends on what you can document. PECB awards one of four levels (Provisional Auditor, Auditor, Lead Auditor or Senior Lead Auditor) based on your work experience and logged audit hours. The scheme is run in compliance with ISO/IEC 17024, and both IAS and UKAS list this credential in their accreditation scopes for PECB. The credential is issued and maintained by PECB, whose ISO/IEC 27001 certification scheme dates back to a first release in January 2010.
Security concepts, risk, control types and the standards around ISO/IEC 27001. 16.25% of the exam.
Clauses 4 to 10, the 93 Annex A controls and the Statement of Applicability. 10% of the exam.
ISO 19011 principles, evidence types and auditor ethics. 17.5% of the exam.
Objectives, scope, criteria, feasibility and materiality. 15% of the exam.
Stage 1 and stage 2, evidence, sampling and findings. The heaviest domain at 22.5%.
Conclusions, the certification recommendation and the audit report. 8.75% of the exam.
Surveillance, recertification, audit records and auditor performance. 10% of the exam.
Four things that set this PECB credential apart from the security exams most people sit first.
PECB builds the course and exam on ISO 19011 audit guidelines and the ISO/IEC 17021-1 process that certification bodies operate under. You learn the stage 1 and stage 2 sequence, how to write a nonconformity the auditee can act on, and what a certification recommendation has to rest on. It plays more like a rehearsal for audit work than a quiz on controls.
You can bring a hard copy of ISO/IEC 27001, the course materials and your own notes. That helps less than it sounds. Half of the 80 questions measure evaluation, many come in sets of five tied to one scenario, and each has three options, one correct and two distractors.
Everyone sits the same exam. Your work history and audit hours then decide whether you hold Provisional Auditor, Auditor, Lead Auditor or Senior Lead Auditor. Our comparison of Lead Auditor and Lead Implementer explains why logging hours early saves trouble later.
PECB runs this scheme in compliance with ISO/IEC 17024:2012, the standard for bodies that certify people. The International Accreditation Service lists ISO/IEC 27001 Lead Auditor in PECB's accredited scope (PCB-111), and the UKAS schedule issued August 27, 2026 lists PECB Certified ISO/IEC 27001 Lead Auditor against version 4.7 of the scheme.
PECB doesn't claim a DoD 8140 listing for this credential. If a federal audit or assessment role needs one, CISA is approved at the Advanced level. PECB lists every accreditation it holds on its accreditations page.
The certification, the exam and what it takes to keep the credential active, as of October 2026.
Lead Auditor proves you can audit an ISMS. From there, holders tend to learn the build side, work toward PECB's Master credential, or carry the same audit method to another standard.
PECB's ISO/IEC 27001 Lead Implementer covers the other side of the table: planning, implementing, monitoring and improving an ISMS, then preparing it for certification. The exam format matches (80 open-book questions in three hours), and the Lead level asks for the same five years with 300 hours of project work instead of audit work.
The top credential in PECB's ISO/IEC 27001 scheme. It requires passing both the Lead Auditor and Lead Implementer exams, 20 years of experience with 10 in a leadership role in the field, and 5,000 hours that combine audit and project work. Treat it as a long-term target rather than a next step.
PECB runs Lead Auditor credentials on other management system standards too, including ISO/IEC 27701 for privacy, ISO/IEC 42001 for AI and ISO 22301 for business continuity. Each lists the same 80-question, three-hour, open-book exam format, so most of the new work is the standard you'll be auditing.
Lead Auditor anchors an ISMS audit career. It builds on general security knowledge and some time spent around an ISMS, then leads toward implementation, broader IT audit, or risk and governance work.
Build the baseline
The anchor
Two questions to answer before you commit: can you certify at the level you want, and should you pursue this credential specifically. Here's a straight answer to both.
You can certify at Lead Auditor.
You have five years of professional experience, two of them in information security management, and at least 300 hours of audit work such as planning audits, on-site audits, drafting nonconformity reports and leading an audit team. Pass the exam, apply with two professional references, sign the PECB Code of Ethics, and you hold the Lead Auditor credential.
You can still pass now.
Nothing stops you from sitting the exam first. With no experience you apply as a Provisional Auditor, and two years (one in information security management) plus 200 audit hours gets you Auditor. As your hours grow, you upgrade through your PECB account for a US$100 fee, and PECB decides whether another exam is needed. Start an audit log now with the date, client, scope and your role for each audit.
The credential maps to audit, assurance and compliance roles wherever ISO/IEC 27001 certification matters, from certification bodies to internal audit and supplier risk teams.
Audits client ISMSs for a certification body, from the stage 1 documentation review through the stage 2 audit, surveillance and recertification. PECB builds the Lead Auditor course on the ISO/IEC 17021-1 process these auditors work under.
Runs the internal audits ISO/IEC 27001 requires under clause 9.2 and reports results to management. The credential covers planning that audit program and writing findings an auditee can act on.
Sets the audit plan, runs the opening and closing meetings, and owns the conclusions on an engagement. Leading an audit team is one of the activities PECB counts toward the 300 audit hours the Lead level asks for.
Assesses vendors and suppliers against ISO/IEC 27001 as second-party audits, judging whether their controls and certificates hold up before a contract is signed or renewed.
Keeps an organization in conformity with its ISMS requirements between external audits. PECB names the people responsible for maintaining that conformity as part of the audience for this credential.
Runs readiness assessments and gap analyses before the certification audit arrives. PECB lists managers and consultants who want to master the ISMS audit process among the people the course is built for.
Lead Auditor and Lead Implementer share a standard and an exam format but sit on opposite sides of the audit. CISA covers IT audit well beyond one standard. Here's how the three line up.
| 27001 Lead Auditor | 27001 Lead Implementer | CISA | |
|---|---|---|---|
| Issuer | PECB | PECB | ISACA |
| Focus | Auditing an ISMS against ISO/IEC 27001 | Building and running an ISMS | Information systems audit |
| Exam Format | 80 questions, 3 hours, open book | 80 questions, 3 hours, open book | 150 questions, 4 hours |
| Experience | Lead: 5 yrs (2 in infosec) + 300 audit hrs | Lead: 5 yrs (2 in infosec) + 300 project hrs | 5 yrs in IS audit, control, or security |
| Passing Score | 70% | 70% | 450 / 800 |
| Renewal | 90 CPD hours over 3 years | 90 CPD hours over 3 years | 120 CPEs over 3 years |
| Accreditation | ISO/IEC 17024 (IAS, UKAS) | ISO/IEC 17024 (IAS, UKAS) | ANAB (ISO/IEC 17024) |
| DoD 8140 Approved | Not claimed by PECB | Not claimed by PECB | Yes (Advanced) |
| Best For | Internal and certification body auditors | ISMS managers and implementation leads | IT auditors and assurance pros |
PECB figures are for the Lead level of each scheme. Fees and requirements change, so check PECB and ISACA before you register. Many practitioners eventually hold more than one of these credentials.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our PECB authorized boot camp covers all seven exam domains over four days, live online or in person. Official PECB courseware, the exam, the certification application fee, one free retake and a 31 CPD attestation are included, and you sit the exam at the end of the course.
Choosing between audit and implementation, what an audit really checks, GRC careers, and the regulation pushing more companies toward ISO 27001.
Lead Implementer builds the ISMS and Lead Auditor judges whether it holds up. Which one fits the seat you actually occupy, how the exams and credential tiers line up, and why audit hours are the real gate.
What a security audit checks against a standard like ISO 27001, what a penetration test finds instead, and why passing one never stands in for the other.
GRC postings mix CRISC, CISA, CISSP and CGRC in every combination. How the main governance, risk and compliance credentials divide the work, and where hands-on ISO 27001 experience counts.
What the EU NIS2 Directive asks of American companies operating in Europe, and how much of it an existing ISO 27001 program already covers before the gaps show up.
Why the major salary sources disagree on what IT auditors with CISA earn, and how pay shifts by role. Useful context if you are weighing CISA alongside an ISO 27001 audit credential.
PECB organizes the exam into seven competency domains, each with a published share of the 80 questions. Click any domain for what it covers.
The groundwork for everything after it. Information security concepts and terminology, the laws, regulations, standards and contracts an organization has to comply with, how risk applies to security, and the difference between an information asset, data and a record. It also covers control attributes, preventive, detective and corrective controls, and what big data, AI, machine learning, cloud computing and outsourcing change. 13 of the 80 questions.
The standard itself. The structure of ISO/IEC 27001:2022, the requirements in clauses 4 to 10, and the 93 Annex A controls and how they land in the Statement of Applicability. It also covers ISMS scope and policy, leadership commitment, risk assessment and treatment, performance evaluation, internal audit, management review and continual improvement. Only 8 questions, which is light for how much material it holds.
How auditing works before you apply it to an ISMS. Audit terminology from ISO 19011, first, second and third party audits, and the principles of auditing, from integrity and fair presentation to independence and the evidence-based and risk-based approaches. It adds audit evidence types, ethics under the PECB Code of Ethics, auditing outsourced operations and the use of big data in audits. All 14 questions measure evaluation.
Everything that happens before you arrive on site. Audit objectives, scope and criteria, the difference between the ISMS scope and the audit scope, audit feasibility, materiality and reasonable assurance, and the risk-based approach with inherent, control and detection risk. It also covers team roles, cultural factors and the terms of the engagement with the auditee. 12 questions.
The heaviest domain. Stage 1 and stage 2 audits, the opening meeting, communication and conflict resolution, and evidence collection through interview, documented information review, observation, analysis, sampling and technical verification. It also covers sampling methods, checklists, working papers, audit test plans and turning evidence into audit findings. All 18 questions measure evaluation.
Wrapping up the engagement. Preparing audit conclusions, justifying the recommendation for certification, running the closing meeting, writing and distributing the ISO/IEC 27001 audit report, and evaluating the action plans the auditee proposes. 7 questions, the smallest share of the exam.
The long view of audit work. Follow-up, surveillance and recertification audits, the conditions for modifying, suspending or withdrawing an organization's certification, the PDCA cycle applied to an audit program, protecting audit records, combined audits, and monitoring the competence and performance of each auditor. All 8 questions measure evaluation.
Domains and weights reflect the PECB ISO/IEC 27001 Lead Auditor Candidate Handbook (version 1.5, 2026) and the ISO/IEC 27001 Certification Scheme (version 4.7). Half of the 80 questions measure evaluation, all of them in domains 03, 05 and 07.
The questions candidates ask most often when researching the PECB Certified ISO/IEC 27001 Lead Auditor certification.
It is PECB's personnel certification for auditing an information security management system (ISMS) against ISO/IEC 27001:2022 and leading the audit team. The exam covers seven competency domains, from ISMS fundamentals through conducting and closing an audit to managing an audit program, and the course follows ISO 19011 audit guidelines and the ISO/IEC 17021-1 certification process.
It fits people who audit an ISMS or want to: internal auditors, auditors at or moving toward a certification body, consultants who run readiness assessments, and staff who keep an organization in conformity with ISO/IEC 27001. If you build and run the ISMS rather than audit it, ISO/IEC 27001 Lead Implementer is usually the better first choice.
As of October 2026, PECB lists the Lead exam at US$1,000 if you take it without a training course, plus a US$500 certification application fee. A course from a PECB partner includes the first exam attempt, one free retake, the application fee and the first year of the annual maintenance fee, and that cycle has to be completed within 12 months of an instructor-led course.
It's 80 multiple-choice questions in three hours, and you need 70 percent to pass. Each question has three options. Many are scenario-based, with five questions tied to one scenario. The exam is open book, so you can use a hard copy of ISO/IEC 27001, your course materials and your own notes. Online results appear as soon as you submit.
For the Lead Auditor level, PECB asks for five years of professional experience, two of them in information security management, and 300 hours of audit activity. Valid audit work includes planning audits, on-site audits, drafting audit and nonconformity reports, following up on nonconformities and leading an audit team. You also need two professional references and must sign the PECB Code of Ethics.
Yes. No experience is needed to sit the exam or to hold the Provisional Auditor level. Two years of experience, one of them in information security management, plus 200 audit hours qualifies you for Auditor. As your hours grow you can upgrade online for a US$100 fee, and PECB evaluates whether another exam is needed.
The domains are fundamental principles and concepts of an ISMS (16.25 percent), the ISMS and ISO/IEC 27001 requirements (10 percent), fundamental audit concepts and principles (17.5 percent), preparing an audit (15 percent), conducting an audit (22.5 percent), closing an audit (8.75 percent), and managing an audit program (10 percent). Conducting an audit is the heaviest, at 18 of the 80 questions.
PECB certifications are valid for three years. A Lead Auditor reports 90 CPD hours across the cycle (Auditor needs 60 and Senior Lead Auditor 180) and pays the annual maintenance fee, which PECB lists at US$390 per three-year cycle. The hours don't have to be even from year to year. Missing CPD or fees leads to a 12-month suspension and then possible revocation.
Yes. PECB runs the scheme in compliance with ISO/IEC 17024:2012. The International Accreditation Service lists ISO/IEC 27001 Lead Auditor in PECB's accredited scope (PCB-111), and the UKAS schedule for PECB (accreditation number 21923) lists PECB Certified ISO/IEC 27001 Lead Auditor. PECB doesn't claim a DoD 8140 listing for it.
Lead Auditor and Lead Implementer are both PECB credentials on ISO/IEC 27001 with the same exam format. Lead Auditor evaluates an ISMS, and Lead Implementer builds and runs one. CISA from ISACA is a broader IT audit credential with a 150-question, four-hour exam, a five-year experience requirement and DoD 8140 approval at the Advanced level.
The 2022 edition. PECB moved its ISO/IEC 27001 certification scheme to ISO/IEC 27001:2022 in December 2022, and the current exam tests the 2022 clause structure and the 93 controls in Annex A. The scheme in force is version 4.7, dated December 2025, which is the version UKAS references in its accreditation schedule.
If your work involves auditing an ISMS, whether inside your organization, at suppliers or for a certification body, it ties directly to that job and it's accredited under ISO/IEC 17024. Its weight depends on your audit hours, though. A Provisional credential with no logged audits says less than the Lead level, so start logging hours early. If you never audit, it's the wrong pick.
Whether you're weighing the certification, working out funding, or planning training for a team, tell us where you are and we'll help you map out the right path.