Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
PECB's ISO/IEC 27701 Lead Auditor exam is 80 open-book questions in three hours, but the credential you walk away with depends on your logged audit hours. This guide covers the seven weighted exam domains, the four credential levels, fees and maintenance as of October 2026, and how the credential compares to CIPM and CDPSE.
PECB Certified ISO/IEC 27701 Lead Auditor is PECB's credential for professionals who plan, conduct and close audits of a privacy information management system (PIMS) against ISO/IEC 27701:2025.
A PIMS is the set of policies, roles, risk processes and controls an organization uses to manage personally identifiable information (PII) as a PII controller, a PII processor, or both. The auditor tests it with evidence, checking whether the privacy risk assessment reflects the processing that actually happens and whether the controls claimed in the Statement of Applicability work in practice. The exam covers that job across seven competency domains, from PIMS fundamentals through managing a full audit program.
The scheme is run under ISO/IEC 17024, and the International Accreditation Service (IAS) scope of accreditation lists ISO/IEC 27701 Lead Auditor by name. Passing the exam earns eligibility, not the title. The credential you hold depends on documented experience and logged audit hours, from Provisional Auditor up to Senior Lead Auditor. The credential is issued and maintained by PECB, the Professional Evaluation and Certification Board.
Terms, privacy principles, related standards, GDPR mapping. 15% of the exam.
Clauses 4 to 10, risk treatment, Annex A controls. 10% of the exam.
ISO 19011 principles, audit risk, evidence. 18.75% of the exam.
Objectives, scope, criteria, feasibility, audit plan. 12.5% of the exam.
Stage 1 and 2, evidence, sampling, findings. The heaviest at 25%.
Conclusions, closing meeting, report, action plans. 8.75% of the exam.
PDCA, audit records, surveillance, recertification. 10% of the exam.
Four things that set this credential apart from the privacy certifications most people meet first.
Most privacy certifications are earned at the testing center. Here the exam makes you eligible, and the evidence decides the rest. PECB checks your work history, counts your audit hours, and asks for two professional references before it decides whether you hold Provisional Auditor, Auditor, Lead Auditor or Senior Lead Auditor.
PECB teaches PIMS audits in line with ISO 19011, ISO/IEC 17021-1 and ISO/IEC 27706, the standard for bodies that certify privacy management systems. Stage 1 and stage 2, nonconformity reports, and the recommendation for certification are all on the exam.
You can bring a hard copy of the standard and your course notes, so the exam leans on judgment over recall. 43 of the 80 questions measure evaluation. Our look at how PECB exams and credentials work explains the format.
ISO/IEC 27701:2025, published in October 2025, is no longer an extension of ISO/IEC 27001. A PIMS can now be built and certified on its own, and the controls are grouped for PII controllers, PII processors, and a shared set that applies to both.
PECB bases its Lead Auditor course on the 2025 edition, and the current candidate handbook tests clauses 4 to 10 and the Annex A controls. PECB's ISO/IEC 27701 overview describes the change in its own words.
The credential, the exam, and what it takes to keep it, as PECB publishes them in October 2026.
The Lead Auditor credential proves you can examine a privacy management system. From there, people tend to move toward building one, auditing security and privacy together, or running the privacy program itself.
PECB's companion credential for the people who design and run the PIMS that auditors examine. It uses the same four-level ladder and, per PECB's exam list, the same 80-question, three-hour, open-book format. Its 300 hours at Lead level are PIMS project hours rather than audit hours.
The 2025 edition separated the two standards, but an organization that runs an ISMS and a PIMS side by side can have both audited together, and combined audits are part of this exam. PECB's ISO/IEC 27001 Lead Auditor exam follows the same 80-question, three-hour, open-book format, so the step across is mostly the standard itself.
The IAPP's privacy program management credential covers how to run the program an auditor reviews. Six domains, 90 questions in 2.5 hours, $550, and no experience requirement. Our CIPM guide has the full breakdown.
The credential sits in the middle of a privacy audit career. It builds on privacy knowledge and real audit hours, and it leads toward implementation, combined security and privacy audits, and privacy program roles.
Build the baseline
The anchor
Two questions to answer before you commit: which credential level you can reach today, and should you pursue a privacy audit credential at all. Here's a straight answer to both.
You can certify at Lead Auditor.
You have five years of professional experience, two of them in privacy management, and a total of 300 hours of audit activities such as planning audits, conducting on-site audits, drafting audit and nonconformity reports, following up on nonconformities, and leading an audit team. Pass the exam, sign the PECB Code of Ethics, name two professional references, and apply within 12 months of finishing the course.
You can still pass now.
Sit the exam and apply for Provisional Auditor, which needs no experience and no audit hours. At two years of experience (one in privacy management) and 200 audit hours you reach Auditor, and the Lead bar follows. Upgrades are requested online with a $100 application fee, and PECB evaluates each one to decide whether another exam is needed. Log your audit hours as you earn them, against PECB's list of qualifying activities, since PECB checks the hours when it evaluates each application.
The credential maps to first, second and third party privacy audit work, plus the compliance and advisory roles that live alongside it. These are the roles PECB writes the course for.
Leads stage 1 and stage 2 audits of privacy information management systems for a certification body, then writes the report and the certification recommendation. PECB names auditors who want to perform and lead PIMS certification audits first in its audience list.
Runs first-party audits of the organization's own PIMS against ISO/IEC 27701, samples processing activities, and reports findings into management review before the certification body ever shows up.
Keeps the PIMS conforming between audits: tracks nonconformities, owns corrective action plans, and makes sure controller and processor controls still match the Statement of Applicability.
Runs readiness reviews and gap assessments for clients preparing for ISO/IEC 27701 certification. PECB lists managers and consultants who need to master the PIMS audit process among the course's audience.
Audits processors and sub-processors that handle personal data on the organization's behalf. The exam covers second-party audits and auditing outsourced operations directly.
Joins an audit team as the subject-matter specialist on privacy engineering or data protection, advising auditors without acting as one. PECB lists technical experts and advisors on PII protection as part of the audience.
All three are privacy credentials, and they test different jobs. PECB's checks whether you can audit a PIMS against one standard, CIPM covers running a privacy program, and CDPSE is the engineering credential. Here's how they line up.
| ISO 27701 Lead Auditor | CIPM | CDPSE | |
|---|---|---|---|
| Issuer | PECB | IAPP | ISACA |
| Focus | Auditing a PIMS against ISO/IEC 27701:2025 | Privacy program management | Privacy engineering and technical controls |
| Exam Format | 80 questions, 3 hrs, open book | 90 questions, 2.5 hrs | 120 questions, 3.5 hrs |
| Experience | None for Provisional, 5 yrs + 300 audit hrs for Lead | None required | 3+ yrs in CDPSE domains |
| Passing Score | 70% | 300 on a 100 to 500 scale | 450 on a 200 to 800 scale |
| Exam Cost | $1,000 without training (included with partner training) | $550 | $575 member / $760 non-member |
| Renewal | 90 CPD hrs over 3 years | 20 CPE per 2-year term | 120 CPEs over 3 years (20 min/yr) |
| Best For | Privacy auditors and certification body auditors | Privacy program managers | Privacy engineers and architects |
Pricing and renewal details change and can vary by membership status. CIPM and CDPSE figures come from our CIPM guide and CDPSE guide. PECB figures come from the ISO/IEC 27701 Lead Auditor candidate handbook and PECB's certification maintenance policy.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our PECB ISO/IEC 27701 Lead Auditor boot camp runs four days, live online or in person, taught from official PECB courseware by a PECB Authorized Training Partner. The PECB exam, the certification application fee, one free exam retake within 12 months, and an attestation worth 31 CPD credits are all included.
How PECB credentials work, the auditor or implementer decision, privacy basics, and what an audit is actually for.
How PECB's credential tiers work, why passing the exam earns eligibility rather than the Lead title, and what an open-book PECB exam lets you bring into the room. The groundwork behind every PECB auditor credential, ISO/IEC 27701 included.
The same auditor or implementer decision you face with ISO/IEC 27701, worked through for ISO/IEC 27001: which seat you sit in, what each exam covers, and why the experience tiers decide what you hold.
What counts as personal data, how privacy differs from security, the principles behind most privacy laws, and which privacy certifications are worth a look.
ISACA's technical privacy credential, who it suits and who should skip it, and how it lines up against the IAPP's CIPP, CIPM and CIPT.
An audit checks whether controls exist and work as documented. A pen test checks whether they hold up under attack. Why the two answer different questions, and how they work together.
PECB splits the 80-question exam across seven competency domains, each with a fixed number of questions. Conducting the audit alone is 20 questions, so stage 2 evidence work deserves the most prep time. Click any domain for what it covers.
Twelve of the 80 questions. How ISO works and how ISO/IEC 27701 was developed, the main PIMS concepts and terms, the privacy principles behind the standard, and the laws, regulations, contracts and internal policies an organization has to meet. It also covers the related information security and privacy standards, the mapping between ISO/IEC 27701 requirements and the GDPR, and the privacy controls that apply to PII controllers and PII processors.
Eight questions on the requirements an auditor tests against: the structure of the standard and clauses 4 to 10, internal and external factors and interested parties, the PIMS scope and privacy policy, leadership and assigned roles, privacy risk assessment and treatment, the selection of Annex A controls and the Statement of Applicability, staff awareness and competence, performance evaluation through monitoring, internal audit and management review, and continual improvement.
Fifteen questions on the audit side of the job. The ISO 19011 principles (integrity, fair presentation, due professional care, confidentiality, independence, and the evidence-based and risk-based approaches), first, second and third party audits, the PECB Code of Ethics, inherent, control and detection risk, materiality, reasonable assurance, the types and reliability of audit evidence, the use of AI and big data in audits, and auditing outsourced operations.
Ten questions on the work before anyone arrives on site: the roles of the audit team leader, team members and technical experts, setting audit objectives, criteria and scope, the difference between the PIMS scope and the audit scope, audit feasibility, cultural aspects of an audit, the terms of the audit engagement and first contact with the auditee, and preparing the audit plan.
The heaviest domain at 20 questions. Stage 1 versus stage 2, the opening meeting, documented information review, communication during the audit, guides and observers, and conflict resolution. Evidence collection by interview, observation, analysis, sampling and technical verification, then corroboration and evaluation. It also covers audit checklists, remote and technology-assisted audits, clause-by-clause conformity checks against clauses 4 to 10 and Annex A, and writing findings and nonconformity reports.
Seven questions on finishing the job: evaluating the evidence to reach audit conclusions, justifying the recommendation for certification, presenting conclusions to the auditee's management, running the closing meeting, writing and distributing the audit report, and evaluating the action plans the auditee submits.
Eight questions on running audits as a program rather than one at a time. Building the program on the PDCA model, audit resources, procedures and policies, protecting the integrity, availability and confidentiality of audit records, combined audits, the personal attributes of a professional auditor, follow-up, surveillance and recertification audits, and reviewing the program so it stays effective.
Domains, question counts and weights reflect the PECB ISO/IEC 27701 Lead Auditor Candidate Handbook, Version 1.5 (2026). Badges show each domain's share of the 80 questions.
The questions candidates ask most often when researching the PECB Certified ISO/IEC 27701 Lead Auditor credential.
It is PECB's credential for auditing a privacy information management system (PIMS) against ISO/IEC 27701:2025. It shows you can plan, conduct and close a PIMS audit using ISO 19011 guidelines and the ISO/IEC 17021-1 certification audit requirements, and manage an audit program. PECB runs the scheme under ISO/IEC 17024.
PECB writes the course for auditors who want to perform and lead PIMS certification audits, managers and consultants who need to master the PIMS audit process, people responsible for keeping an organization conformant, technical experts preparing for a PIMS audit, and advisors on protecting personally identifiable information (PII). It assumes you already understand information security, privacy and audit principles.
The English exam has 80 multiple-choice questions over three hours, and it is open book. Each question has three options. Some stand alone and others come in sets of five tied to a scenario you read first. Of the 80 questions, 43 measure evaluation and 37 measure comprehension, application and analysis. You need 70 percent to pass.
PECB allows a hard copy of the ISO/IEC 27701 standard, the training course materials, and any personal notes you took during the course. Course materials and notes can be opened in the PECB Exams app or brought in printed. Phones and tablets are not allowed.
As of October 2026, PECB lists the Lead exam at $1,000 for candidates who sit it without a training course, plus a $500 certification application fee. If you train with a PECB partner, the course fee covers the first exam attempt, one free retake, the application fee, and the first year of the annual maintenance fee, all within 12 months of finishing the course.
The full Lead Auditor credential requires five years of professional experience, two of them in privacy management, plus 300 hours of audit activities. Auditor requires two years (one in privacy management) and 200 hours. Senior Lead Auditor requires ten years (seven in privacy management) and 1,000 hours. Every level requires the exam and signing the PECB Code of Ethics.
Yes. Passing the exam and meeting the experience bar are separate steps. If you pass without the experience, you can apply for PECB Certified ISO/IEC 27701 Provisional Auditor, which has no experience or audit-hour requirement. As your hours build, you can apply online to upgrade to Auditor or Lead Auditor. PECB charges a $100 application fee for an upgrade.
The domains are fundamental principles and concepts of a PIMS (15 percent), PIMS requirements (10 percent), fundamental audit concepts and principles (18.75 percent), preparing an ISO/IEC 27701 audit (12.5 percent), conducting an ISO/IEC 27701 audit (25 percent), closing an ISO/IEC 27701 audit (8.75 percent), and managing an ISO/IEC 27701 audit program (10 percent).
The 2025 edition. PECB bases its Lead Auditor course on ISO/IEC 27701:2025, published in October 2025 as a standalone management system standard. A PIMS no longer has to sit on top of an ISO/IEC 27001 ISMS, and the controls are grouped for PII controllers, PII processors, and both. PECB also runs a separate ISO/IEC 27701 Transition course on the changes from the 2019 edition.
PECB certifications are valid for three years. A Lead Auditor reports 90 continuing professional development (CPD) hours over the three-year cycle and pays annual maintenance fees, which PECB lists at $390 per three-year cycle. You also keep to the PECB Code of Ethics. Missing CPD or fees starts a 12-month suspension, and the certification is revoked if you don't fix it in that time. Provisional Auditor needs no maintenance.
PECB is accredited by the International Accreditation Service (IAS) as a personnel certification body under ISO/IEC 17024, and the IAS scope of accreditation lists ISO/IEC 27701 Lead Auditor by name. PECB's candidate handbook says the scheme is specified in compliance with ISO/IEC 17024.
Lead Implementer covers building and running a PIMS, and its Lead level counts 300 hours of PIMS project work. Lead Auditor sits on the other side of the table, so its 300 hours have to be audit activities such as planning audits and drafting nonconformity reports. Both use the same four-level ladder and, per PECB's exam list, the same 80-question, three-hour, open-book format.
The ISO 27701 Lead Auditor from PECB tests whether you can audit a PIMS against one named standard. CIPM from the IAPP covers running a privacy program, and CDPSE from ISACA covers building privacy into systems. CIPM has no experience requirement, CDPSE asks for three years, and PECB's Lead level asks for five years plus 300 audit hours.
It depends on whether audits are part of your job. The 2025 edition lets an organization certify its PIMS without an ISO/IEC 27001 certificate behind it, which opens privacy certification to organizations that never built an ISMS. If you audit or plan to, the credential matches the work. If you build privacy programs rather than examine them, Lead Implementer or CIPM is the closer fit.
Whether you're working out which credential level you can reach, planning around audit hours, or training a team ahead of a PIMS certification, tell us where you are and we'll help you map out the right path.