Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
What you need to know about PECB's compliance management system audit credential as of 2026: the seven exam domains and their weights, the open-book exam, the four credential levels and the audit hours behind them, fees, CPD rules, and how it compares to ISO/IEC 27001 Lead Auditor, ISO 37001 Lead Auditor and CISA. A reference guide for anyone weighing the credential or trying to understand what it covers.
It is PECB's credential for auditing a compliance management system (CMS) against ISO 37301:2021, the ISO standard that turned compliance management from guidance into requirements an organization can be certified against.
A CMS is the set of policies, processes and controls an organization uses to find its compliance obligations and meet them. Those obligations include laws, regulations, permits and licenses, plus the codes of conduct and commitments it chooses to adopt. The Lead Auditor credential shows you can plan that audit, lead a team through it, gather evidence, write nonconformity reports and follow up, using the guidelines in ISO 19011 and the certification audit process in ISO/IEC 17021-1.
The exam is only the first step. Which of PECB's four auditor levels you hold (Provisional Auditor, Auditor, Lead Auditor or Senior Lead Auditor) depends on the experience and audit hours you can document. The scheme runs in compliance with ISO/IEC 17024 and falls within PECB's IAS accreditation. The credential is issued and maintained by PECB, the Professional Evaluation and Certification Board.
Scope, related standards, ethics and tone at the top. 13.75% of the exam.
Clauses 4 to 10 of ISO 37301. 12.5% of the exam.
ISO 19011 principles, materiality and audit risk. 20% of the exam.
Scope, feasibility, the audit plan and test plans. 12.5% of the exam.
Stage 1 and stage 2, evidence and sampling. The heaviest at 25%.
Findings, nonconformities, the report and follow-up. 7.5% of the exam.
PDCA, audit records and auditor performance. 8.75% of the exam.
Four things that separate this credential from a general audit certification.
ISO 19600, published in 2014, was guidance only. An organization could follow it but could not be certified against it. ISO 37301 replaced it in April 2021 with requirements a third party can audit. Every certification audit against it needs someone who can test those requirements clause by clause, and that someone is the lead auditor.
You can bring a hard copy of ISO 37301, the course materials and your own notes. The book will not answer the questions for you, though. 49 of the 80 are written to measure evaluation, and scenario-based items come in groups of five built around one case.
Passing does not make you a Lead Auditor by itself. PECB checks your work history, your logged audit hours and two references before it assigns a level. Our guide to how PECB exams and credentials work walks through the tiers.
PECB's candidate handbook describes the ISO 37301 Lead Auditor scheme as compliant with ISO/IEC 17024, the international standard for bodies that certify people. The International Accreditation Service lists ISO 37301 Lead Auditor in PECB's accredited scope under certificate PCB-111.
PECB doesn't claim a DoD 8140 listing for this credential. If a federal audit role requires one, CISA is approved at the Advanced level. PECB lists the accreditations it holds on its accreditations page.
The credential, the exam and what it takes to keep it. Fees are PECB list prices in US dollars as of October 2026.
ISO 37301 Lead Auditor proves you can audit a compliance program. From there, the natural moves are the implementation side of the same standard, a second compliance standard, or IT audit.
PECB's implementation credential on the same standard. Where the auditor tests a CMS, the implementer plans and builds one and gets it ready for certification. Same exam format (80 questions, three hours, open book), with 300 hours of CMS project activity for the Lead level.
PECB's audit credential for anti-bribery management systems, a narrower standard than ISO 37301 and its full range of compliance obligations. It follows the same seven-domain audit structure and asks for two years in anti-bribery management at the Lead level.
ISACA's Certified Information Systems Auditor moves you from compliance obligations to information systems and IT controls. It suits auditors whose scope keeps drifting into technology, and it requires five years of IS audit, control, or security experience.
It builds on compliance or audit experience and a working knowledge of the standard. From there it leads into implementation, other ISO management system audits, and IT audit as your work gets more senior.
Build the baseline
The core credential
Two questions to answer before you commit: can you reach the Lead Auditor level, and should you pursue this credential specifically. Here's a straight answer to both.
You can certify in full.
You have five years of professional experience, two of them in compliance management, and at least 300 hours of audit activity such as planning audits, leading an audit team, conducting on-site audits and drafting nonconformity reports. Pass the exam, sign the PECB Code of Ethics, name two professional references, and you can hold the full Lead Auditor credential.
You can still pass now.
The exam is the same for every level. With no experience you can apply as Provisional Auditor, and with two years (one in compliance management) plus 200 audit hours you qualify as Auditor. Upgrade online once your hours catch up, for a $100 fee. Apply within 12 months of finishing an instructor-led course, or the case closes and reopening it costs extra.
The credential maps to compliance audit, assurance and advisory work, on both sides of a certification audit. These are the roles where an ISO 37301 audit background gets used every week.
Plans and leads audits of a compliance management system against ISO 37301, testing whether obligations are identified, assessed and actually met. The job this credential is named for.
Audits client organizations on behalf of a certification body, working to ISO/IEC 17021-1. PECB says the Lead Auditor course can potentially qualify you to audit for conformity assessment bodies.
Runs the internal audits ISO 37301 requires under clause 9 and reports to management review on how the compliance program is performing, not just whether the paperwork exists.
Owns the compliance management system day to day. Auditor training tells the person facing a certification audit exactly what the other side of the table will test.
Leads the compliance function and reports to the governing body. Culture, speak-up channels and investigations all fall under this role, and all of them get examined in a CMS audit.
Runs gap assessments and readiness reviews for organizations heading toward ISO 37301 certification, then helps them through stage 1 and stage 2 of the certification audit.
Three PECB lead auditor credentials share one exam design and differ in the standard you audit. CISA comes at audit from the IT side. Here's how they line up.
| ISO 37301 LA | ISO/IEC 27001 LA | ISO 37001 LA | CISA | |
|---|---|---|---|---|
| Issuer | PECB | PECB | PECB | ISACA |
| Focus | Compliance management system audit | Information security management system audit | Anti-bribery management system audit | Information systems audit |
| Standard | ISO 37301:2021 | ISO/IEC 27001:2022 | ISO 37001:2025 | ISACA outline (Aug 2024) |
| Exam Format | 80 questions, 3 hrs, open book | 80 questions, 3 hrs, open book | 80 questions, 3 hrs, open book | 150 questions, 4 hours |
| Experience | 5 yrs (2 in compliance), 300 audit hrs | 5 yrs (2 in infosec mgmt), 300 audit hrs | 5 yrs (2 in anti-bribery), 300 audit hrs | 5 yrs in IS audit, control, or security |
| Passing Score | 70% | 70% | 70% | 450 / 800 |
| Renewal | 90 CPD hours over 3 years | 90 CPD hours over 3 years | 90 CPD hours over 3 years | 120 CPEs over 3 years |
| Accreditation | IAS (ISO/IEC 17024) | IAS and UKAS (ISO/IEC 17024) | IAS (ISO/IEC 17024) | ANAB (ISO/IEC 17024) |
| Best For | Compliance auditors and officers | ISMS and security auditors | Anti-corruption and ethics auditors | IT auditors and assurance pros |
PECB figures are for the Lead Auditor level of each scheme. Fees and requirements change, so check PECB and ISACA before you register. Many auditors eventually hold more than one of these credentials.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our PECB authorized ISO 37301 Lead Auditor boot camp runs four days, live and instructor-led, in person or online. Official PECB courseware, the certification exam, the application fee, one free retake within 12 months and a 31 CPD credit attestation are all in the course price.
How PECB credentials work, GRC career choices, the auditor versus implementer decision, and where compliance audit is heading.
How the PECB model differs from vendor exams: passing earns eligibility, and your documented experience, audit hours and two references decide which tier you hold. ISO 37301 Lead Auditor appears in its guide to which PECB credential fits which role.
Governance, risk and compliance job postings ask for a confusing mix of credentials. Which ones matter, where compliance-focused options fit, and how to build a certification stack by career stage.
Written about ISO/IEC 27001, but the same choice applies to ISO 37301. Lead Implementer builds the management system, Lead Auditor decides whether someone else's holds up. The seat you sit in should decide it.
How AI is changing governance, risk management and compliance work, the regulatory pressure that comes with it, and why compliance professionals now need a working level of AI literacy.
Why salary estimates for IT auditors disagree so widely, how pay varies by job title and industry, and who should skip the CISA. Useful context if you are weighing compliance audit against IT audit.
PECB splits the ISO 37301 Lead Auditor exam into seven competency domains and publishes how many of the 80 questions come from each. Click any domain for what it covers.
What ISO 37301 covers and where it applies, how it connects to ISO 19600, ISO 31000, ISO 31022, ISO 19011 and ISO 26000, the role of ethics and codes of conduct, tone at the top and tone at the middle, and the usual barriers to compliance. 11 of the 80 questions.
The requirements in clauses 4 to 10: context, compliance obligations and compliance risk assessment, leadership and the compliance policy, objectives, resources, operational controls, raising concerns and investigations, performance evaluation, and corrective action. 10 questions.
The ISO 19011 audit principles, first, second and third party audits, the PECB Code of Ethics, materiality, reasonable assurance, and inherent, control and detection risk. 16 questions, all written to test evaluation.
Audit objectives, scope and criteria, the feasibility study, the roles of the team leader, team members and technical experts, first contact with the auditee, types of audit evidence, the audit plan, working papers and audit test plans. 10 questions.
The heaviest domain. The opening meeting, stage 1 and stage 2 audits, guides and observers, interviews, documented information review, observation, sampling, technical verification, and corroborating what you find. 20 questions.
Drafting findings and conclusions, conformity versus minor and major nonconformity, the benefit of the doubt, quality review of working documents, the closing meeting, the audit report, action plan review, follow-up and surveillance audits. 6 questions.
Applying the PDCA cycle to an audit program, audit resources and records, combined audits, monitoring the performance of each auditor, and the personal attributes expected of a professional auditor. 7 questions.
Domains and weights reflect the PECB ISO 37301 Lead Auditor Candidate Handbook, version 1.5 (June 2026). Each weight is the domain's share of the 80 exam questions.
The questions candidates ask most often when researching the PECB Certified ISO 37301 Lead Auditor certification.
It is PECB's credential for auditing a compliance management system against ISO 37301:2021. Holders have shown they can plan, lead and report a CMS audit using the audit principles in ISO 19011. PECB designed it for compliance officers, auditors and consultants who assess whether an organization actually meets its obligations.
PECB aims it at auditors who want to perform and lead CMS audits, managers and consultants who want to master the audit process, people responsible for keeping an organization in conformity with ISO 37301, technical experts preparing for a CMS audit, and compliance officers. If you will build the program rather than audit it, ISO 37301 Lead Implementer is the closer match.
As of October 2026, PECB lists the Lead exam at $1,000 if you take it without a course, plus a $500 certification application fee. When you train with a PECB partner, the course fee covers the first exam attempt, one free retake, the application fee and the first year of the annual maintenance fee.
The exam has 80 multiple-choice questions, each with three options, and you get three hours. It is open book, so you can use a hard copy of ISO 37301, the course materials and your own notes. Some questions stand alone and others come in sets tied to a scenario. You need 70 percent to pass, and online results arrive instantly.
The full Lead Auditor credential requires five years of professional experience, two of them in compliance management, plus at least 300 hours of audit activities. You also sign the PECB Code of Ethics and provide two professional references. Senior Lead Auditor asks for ten years, seven in compliance management, and 1,000 audit hours.
Yes. Everyone sits the same exam, and passing makes you eligible to apply. With no experience you can hold PECB Certified ISO 37301 Provisional Auditor. With two years of experience, one in compliance management, and 200 audit hours you qualify as Auditor. You can upgrade later, for a $100 fee, once your experience and hours meet the Lead Auditor bar.
The domains are fundamental principles and concepts of a CMS, CMS requirements, fundamental audit concepts and principles, preparing an ISO 37301 audit, conducting an ISO 37301 audit, closing an ISO 37301 audit, and managing an ISO 37301 audit program. Conducting the audit is the heaviest, at 20 of the 80 questions.
PECB certifications are valid for three years. To renew, a Lead Auditor reports 90 hours of continuing professional development (CPD) across the cycle, such as audit work, training or conferences, and pays the annual maintenance fee, which PECB lists at $390 per three-year cycle. Missing CPD or fees triggers a 12-month suspension, and PECB revokes the credential if you don't fix it in that window.
Yes. PECB runs the scheme in compliance with ISO/IEC 17024, and ISO 37301 Lead Auditor is listed in the scope of PECB's accreditation from the International Accreditation Service (IAS). PECB does not claim a DoD 8140 listing for this credential.
ISO 37301 Lead Auditor audits a compliance management system that covers all of an organization's obligations. ISO 37001 Lead Auditor, also from PECB, audits an anti-bribery management system with the same exam format. CISA from ISACA is an IT audit credential with a 150-question, four-hour exam and a five-year experience requirement.
ISO 37301:2021, the first and so far only edition, published in April 2021 to replace the ISO 19600:2014 guidance. ISO reviewed and confirmed it in 2026, and a 2024 amendment added climate change wording shared across ISO management system standards. No newer edition exists as of October 2026.
It is worth it if your work involves auditing compliance programs or preparing organizations for ISO 37301 certification, since it is the credential built around that standard. The open-book exam rewards audit judgment, and the tiered levels let you start before you have the hours. It is less useful if your audits center on IT controls, where CISA is the closer fit.
Whether you're weighing the credential, working out which level you'll qualify for, or planning training for a compliance team, tell us where you are and we'll help you map out the right path.