Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
This guide covers PECB's ISO/IEC 42001 Lead Auditor credential as of October 2026, including the seven weighted exam domains, the 80-question open-book exam, the four credential levels and the audit hours behind them, fees, CPD rules, and how it compares to AAIA and AIGP. It is written for auditors who now have AI management systems in scope.
The PECB Certified ISO/IEC 42001 Lead Auditor is a professional certification for people who audit artificial intelligence management systems (AIMS) and lead the audit team that does it.
ISO/IEC 42001:2023, published in December 2023, sets the requirements for establishing, running, and continually improving an AIMS, and organizations can be certified against it. This credential tests the audit side of that: planning, conducting, and closing an ISO/IEC 42001 audit following ISO 19011 guidelines and ISO/IEC 17021-1 requirements, then managing the audit program that follows. The skills tested are audit skills, such as weighing evidence and writing nonconformities, rather than building AI systems.
There is no prerequisite to sit the exam. What you get after passing depends on your experience, from Provisional Auditor up to Senior Lead Auditor. The credential is issued by PECB (the Professional Evaluation and Certification Board), a personnel certification body that runs the scheme in line with ISO/IEC 17024.
Pass the exam and sign the PECB Code of Ethics. No experience or audit hours needed.
Two years of experience, one of them in AI management, and 200 audit hours.
Five years of experience, two in AI management, and 300 audit hours.
Ten years of experience, seven in AI management, and 1,000 audit hours.
Four things that set this credential apart as organizations start asking auditors to check their AI management systems.
ISO/IEC 42001:2023 is a management system standard, which means an organization can be audited and certified against it. Somebody has to run those audits. This credential tests that method directly: stage 1 and stage 2 audits, evidence collection, nonconformity findings, the closing meeting, and the audit program, all against one named standard rather than AI in general.
Anyone can take the exam, with or without the course. Experience decides the credential you are granted afterward, from Provisional Auditor with no audit hours to Senior Lead Auditor with 1,000. You can apply to upgrade as your hours grow.
You can bring a hard copy of ISO/IEC 42001, the course materials, and your notes. That does not make it easy, because scenario questions ask you to judge what an audit team did right or wrong. Our guide to how PECB exams and credentials work covers the format.
PECB designs the ISO/IEC 42001 scheme to meet ISO/IEC 17024, the international standard for bodies that certify people, and the United Kingdom Accreditation Service (UKAS) schedule of accreditation for PECB lists this Lead Auditor credential by name. PECB does not claim a DoD 8140 listing for it.
Broader AI credentials cover what to look for in AI systems. This one covers how a certification audit against the standard actually runs, which is what an audit team needs when a client asks for ISO/IEC 42001 certification.
The certification, the exam, and what it takes to keep the credential, as PECB publishes them in October 2026.
This credential covers auditing an AI management system against one standard. Auditors who also build these systems, audit security alongside them, or assure AI more broadly can pair it with one of these.
The other half of PECB's ISO/IEC 42001 scheme, for people who plan, build, and run the AIMS. Same exam shape (80 questions, three hours, open book) across six domains, with AIMS project hours in place of audit hours.
Domain 7 of this exam covers combined audits, where one audit spans more than one management system standard. If your auditees also run ISO/IEC 27001, PECB's ISO/IEC 27001 Lead Auditor applies the same audit method to information security.
ISACA's Advanced in AI Audit covers AI governance, AI operations, and audit techniques beyond a single standard. It requires an active CISA, CIA, or CPA, so it suits auditors who already hold one.
Nothing is required before it, but it works best on top of some audit background. From there it points toward the implementer side of the standard and the wider AI audit and governance credentials.
Helpful, not required
The credential
Two questions to answer before you commit: which credential your experience will get you, and whether you should pursue this one specifically. Here's a straight answer to both.
Aim for Lead Auditor.
With five years of professional experience, two of them in AI management, and at least 300 hours of audit activity, you can apply for the full Lead Auditor credential once you pass. PECB counts hours spent planning audits, managing audit programs, drafting audit and nonconformity reports, reviewing documented information, auditing on site, following up nonconformities, and leading audit teams. You also list two professional references.
Start as Provisional, then upgrade.
There is no prerequisite to sit the exam. PECB asks only for a fundamental understanding of ISO/IEC 42001 and of AI principles before the course. Pass, apply, and sign the Code of Ethics, and you can hold the Provisional Auditor credential. As you log experience and audit hours, you can apply to upgrade to Auditor or Lead Auditor from your PECB dashboard for a $100 upgrade fee.
The credential targets first, second, and third party audit work on AI management systems. These are the roles it is built for.
Leads stage 1 and stage 2 certification audits of AI management systems for a certification body, then writes the audit report and the certification recommendation.
Audits the AIMS from inside the organization, testing the AI policy, risk and impact assessments, and Annex A controls before the external auditors arrive.
Audits vendors that build or supply AI systems, checking that their management system meets contract terms and the requirements of ISO/IEC 42001.
Owns day-to-day conformity with ISO/IEC 42001 and uses audit findings to drive corrective action and continual improvement of the AIMS.
Runs gap assessments and pre-certification internal audits for clients, and gets them ready for a certification body to come in.
Builds and runs the AIMS audit program, schedules surveillance and recertification audits, and combines AI audits with ISO/IEC 27001 work where the scopes overlap.
ISACA's Advanced in AI Audit (AAIA) and the IAPP's Artificial Intelligence Governance Professional (AIGP) both deal with AI oversight, but each of the three tests a different job: auditing against one certifiable standard, assuring AI systems broadly, or governing AI under law and policy. Here's how they line up.
| ISO 42001 LA | AAIA | AIGP | |
|---|---|---|---|
| Issuer | PECB | ISACA | IAPP |
| Focus | Auditing an AIMS against ISO/IEC 42001 | AI audit and assurance | AI governance, law, lifecycle oversight |
| Prerequisite | None to sit, experience sets level | Active CISA, CIA, or CPA | None |
| Exam Format | 80 questions, 3 hours, open book | 90 questions, 2.5 hours | 100 items, about 3 hrs |
| Passing Score | 70% | 450 / 800 | 300 (scaled 100 to 500) |
| Renewal | 90 CPD hours over 3 years | 30 CPEs over 3 years | 20 CPEs over 2 years |
| Best For | Auditors of AI management systems | Credentialed auditors assuring AI | Privacy, compliance, risk, legal, program leaders |
Pick by the work in front of you. Certification audits against the standard point to the PECB credential, and broader AI assurance inside an audit function points to AAIA. Figures come from PECB, ISACA, and the IAPP as of October 2026, so check each issuer before you register.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our PECB ISO/IEC 42001 Lead Auditor boot camp covers all seven exam domains in four days of live, instructor-led training, in person or online, using official PECB courseware. The PECB exam, the certification application fee, one free retake within 12 months, and a 31 CPD credit attestation are included.
ISO/IEC 42001 itself, how PECB exams and credentials work, and where an AI audit credential fits among the AI certifications.
What ISO/IEC 42001 requires, from context and leadership to AI risk assessment and AI-specific controls, how organizations implement it in phases, and the common challenges they hit along the way.
How PECB exams are scored, what you can bring into an open-book exam, why passing does not make you a Lead Auditor on its own, and what it takes to keep a PECB credential active.
Written for ISO/IEC 27001, but the same split applies to 42001. Lead Implementer if you build the management system, Lead Auditor if you evaluate other people's.
Five questions to answer first, including whether you govern, secure, or audit AI, and a plain answer on whether ISO 42001 is a credential for people or a certification for organizations.
How the three frameworks fit together, with a side-by-side comparison and a straight answer on whether the EU AI Act requires ISO 42001 certification.
The AI certification field in 2026, from AIGP and the ISACA AI credentials to vendor programs, sorted by the job each one is actually built for.
The principles, frameworks, and program pieces behind AI governance, including where ISO/IEC 42001 sits next to the NIST AI RMF and the EU AI Act.
PECB publishes the question count and weight for each competency domain. Domains 03, 05, and 07 are tested at the evaluation level and make up 55 percent of the exam. Conducting the audit carries the most weight at 19 questions, so the stage 1 and stage 2 material deserves the most study time. Click any domain for what it covers.
ISO standards related to AI and the scope of ISO/IEC 42001, the roles of certification bodies and accreditation bodies, core AI concepts from machine learning to deep learning and neural networks, the iterative AI system life cycle, and the ethical principles behind AI development and deployment. 12 of the 80 questions.
The structure and terminology of ISO/IEC 42001, the requirements in clauses 4 to 10, the objectives of Annexes A, B, C, and D, and the process approach to building, maintaining, and improving an AI management system. 8 questions.
The ISO 19011 audit principles, first, second, and third party audits, evidence-based and risk-based auditing, materiality and reasonable assurance, auditor ethics and professional responsibility, and using AI technologies to support the audit itself. 16 questions, all at the evaluation level.
The responsibilities of the audit team leader, team members, and technical experts, audit feasibility, setting and confirming audit objectives, scope, and criteria, the difference between the AIMS scope and the audit scope, and the terms of the audit engagement. 9 questions.
The heaviest domain. Stage 1 and stage 2 audits, the opening meeting, evidence collection through interviews, documented information review, observation, sampling, and technical verification, audit test plans and working papers, and the benefit of the doubt. 19 questions.
Evaluating audit findings, the closing meeting and audit report under ISO/IEC 17021-1, drafting and presenting conclusions, evaluating action plans, protecting audit records, and quality reviews of audit documentation. 7 questions.
Follow-up, surveillance, and recertification audits, running an audit program on the PDCA model, managing audit records, combined audits, the certification cycle, and the rules for using certification marks. 9 questions.
Domains, question counts, and weights reflect the PECB ISO/IEC 42001 Lead Auditor Candidate Handbook (version 1.5) and the ISO/IEC 42001 Certification Scheme (version 1.2) as of October 2026.
The questions candidates ask most often when researching the PECB ISO/IEC 42001 Lead Auditor certification.
It is PECB's credential for professionals who audit artificial intelligence management systems (AIMS) against ISO/IEC 42001:2023 and lead an audit team. The exam tests how to plan, conduct, and close an AIMS audit in line with ISO 19011 and ISO/IEC 17021-1, and how to manage an audit program. Passing the exam is the first step. The credential level you receive depends on your experience and audit hours.
PECB aims it at internal and external auditors who want to specialize in AI management systems, managers and consultants who want to master the AIMS audit process, people responsible for conformity with ISO/IEC 42001 inside an organization, and expert advisors in AI management. It suits certification body auditors and internal audit teams preparing an organization for certification.
No. There is no prerequisite to sit the exam, and PECB only recommends a fundamental understanding of ISO/IEC 42001 and AI concepts before the course. Experience decides which credential you get afterward. With none you start as Provisional Auditor. The full Lead Auditor credential needs five years of professional experience, two of them in AI management, plus 300 hours of audit activity.
As of October 2026, PECB lists the Lead exam at $1,000 if you take it without a training course, plus a $500 certification application fee. When you train through a PECB partner, the course fee covers the first exam attempt, one free retake, the application fee, and the first year of the annual maintenance fee, as long as you finish within 12 months of the course.
The exam has 80 multiple-choice questions in three hours, and you need 70 percent to pass. Each question has three options, and many are scenario based, with five questions tied to one audit scenario. It is open book, so you can use a hard copy of ISO/IEC 42001, the course materials, and your own notes. You can take it online with a remote PECB invigilator or on paper, and online results arrive instantly.
The domains are fundamental principles and concepts of an AI management system (15 percent), AI management system requirements (10 percent), fundamental audit concepts and principles (20 percent), preparing an ISO/IEC 42001 audit (11.25 percent), conducting an ISO/IEC 42001 audit (23.75 percent), closing an ISO/IEC 42001 audit (8.75 percent), and managing an ISO/IEC 42001 audit program (11.25 percent).
PECB grants four levels from the same exam, and your experience picks the level. Provisional Auditor needs no experience at all. For Auditor you need two years of experience, one in AI management, and 200 audit hours. Lead Auditor asks for five years, two in AI management, and 300 audit hours, and Senior Lead Auditor for ten years, seven in AI management, and 1,000 audit hours. Every level requires signing the PECB Code of Ethics.
PECB certifications are valid for three years. To renew the Lead Auditor credential you report 90 hours of continuing professional development (CPD) over the three-year cycle and pay the annual maintenance fee, which PECB lists at $390 per three-year cycle. The hours do not have to be spread evenly across the years. If you miss the requirements, the certification is suspended for up to 12 months, and PECB can revoke it after that.
Yes. PECB runs the scheme in line with ISO/IEC 17024, and the UKAS schedule of accreditation for PECB (issue 007, dated August 27, 2026) lists the PECB Certified ISO/IEC 42001 Lead Auditor under that standard. PECB does not list a DoD 8140 approval for this credential.
Lead Auditor is about auditing an AI management system. Lead Implementer is about planning, building, and running one. Both PECB exams are 80 open-book multiple-choice questions over three hours with a 70 percent pass mark. Lead Auditor covers seven domains and counts audit hours toward its credential levels, while Lead Implementer covers six domains and counts AIMS project hours.
ISO/IEC 42001 Lead Auditor is tied to one certifiable standard and teaches the audit process itself, from the stage 1 audit to the audit program, with no prerequisite to sit the exam. AAIA from ISACA requires an active CISA, CIA, or CPA and tests AI governance, AI operations, and audit techniques more broadly. Auditors who assess AI both inside and outside a 42001 certification audit may want both.
It earns its keep if ISO/IEC 42001 audits are part of your actual work, whether at a certification body, in internal audit, or as a consultant preparing clients for certification. ISO/IEC 42001:2023 is the first AI management system standard, and this credential tests the audit method against it directly. If your AI work is mostly policy, law, or security, AIGP or AAISM will usually fit better.
If you're weighing the certification, working out funding, or planning training for an audit team, tell us where you are and we'll help you map out the right path.