ISO 27001 lead auditor: the qualification, and what auditing for a certification body actually requires

“ISO 27001 lead auditor” is sold as a course, but the phrase covers three different things, and they are governed by three different sets of rules. Knowing which one you need — for your career, for a job advert, or for your own organisation's internal audit — saves you buying the wrong one.

Three things called an “ISO 27001 auditor”

The first column is what most people mean. The second is what an organisation actually meets at Stage 1 and Stage 2. The third is what your organisation has to provide for itself every year. A single person can be all three at different times — but never the second and third for the same organisation, because a certification body may not provide internal audits to its certified clients.

The personal credential: how the grades work

A lead auditor credential is issued by a personnel certification body under a published scheme. We use PECB as the worked example because it publishes its grade rules in full on a public page; other scheme owners publish their own, and we do not rank them. Every PECB auditor grade starts from the same exam — “PECB Certified ISO/IEC 27001 Lead Auditor exam or equivalent” — and then differs by experience:

What counts as audit experience

PECB says the audits must follow best audit practice and include activities such as:

• Audit planning
• Audit interview
• Managing an audit program
• Drafting audit reports
• Drafting non-conformity reports
• Drafting audit working documents
• Documentation review
• On-site Audit
• Follow-up on non-conformities
• Leading an audit team

The course itself

The published PECB lead auditor course runs over five days:

PECB also states that “Certification and examination fees are included in the price of the training course”. We do not publish course prices: they vary by provider and format, and we have no source we could keep current.

Other schemes, and moving between them

Schemes are not all built the same way. Exemplar Global, for instance, allows an audit log in place of a knowledge exam where no exam is available: “If a knowledge examination is not available, this may be substituted with an audit log showing relevant audit experience. If you choose this method, we require that you show evidence of 10 audit days reflecting the specific scheme (e.g, QMS, EMS, OHS, etc.) and grade (i.e., auditor or lead auditor) you wish to apply for.” — and adds: “Importantly, the audit dates captured in your log need to have been conducted within the past three years.” Schemes also recognise one another to some extent: “There are current agreements with IRCA/CQI, PECB, and the CCAA to recognize certification.”

Lead auditor vs lead implementer

Same scheme owner, same experience ladder, different job. The implementer grades mirror the auditor grades exactly, but count project activities rather than audit activities:

What each is trained to do

The implementer course, over the same five days, covers:

And the project experience PECB counts for an implementer includes:

• Drafting an ISMS implementation business case
• Managing an ISMS implementation project
• Implementing the ISMS
• Managing documented information
• Implementing corrective actions
• Monitoring the ISMS performance
• Managing an ISMS implementation team

If your aim is to get your own organisation certified, the implementer route is the closer fit. If your aim is to run internal audits or to audit other organisations, the auditor route is. Neither certifies your organisation.

Auditing for a certification body: what ISO/IEC 27006 requires

The auditor who arrives for your Stage 2 is not there because of a course certificate. Certification bodies are assessed against ISO/IEC 17021-1, and for information security against ISO/IEC 27006, which requires that each ISMS auditor:

How the auditor-in-training rule works

The route in is supervised audit work. ISO/IEC 17021-1: “Auditors-in-training may participate in the audit, provided an auditor is appointed as an evaluator. The evaluator shall be competent to take over the duties and have final responsibility for the activities and findings of the auditor-in-training.” So when a certification body brings an extra person to your audit, it may be exactly this — and the evaluator, not the trainee, carries final responsibility for the findings.

What a certification body must define for its auditors

“Table A.1 specifies the knowledge and skills that a certification body shall define for specific certification functions.” For the people auditing and leading the audit team, the table lists knowledge and skills including:

• Knowledge of business management practices
• Knowledge of audit principles, practices and techniques
• Knowledge of specific management system standards/normative documents
• Knowledge of certification body’s processes
• Knowledge of client’s business sector
• Knowledge of client products, processes and organization
• Language skills appropriate to all levels within the client organization
• Note-taking and report-writing skills
• Presentation skills
• Interviewing skills
• Audit-management skills

Sector knowledge is on that list for a reason: it is why the auditor assigned to a fintech and the one assigned to a manufacturer may be different people. And “The necessary knowledge and skills of the audit team leader and auditors may be supplemented by technical experts, translators and interpreters who shall operate under the direction of an auditor.”

Your internal auditor

ISO 27001 requires every certified organisation to audit its own management system. The harmonized-structure text that the standard is built on — ISO/IEC 27001:2022 says it applies its “identical text” — sets the requirement:

And for the programme, the organisation shall:

We measured how closely ISO/IEC 27001:2022 follows the current harmonized text in the clauses we can read side by side (4.1 to 6.3): 79–100% of each common clause's wording appears, in order, in the standard, with small differences such as “outcome(s)” for “result(s)”. Read the quotes above as the common requirement, not as ISO 27001's exact wording.

Who can do it

The requirement is objectivity and impartiality, not a named qualification. A colleague from another team, a contractor, or a consultancy can all qualify; someone auditing their own work cannot. The one party the standard rules out entirely is your certification body:

Your internal audits are then examined twice at certification and again at every surveillance audit, where “internal audits and management review” is the first thing each one must include.

A credential for a person, a certificate for an organisation

Two different conformity assessment standards sit behind the two kinds of certificate, and they are easy to conflate:

An organisation with three qualified lead auditors on staff is not ISO 27001 certified, and an organisation with a certificate does not need any. Procurement questionnaires sometimes blur the two; the certificate that answers them is the organisation's, issued by an accredited certification body.

Where this fits

• Stage 1 and Stage 2What the certification body's auditor checks at each stage
• Surveillance auditsWhere your internal audit is examined every year
• Major and minor nonconformitiesWhat an auditor may record, and what they may not suggest
• Choosing a certification bodyWhat to ask about who will audit you
• ConsultantsWho can run your internal audit if nobody in-house is independent enough

Common questions