Lead Auditor

ISO 27001 Lead Auditor

2026 edition

Self-paced PECB training delivered via myPECB.

Global training partner Aegentra is an official PECB authorised training partner and an official CompTIA partner.

Official PECB training in planning, conducting, reporting and following up ISO/IEC 27001:2022 ISMS audits.

Who it is for

Interpret ISO/IEC 27001:2022 from an auditor’s perspective.
Plan an audit using clear objectives, scope, criteria and appropriate sampling.
Collect and evaluate evidence through interviews, observation and document review.
Report findings and assess corrective-action follow-up while maintaining objectivity.

Day 1 — ISO 27001 and ISMS audit fundamentals

Review the purpose and structure of an ISMS, ISO/IEC 27001:2022 requirements and the relationship between risk treatment and the Statement of Applicability. Introduce audit terminology, professional responsibilities and the different purposes of internal, supplier and certification audits.

Day 2 — Audit principles, preparation and initiation

Explore audit principles, professional behaviour and audit-programme management. Define objectives, scope and criteria, review documented information and select appropriate methods and resources. Prepare an audit plan, working papers and questions that support a focused evidence-gathering process.

Day 3 — Conducting the audit

Work through the opening meeting, communication, interviews, observation and evidence collection. Evaluate the relevance and sufficiency of a sample, trace evidence to the criteria and develop potential findings. Consider how remote and onsite methods affect the audit approach.

Day 4 — Closing the audit and following up

Evaluate conformity, write clear nonconformities and prepare the audit report. Practise presenting conclusions at a closing meeting, reviewing corrective-action plans and following up on their effectiveness. Consider audit records, team responsibilities, ethics and continuing competence.

Day 5 — PECB certification examination

A fundamental understanding of ISO/IEC 27001 and comprehensive knowledge of audit principles.

Format: Open-book multiple-choice — stand-alone and scenario-based questions
Duration: 3 hours
Questions: 80 multiple-choice questions across 7 competency domains
Pass mark: 70%

Credential	Professional experience	Project activity
Provisional Auditor	None; None	None
Auditor	Two years; One year in information security management	200 audit hours
Lead Auditor	Five years; Two years in information security management	300 audit hours
Senior Lead Auditor	Ten years; Seven years in information security management	1,000 audit hours