Show me desktop version
CALL US +1 (646) 759 9933

ISO 27001/ISO 22301 Knowledge base

How to become ISO 27001 Lead Auditor

Author: Dejan Kosutic

Many people think that just by attending the ISO 27001 Lead Auditor Course they have become the ISO 27001 Lead Auditor. Well, this is not entirely true.

This article will show the steps you need to take if you want to work as an auditor for a certification body. If you want to work as an internal auditor, you basically do not need the Lead Auditor Course or anything else mentioned here – you can perform internal audits by just proving you have enough experience and knowledge. To learn more about internal audits read this article Dilemmas with ISO 27001 & BS 25999-2 internal auditors.

Steps for becoming the ISO 27001 Lead Auditor

So, if you want to become lead auditor, here is what ISO 27006 (standard that defines the requirements for certification bodies) requires:

  1. Prior experience – You need to have at least four years of experience in information technology, of which at least two years on a job related to information security.
  2. Pass the exam – The ISO 27001 Lead Auditor Course lasts 5 days, and on the fifth day you need to pass the written exam. Therefore, you need to invest considerable effort, not only by studying for the exam but also for attending the full 5 days of the course (if you miss a single day you will not be permitted to take the exam).
  3. Find a certification body – You need to find a certification body which needs an ISO 27001 certification auditor – that may prove to be a difficult task, since most of the certification bodies already have their auditors.
  4. Go through training – When you find the certification body which is interested, this doesn’t mean you’ll start auditing tomorrow – ISO 27006 requires you to go through a trainee program (or similar) during which you will attend real certification audits (done by more experienced colleagues) where you will learn how to perform such audits. Usually, this trainee period lasts 20 audit days after which you’ll be entitled to perform ISMS audits as part of the audit team.
  5. Gain audit experience – To become the ISO 27001 Lead Auditor, i.e. to lead a team of auditors performing ISO 27001 audit, you need to have experience in at least three complete ISMS audits.

After you finish all these steps, you will be able to perform the ISMS audits as the team leader. So, the ISO 27001 Lead Auditor Course is just the beginning of your journey…

You can also check out our  ISO 27001 Lead Auditor Course preparation training – a webinar which describes the details of the course and helps you prepare for the exam.

If you enjoyed this article, subscribe for updates

Improve your knowledge with our free resources on ISO 27001/ISO 22301 standards.

100% privacy respected. Unsubscribe at any time with a single click.

  • Dear Dejan, Planning to take up ISO27K1 Lead Auditor training and certification soon. Who certifies the final exam? I am hearing different answers from diferent quarters: PECB, IRQA etc.

    • Rhand Leal

      The certification is issued by the training provider. Entities like PECB, IRCA and Exemplar Global (formerly RABQSA) provide accreditation for training providers that are compliant with ISO 17024 (Conformity assessment – General requirements for bodies operating certification of persons). An certification issued by providers accredited by PECB, IRCA or Exemplar Global is globally recognized. One example is the exam from our ISO 27001 Internal Auditor course, that is certified by Exemplar Global (for more information about this internal auditor course, please see this link: https://training.advisera.com/course/iso-27001-internal-auditor-course/)

      This article will provide you further explanation about Lead Auditor certification:
      – Accreditation vs. certification vs. registration in the ISO world https://advisera.com/27001academy/blog/2016/02/29/accreditation-vs-certification-vs-registration-in-the-iso-world/

OUR PARTNERS


  • Exemplar Global (formerly RABQSA) is leading international
    authority in certification of training providers.

  • ITIL® is a registered trade mark of AXELOS Limited.
    Used under licence of AXELOS Limited. All rights reserved.

  • DNV GL Business Assurance is one of the leading providers of
    accredited management systems certification.
Request callback
Request callback

Or call us directly

International calls
+1 (646) 759 9933