Training, exams and certification
Training, exams and certification
Eighty questions in three hours, open book, seventy per cent to pass, across seven weighted domains. And the part most candidates discover late: passing the exam does not make you a Lead Auditor.
Reviewed by GoToCertify’s accredited trainers
The PECB Certified ISO/IEC 27001 Lead Auditor exam is a multiple-choice paper with standalone and scenario-based questions, delivered online or on paper.
| Questions | 80, multiple choice with three options each — standalone and scenario-based |
|---|---|
| Duration | 3 hours |
| Pass mark | 70% |
| Materials | Open book — a hard copy of ISO/IEC 27001, the training course materials, and your own notes from the course |
| Question balance | Half measure comprehension, application and analysis; half measure evaluation |
| Non-native language | 30 additional minutes for Lead-level exams taken on paper, on request |
| Delivery | Online in the PECB Exams app with a remote invigilator, or on paper at a PECB partner’s site |
| Retakes | One free retake within 12 months for candidates trained by a PECB partner (included in our Exam Bundle); no limit on further retakes, subject to PECB’s rules on spacing |
| Validity | Three years, with CPD and an annual maintenance fee of USD 120 (first year included) |
| Credential | Passing the exam is one of several requirements. See below |
Passing the exam earns you a certificate; the Lead Auditor title needs experience. PECB awards four credentials from the same paper, and which one you get depends on years worked and audit hours logged.
| Provisional Auditor | No professional experience, no audit hours |
|---|---|
| Auditor | 2 years, one of them in information security — 200 audit hours |
| Lead Auditor | 5 years, two of them in information security — 300 audit hours |
| Senior Lead Auditor | 10 years, seven of them in information security — 1,000 audit hours |
All four also require signing the PECB Code of Ethics.
This is the single most useful thing to know before you book. Someone fresh to auditing can sit and pass the same exam as a fifteen-year veteran, and both will be certified — at different levels. If a job advertisement asks for a Lead Auditor, the exam alone will not answer it.
PECB publishes the weighting, and it is not even:
| Conducting an audit | 18 questions · 22.5% | |
| Fundamental audit concepts | 14 questions · 17.5% | |
| Fundamental ISMS principles | 13 questions · 16.25% | |
| Preparing an audit | 12 questions · 15% | |
| ISMS and 27001 requirements | 8 questions · 10% | |
| Managing an audit programme | 8 questions · 10% | |
| Closing an audit | 7 questions · 8.75% |
Three domains — conducting an audit, fundamental audit concepts, and preparing one — carry fifty-five per cent of the paper between them. The requirements of the standard itself are ten per cent.
Read that again if you were planning to revise by reading ISO/IEC 27001 cover to cover. This is an auditing exam. The standard is the subject matter; auditing is the skill being tested.
Three things go in with you: a hard copy of the standard, your training course materials, and any personal notes you took during the course — printed or on the PECB Exams app.
That last one is rare. Most restricted open-book exams name a list of official documents and exclude everything else. Here your own notes count, which changes what taking notes is for: they are not a revision aid you leave behind, they are an exam resource you will use.
So write them accordingly. Indexed by domain, with the weighting above in mind, and legible to a tired person under time pressure.
Take notes as if you will read them in the exam — because you will. Structure them by the seven domains, not by the order of the course.
Weight your revision to the audit process. Conducting, preparing and closing an audit is nearly half the paper.
Check the experience table before you book. If the Lead Auditor credential is the goal, the audit hours are the long pole, not the exam.
Eighty multiple-choice questions, standalone and scenario-based.
70%.
Three hours. Lead-level exams taken on paper allow 30 extra minutes, on request, for candidates sitting in a language other than their own.
Yes — a hard copy of the standard, your course materials, and your own notes from the course.
Not by itself. The Lead Auditor credential also requires five years of professional experience, two of them in information security, and 300 audit hours.
You can still sit the exam and be certified as a Provisional Auditor, then upgrade as the experience accumulates.
Yes. PECB places no limit on the number of retakes, though there are rules about the interval between them.
Yes. Lead-level exams carry an additional 30 minutes.
Sources. Every figure on this page comes from PECB’s published candidate handbooks and certification pages, checked in September 2026.
The PECB Exam Bundle is on sale here: exam voucher, Learning Resource Kit and a retake, €670 excl. VAT.
See the Exam Bundle
BITIL.COM is an Authorized Reseller and Silver Partner of PECB.
