Skip to main content
ISO 27001

ISO27001 - Lead Auditor

ISO27001 - Lead Auditor. Review available formats, prerequisites, current inclusions and certification terms before booking.

PECBLead Auditor5 daysLiveSelf-pacedIn-house
  • Practitioner-led, taught by a working CISO
Christophe Mazzola

Taught by

Christophe Mazzola

Practicing CISO · Founder of Cyber Academy

See full profile →

For

Right fit if you are.

  • ✓Auditors who intend to perform or lead third-party ISMS audits
  • ✓Managers or consultants aiming to master the ISMS audit process
  • ✓Individuals responsible for maintaining organisational conformity with ISMS requirements
  • ✓Technical experts preparing to enter the information security audit field
  • ✓Expert advisors in information security management seeking structured audit methodology knowledge

Honest call

NOT for. When to skip it.

We'd rather you keep your money than buy the wrong path.

  • ✗Individuals with no prior exposure to ISO/IEC 27001 or information security concepts, as the pace assumes existing foundational knowledge
  • ✗Those seeking an introductory overview of information security rather than an in-depth audit methodology
  • ✗Professionals looking solely for implementation guidance, as this course focuses on auditing rather than building an ISMS
  • ✗Participants expecting a purely technical hands-on security training course unrelated to audit processes

Outcomes

What you'll be able to do

  • 1Describe the fundamental concepts and principles underpinning an information security management system (ISMS) based on ISO/IEC 27001
  • 2Interpret ISO/IEC 27001 requirements from an auditor's perspective to assess ISMS conformity
  • 3Evaluate an organisation's ISMS against ISO/IEC 27001 requirements using established audit concepts and principles
  • 4Plan, conduct, and formally close an ISO/IEC 27001 compliance audit in line with ISO/IEC 17021-1 requirements and ISO 19011 guidelines
  • 5Apply audit initiation and preparation techniques to structure effective on-site audit activities
  • 6Document and communicate audit findings, nonconformities, and conclusions to relevant stakeholders
  • 7Manage an ISO/IEC 27001 audit programme across multiple audit cycles

Programme

Day by day

Day 1Introduction to the Information Security Management System and ISO/IEC 27001

  • ISMS Concepts and ISO/IEC 27001 Overview

    Participants explore the fundamental principles of an ISMS and the structure and intent of ISO/IEC 27001 as a basis for audit work.

  • ISO/IEC 27001 Requirements from an Auditor's Lens

    Key clauses and controls within ISO/IEC 27001 are examined specifically through the perspective of what an auditor must verify.

By end of day

  • • Articulate the purpose and scope of an ISMS under ISO/IEC 27001
  • • Identify the clauses most critical to auditor scrutiny
Day 2Audit Principles, Preparation, and Initiation of an Audit

  • Fundamental Audit Concepts and Principles

    Core auditing principles drawn from ISO 19011 and ISO/IEC 17021-1 are introduced, covering independence, evidence-based approaches, and audit ethics.

  • Audit Preparation and Programme Planning

    Participants learn how to define audit objectives, scope, and criteria, and how to assemble and coordinate an audit team.

  • Audit Initiation Activities

    The steps involved in formally initiating an audit, including conducting a document review and establishing first contact with the auditee, are covered.

By end of day

  • • Apply ISO 19011 principles when preparing an audit engagement
  • • Draft an audit plan that aligns scope, objectives, and available resources
Day 3On-Site Audit Activities

  • Opening Meeting and Communication

    Participants practise conducting opening meetings and establishing clear communication channels with auditee management and staff.

  • Evidence Collection and Audit Testing Techniques

    Methods for gathering objective evidence through interviews, observation, and document review are applied to ISMS audit scenarios.

  • Identifying and Recording Nonconformities

    Participants learn to distinguish between major and minor nonconformities and document findings with sufficient factual support.

By end of day

  • • Collect and evaluate objective evidence against ISMS requirements during on-site activities
  • • Record nonconformities accurately and consistently for reporting purposes
Day 4Closing the Audit

  • Audit Conclusions and Closing Meeting

    Participants learn how to consolidate audit findings, form an overall audit conclusion, and present results effectively in a closing meeting.

  • Audit Report Preparation

    The structure and content requirements for a formal audit report under ISO/IEC 17021-1 are reviewed and practised.

  • Managing an ISO/IEC 27001 Audit Programme

    Strategies for planning, implementing, monitoring, and improving a multi-audit programme are examined, including follow-up and corrective action tracking.

By end of day

  • • Prepare a structured audit report that meets ISO/IEC 17021-1 expectations
  • • Outline the key activities required to manage an ongoing ISMS audit programme
Day 5Exam Preparation and Review

  • Competency Domain Review

    All seven competency domains covered during the week are revisited to reinforce understanding and address knowledge gaps before the certification exam.

  • Practice Questions and Exam Technique

    Participants work through practice scenarios aligned to the exam domains to build confidence and familiarity with question formats.

By end of day

  • • Identify areas requiring further personal study before sitting the PECB certification exam
  • • Apply structured exam technique to competency-based questions across all audit domains

Public sessions

Upcoming public sessions

Open-enrolment cohorts. Pick a date and book your seat. Want a private cohort for your team instead? Request an in-house quote.

Deep dive

Everything inside this certification

The detail behind the headline. Read at your own pace. Each section answers a buyer question we get on discovery calls.

  • Domain 1: Fundamental principles and concepts of Information Security Management System (ISMS)
  • Domain 2: Information Security Management System (ISMS)
  • Domain 3: Fundamental audit concepts and principles
  • Domain 4: Preparation of an ISO/IEC 27001 audit
  • Domain 5: Conducting an ISO/IEC 27001 audit
  • Domain 6: Closing an ISO/IEC 27001 audit
  • Domain 7: Managing an ISO/IEC 27001 audit program
  • Certification and examination fees are included in the price of the training course
  • Training material containing over 450 pages of information and practical examples will be distributed
  • An attestation of course completion worth 31 CPD (Continuing Professional Development) credits will be issued to the participants who have attended the training course.
  • In case of exam failure, you can retake the exam within 12 months for free

Educational approach

  • This training is based on both theory and best practices used in ISMS audits
  • Lecture sessions are illustrated with examples based on case studies
  • Practical exercises are based on a case study which includes role playing and discussions
  • Practice tests are similar to the Certification Exam

Building Digital Trust through Effective ISMS Auditing

digital trust

FAQ

Buyers always ask

What is the difference between completing this training course and obtaining a PECB certification?+

Completing the five-day training course means you have attended and engaged with the curriculum delivered by Cyber Academy. A course completion attestation may be issued for this participation.

Obtaining a PECB certification is a separate process that requires passing the PECB certification exam and satisfying PECB's own credential requirements, which may include professional experience criteria. Please refer to PECB's Certification Rules and Policies for full details.

Which audit standards and guidelines does this course reference?+

The course draws on ISO/IEC 17021-1, which sets conformity assessment requirements for bodies providing audit and certification of management systems, and ISO 19011, which provides guidelines for auditing management systems including planning, conducting, and managing audit programmes.

Both standards form the methodological backbone of the audit process taught throughout the week.

How many competency domains does the PECB ISO/IEC 27001 Lead Auditor exam cover?+

According to PECB, the exam covers seven competency domains: fundamental ISMS principles and concepts; ISMS requirements; fundamental audit concepts and principles; preparation of an ISO/IEC 27001 audit; conducting an ISO/IEC 27001 audit; closing an ISO/IEC 27001 audit; and managing an ISO/IEC 27001 audit programme.

The training course is structured to address all seven domains across the first four days, with the fifth day dedicated to review and exam readiness.

Is the certification exam included with this course?+

Exam inclusion depends on the delivery format and commercial option selected. Check the booking summary or ask Cyber Academy for written confirmation before registering.

Completing the training, passing the applicable exam, and meeting the PECB credential requirements are separate steps.

Who should consider the Lead Auditor course rather than the Lead Implementer course?+

The Lead Auditor course is designed for individuals whose primary role involves assessing and verifying that an ISMS meets ISO/IEC 27001 requirements, whether as an internal auditor, third-party auditor, or audit team leader.

The Lead Implementer course is more appropriate for those whose focus is designing, building, and operating an ISMS within an organisation. If your work spans both building and auditing, discussing both programmes with an adviser before enrolling is worthwhile.

Next step

Where this leads

Pillar guide

Read the full ISO 27001 guide

The ISMS family. Statement of Applicability, controls, stage 1/2 audits, certification cycles.

Ready to get certified?

Taught by a practicing CISO. Prices and exam terms shown up front.

Buy a live seatBuy self-paced licenceRequest a quote