ISO 27001 Lead Auditor: what the role is, how the audit runs and how to qualify

What an ISMS audit is, and what a Lead Auditor does

An audit is an assessment based on evidence and facts. It shows where the auditee's management system is strong and where it is weak, and the conclusions go to top management, who decide what to do about them. An ISMS audit asks a specific question: does the information security management system conform to the requirements of ISO/IEC 27001 and to the organization's own requirements, and is it effectively implemented and maintained? That is the wording the standard itself uses for internal audit in clause 9.2.1.

For the standard's own explanation of what an ISMS is and what it requires, read the ISO 27001 guide. This article picks up where that one stops, at the point where someone has to check the system.

Three kinds of audit

What the Lead Auditor owns

The Lead Auditor is the person who leads the audit team. That means agreeing scope and criteria, planning and assigning the work, chairing the opening and closing meetings, deciding which findings stand, writing the conclusions, and being able to defend them. It is a different job from implementation. An implementer asks how to build the system. An auditor asks whether it is working and whether the evidence proves it.

The standards behind the course

The Lead Auditor course does not only teach ISO/IEC 27001. It combines four documents, and it helps to know what each one does.

Two of these are guidance and two are requirements, and the difference matters in an audit. ISO 19011 tells you how to audit well. ISO/IEC 17021-1 and ISO/IEC 27006-1 tell a certification body what it must do. ISO/IEC 27001 tells the organization what it must have. When you are asked a scenario question, the first step is to work out which of the four is the source of the answer.

Evidence, findings and nonconformities

The course draws a line that many practitioners blur. Audit evidence is factual. An audit finding is the auditor's evaluation of that evidence against the criteria. If a change management procedure exists and was followed, that is evidence. Whether it satisfies the requirement and the auditee's own rules is a finding.

ISO 19011 says nonconformities and the evidence that supports them should be recorded, graded according to the organization's context and risks, and reviewed with the auditee so that they acknowledge the evidence is accurate and the nonconformity is understood. Grading can be numeric or qualitative, such as minor and major.

The principles behind good findings

ISO 19011:2018 sets out seven principles of auditing: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. The last two shape the daily work. An evidence-based approach means conclusions rest on verifiable evidence, sampled sensibly. A risk-based approach means the auditor spends time where the risk to the ISMS and to the audit conclusions is highest, not evenly across every clause.

The conclusion and the recommendation

At the end of a certification audit, the audit team reaches a recommendation. If it finds no nonconformities, it can recommend certification. If it finds a few minor nonconformities, it can recommend certification conditional on acceptable corrective action plans. In some cases the auditor needs a new on-site visit before a favorable recommendation can be given.

What the auditee does with a nonconformity

Clause 10.2 of ISO/IEC 27001 tells the organization what to do when a nonconformity occurs: react and correct it, deal with the consequences, find and remove the cause so that it does not recur or occur elsewhere, implement the action, review whether it worked, and change the ISMS if needed. A Lead Auditor evaluating an action plan is checking for exactly those steps. A fix that only addresses the symptom, with no cause analysis, is the most common reason an action plan is sent back.

Internal audit: the clause behind the job

A large share of Lead Auditors work on internal audits, not certification audits. Clause 9.2 of ISO/IEC 27001 requires the organization to audit its ISMS at planned intervals, to plan and maintain an audit programme with frequency, methods, responsibilities and reporting, to define criteria and scope for each audit, to choose auditors who keep the audit objective and impartial, and to report results to the relevant management. Documented information must exist as evidence of the programme and its results.

The standard asks for competence and impartiality, not for a particular certificate. A Lead Auditor credential is the most direct way to show both, which is why it is common for internal audit leads, and why managing an internal audit program is part of day four of the course.

Internal audit feeds management review under clause 9.3, and management review feeds improvement under clause 10. An internal audit that nobody acts on is the same failure that a certification auditor looks for. If you also build the system, the ISO 27001 guide and the ISO 27001 implementation services show how the pieces fit.

The course and the exam

The PECB ISO 27001 Lead Auditor course runs five days. Day one covers the ISMS and ISO/IEC 27001. Day two covers audit principles, preparing for an audit and the stage 1 audit. Day three covers on-site audit activities, including stage 2, communication during the audit, audit procedures and audit test plans. Day four covers drafting findings and nonconformity reports, documentation and quality review, closing the audit, evaluating action plans, what happens after the initial audit and managing an internal audit program. Day five is the exam. What the Lead Auditor course covers goes through the days in more detail.

The exam is multiple choice and open book. You can use a hard copy of the main standard, the course materials, your own notes from the course and a hard copy dictionary. It has stand-alone questions and scenario-based questions, where you read a scenario and answer several questions about it. Exam duration and format has the format, and exam cost covers fees. The ISO 27001 Lead Auditor exam guide goes through the exam topic by topic.

From exam to credential

Passing the exam and meeting the experience requirements are both needed for the Lead Auditor credential. After you pass, you have up to one year to submit your professional file. You can apply for more than one credential level at the same time if you meet the requirements.

The application needs your contact details, your professional and audit experience records, with audit hours, and at least two references who can confirm your experience. Degrees do not replace work experience.

This ladder is why people can enroll before they have audit experience. You earn Provisional Auditor first and move up as you log audits. Prerequisites and experience and how long the certification stays valid cover the rest. PECB credentials are valid for three years.

Lead Auditor or Lead Implementer first?

Choose by the work in front of you. If your job is to build and run the ISMS, start with the Lead Implementer course. If your job is to assess other people's systems, or you want to audit for a living, start with Lead Auditor. An implementer who understands how auditors think builds a better system, and an auditor who has built one asks better questions, so many people end up taking both. Lead Implementer vs Lead Auditor goes deeper, and what the Lead Auditor certification is is the shorter version of this article.

The Lead Implementer and Lead Auditor bundle through reconn covers both sides in one enrollment.