PECB ISO 27001 Lead Auditor exam guide: format, domains, a five-week plan and how to pass
The exam format, the seven domains, the audit stages and their outputs, a five-week plan of action, preparation tips, common mistakes and a retake strategy for the PECB ISO 27001 Lead Auditor exam.
Every great mission starts with reconn.
The PECB ISO 27001 Lead Auditor exam has 80 multiple-choice questions, runs three hours, is proctored online and is open book. You need 70% to pass, which is 56 correct answers. It covers seven competency domains that follow an audit from its principles through preparation, conduct and closure to managing an audit program.
This guide gives you the exam format, what each domain tests, a five-week plan of action I recommend, the audit stage outputs that questions keep returning to, preparation tips, the mistakes I see most, and what to do if you need a retake. If you want a plan built around your own schedule, talk to me directly.
Key takeaways
- The exam has 80 multiple-choice questions with three options each and one correct answer. It runs three hours and the pass mark is 70%, so you need 56 correct answers.
- It is open book. You may use the standard, the course materials, your own notes and a dictionary. That helps you check a detail, but many questions are scenarios that test judgment, so it does not replace understanding.
- Seven competency domains are tested, and they follow the life of an audit: principles, preparation, conducting, closing and managing the program. If you can follow one audit from start to finish and name the output of each stage, you can answer most of the paper.
- Three hours for 80 questions is about two minutes and fifteen seconds per question. Scenario sets of around five questions need more time than the stand-alone ones, so pace yourself.
- My plan of action is five weeks and ends with a timed mock. It is my suggested plan, not a PECB requirement.
- A failed attempt can be retaken within 12 months at no extra fee under PECB's policy, and the credential level you receive depends on your audit experience.
Which PECB course fits your role?
Lead Implementer
Implement, run and improve an ISMS to ISO/IEC 27001.
For people who build and run the ISMS.
Lead Auditor
Plan, run and report an ISMS audit.
For people who audit it.
Chief Information Security Officer
Lead the information security program across the organization.
For people who lead security across the organization.
Understanding the exam
The PECB ISO/IEC 27001 Lead Auditor exam checks whether you can plan, conduct, report and follow up an audit of an information security management system (ISMS), not whether you can recite the standard. Passing it is the gate to the credential. With a sound plan it is very passable.
If you want the bigger picture first, read the ISO 27001 Lead Auditor role and course guide. If you are comparing it with the implementer exam, I wrote a separate ISO 27001 Lead Implementer exam guide. This article is only about the Lead Auditor exam.
| Item | What to expect |
|---|---|
| Questions | 80 multiple-choice questions |
| Options per question | Three, with one correct answer |
| Pass mark | 70%, which means 56 correct answers |
| Duration | 3 hours |
| Delivery | Online and proctored |
| Open or closed book | Open book: the standard, course materials, your notes and a dictionary |
| Question types | Stand-alone questions and scenario-based sets of around five questions |
| When you sit it | Day five of the course, after four days of training |
| Retake | Free within 12 months of the first attempt, under PECB's policy |
A few rules to know before exam day. Cheating, including the use of AI tools, ends the exam and you do not get a second attempt on it. If you fail, the results show which domains were weak. For the fee and retake rules, read my Lead Auditor exam format and exam cost answers, and check PECB's current policy on your exam page.
From my side of the table. Open book is the most misunderstood part. With 80 questions in three hours there is no time to hunt through a standard on every item. Treat the book as a safety net for one or two details, not as your plan.
The seven domains and what each one tests
PECB builds the exam around seven competency domains. PECB publishes the domain names but not a public weighting on its course page, so I do not quote percentages here. All domains are covered in the exam, and they follow the order of a real audit, which makes them easier to study than they look.
| Domain | What it really tests |
|---|---|
| 1. Fundamental principles and concepts of an ISMS | What an ISMS is, why organizations run one, and the vocabulary of information security management |
| 2. The ISMS | What ISO/IEC 27001 requires of an organization, clause by clause, and how the controls fit in |
| 3. Fundamental audit concepts and principles | Audit types, auditor principles, evidence, sampling and the risk-based approach to auditing |
| 4. Preparation of an ISO/IEC 27001 audit | Audit objectives, scope and criteria, the audit plan, the team and the first document review |
| 5. Conducting an ISO/IEC 27001 audit | Opening meeting, collecting evidence, interviews, findings and nonconformities |
| 6. Closing an ISO/IEC 27001 audit | Audit conclusions, the report, the closing meeting, follow-up and corrective actions |
| 7. Managing an ISO/IEC 27001 audit program | Setting up and running a program of audits, competence of auditors and keeping the program effective |
Domains 3 to 6 are the audit itself, and they are where most scenario questions sit. Domains 1 and 2 give you the ISMS you are auditing against, and domain 7 lifts you from one audit to a program of them. The standard you audit against is ISO/IEC 27001:2022, and the guidance on auditing management systems comes from ISO 19011. If those two are not clearly separated in your head, fix that first. The ISO 27001 guide covers the standard itself.
What I tell candidates. The cleanest way to hold the domains is as a timeline. Before the audit, during the audit, after the audit, and across audits. When a scenario drops you into the middle of an engagement, ask which stage you are in, and the answer usually becomes clear.
The audit stages and what each one produces
Questions on this exam often hinge on what comes out of a stage and what comes next. This table is the one I ask candidates to be able to draw from memory.
| Stage | What the auditor does | What it produces |
|---|---|---|
| Initiating the audit | Confirms objectives, scope and criteria with the auditee and checks the audit is feasible | Agreed audit objectives, scope and criteria, and a first contact with the auditee |
| Preparing the audit activities | Reviews documented information, assigns work to the team and plans the sampling | The audit plan, work documents and checklists |
| Conducting the audit | Holds the opening meeting, gathers evidence through interviews, observation and records, and evaluates it against the criteria | Audit evidence, audit findings and nonconformities |
| Preparing the audit report | Weighs the findings against the objectives and agrees conclusions | Audit conclusions and the audit report |
| Closing and following up | Holds the closing meeting and checks that corrective actions are carried out | The distributed report, agreed corrective action plans and verified follow-up |
If you can say what each stage hands to the next, you can reason through most scenario questions without recalling a single clause number.
In practice. I tell every candidate to write down the output of each stage in their own words. The questions are rarely asking you to remember a definition. They ask you to choose the next correct step, and the output of the previous stage tells you what that is.
A five-week plan of action
This is the plan I give people who ask me how to prepare. It is my suggestion, not a PECB requirement. It assumes you have the course materials and can give it eight to ten hours a week. If you have less time, stretch it to seven weeks rather than cramming.
| Week | Focus | What you do | Check yourself |
|---|---|---|---|
| 1 | Domains 1 and 2: the ISMS and ISO/IEC 27001 | Read the standard once, clause by clause, from an auditor's view. For each clause ask what evidence would show it is met | Can you say what an auditor would ask for under each clause? |
| 2 | Domain 3: audit concepts and principles | Study audit types, auditor principles, evidence, sampling and the risk-based approach | Can you explain why each principle protects the audit? |
| 3 | Domains 4 and 5: preparing and conducting | Follow one audit from initiation to the findings. Write the output of each stage | Can you draw the audit stages and their outputs from memory? |
| 4 | Domains 6 and 7: closing and the audit program | Cover conclusions, the report, follow-up, and how a program of audits is run | Can you describe what the closing meeting must cover? |
| 5 | Scenario practice and a timed mock | Do practice questions in sets of five, then sit a full 80-question mock in three hours. Review every miss | Did you finish with 15 minutes to spare? |
Two habits change the outcome more than any extra hour of reading. First, build your own one-page index of the standard with clause numbers and sticky tabs, so open book works for you. Second, after every practice question, say out loud why the other two options are wrong. PECB distractors are plausible, and learning to reject them is the exam skill.
A practitioner note. In week three, stop reading and start auditing. Take any ISMS you know, your own or one you support, and walk it through the stages on paper. The exam is a decision test, and decisions come from practice.
Preparation tips that work
Beyond the plan, these are the tips I would give a colleague sitting next to me.
Before the exam
Study the standard and the audit method together, not one after the other. When a scenario describes a situation, the answer usually applies an audit principle or a stage to it. Practice the translation from scenario to next step.
Learn the vocabulary exactly. Audit criteria, audit evidence, audit findings, audit conclusions, nonconformity and corrective action have specific meanings, and wrong options often swap them.
Tab your open-book material by clause and by domain. You should find any clause in under 15 seconds.
From my side of the table. Pay attention to who does what. The audit team leader, the auditee, the auditor, the client and the technical expert each have defined roles. Several scenarios are really a question about whose job it is.
On exam day
Do a first pass and answer what you know. Mark the questions you are unsure about and return to them. Do not spend five minutes on one question when you have 80 to answer.
Read the last sentence of a scenario first. It tells you what is being asked, and you then read the scenario looking for the facts that matter.
Choose the answer that follows the audit method, not the one you would choose in your own company. The exam tests the standard's logic and the auditor's independence.
Check your technology early. The exam is proctored online, so test your camera, connection and room well before the start time.
What I tell candidates. Candidates lose marks on questions they know because they read too fast. Where two options both seem right, one of them usually answers a different question than the one asked. Go back to the question stem and check it.
Common mistakes to avoid
These are the mistakes I see most often, in the order I see them.
| Mistake | Why it costs marks | What to do instead |
|---|---|---|
| Learning the clauses but not the audit method | Most scenarios are about the audit, not the clause text | Spend at least half your time on domains 3 to 6 |
| Mixing up findings, conclusions and nonconformities | Options often swap these terms | Write one sentence defining each, and the order they appear in |
| Forgetting who does what | Questions test roles and responsibilities in an audit | Make a short table of each role and what they own |
| Treating open book as a safety blanket | You run out of time looking things up | Build an index and use it for details only |
| Never timing a full mock | You find out about pacing during the real exam | Do one full mock in three hours in week five |
| Answering as an implementer | An auditor evaluates evidence, an implementer fixes the system | Answer as an independent auditor would |
| Cramming the night before | Tired candidates misread questions | Light review, early night |
In practice. If you have implemented ISO 27001, be careful. Implementers want to help the organization fix the problem. An auditor reports what the evidence shows and stays independent. I have seen strong practitioners fail because they answered as the person who would fix it.
If you do not pass: a retake strategy
Failing is not a verdict on you. The results show which domains were weak, and that is the most useful information you will get. Here is how I would use it.
- Write down the weak domains today. Do this before you forget how the questions felt.
- Rebuild by stage. Take the weak domains and give them most of a three-week window, with the first two weeks on study and the last on practice sets.
- Do not re-read everything. Targeted work on the weak domains beats starting over.
- Time a mock again. The second attempt often fails on pacing and not on knowledge.
- Use your retake window. PECB says a failed attempt can be retaken within 12 months of the first attempt at no extra fee, and you should confirm the current rule on your exam page before booking.
With reconn eLearning, two exam attempts are included, so a retake does not need a second payment. If you want a second pair of eyes on your weak domains, message me.
A practitioner note. A fail is often one or two domains, not the whole exam. Fix those and the second attempt becomes a different exam for you.
After the exam: from pass to credential
Passing the exam is the first step. The credential level you receive depends on your professional and audit experience, and PECB sets the requirements for each level. All four credentials require passing the exam and signing the PECB Code of Ethics.
| Credential | Professional experience | Information security management experience | ISMS audit hours |
|---|---|---|---|
| Provisional Auditor | None | None | None |
| Auditor | 2 years | 1 year | 200 hours |
| Lead Auditor | 5 years | 2 years | 300 hours |
| Senior Lead Auditor | 10 years | 7 years | 1,000 hours |
You can take the exam without experience and hold the Provisional credential until you earn the rest. Valid audit experience includes activities such as audit planning, interviews, report writing, document review, on-site audits, follow-up of nonconformities and leading an audit team. For the full picture, read my prerequisites and experience answer. If you also want to build what you audit, the Lead Implementer exam guide covers the other side of the standard.
Why prepare with reconn
I teach these courses myself as a PECB Certified Trainer, with more than 20 years in cybersecurity. That matters on this exam, because scenario questions reward people who have seen how audits really run, and what an auditor does when the evidence does not line up.
| What you get | Why it helps your exam |
|---|---|
| A 1-on-1 session with a PECB Certified Trainer | You test your plan and weak domains with me |
| Unlimited email and WhatsApp support until you clear the exam | Questions get answered while you study, not after |
| Two exam attempts | A retake does not need a second payment |
| Certification application fee and first-year annual maintenance fee | No surprise costs when you pass |
| Self-paced eLearning in English | Study on your schedule within your 12-month enrollment |
Support runs for your 12-month enrollment window. Live Online Lead Auditor is planned from 2027, and you can contact me now to register interest.
From my side of the table. The strongest candidates I teach do not ask for more material. They ask for harder questions. That is what the 1-on-1 session is for.
Frequently asked questions
How many questions are on the ISO 27001 Lead Auditor exam?
80 multiple-choice questions with three options each and one correct answer. You need 70% to pass, which is 56 correct answers.
How long is the ISO 27001 Lead Auditor exam?
Three hours, taken online and proctored. That is about two minutes and fifteen seconds per question on average, and scenario sets take longer than stand-alone questions.
Is the ISO 27001 Lead Auditor exam open book?
Yes. PECB allows a hard copy of the standard, the course materials, your own notes from the course and a hard copy dictionary. Because the clock is tight, an index of your materials helps more than extra pages.
What is the pass mark for the ISO 27001 Lead Auditor exam?
70%. With 80 questions that means at least 56 correct answers.
What domains does the ISO 27001 Lead Auditor exam cover?
Seven: fundamental principles and concepts of an ISMS, the ISMS, fundamental audit concepts and principles, preparation of an ISO/IEC 27001 audit, conducting an audit, closing an audit and managing an audit program.
How long should I study for the ISO 27001 Lead Auditor exam?
I recommend five weeks at eight to ten hours a week, finishing with a timed mock. People with audit experience may need less, and people new to the standard may prefer seven weeks. This is my suggestion, not a PECB requirement.
What happens if I fail the ISO 27001 Lead Auditor exam?
The results show which domains were weak. PECB says a failed attempt can be retaken within 12 months of the first attempt at no extra fee, and with reconn eLearning two exam attempts are included.
Do I need audit experience to sit the exam?
No. Experience decides which credential level you receive after passing. Without it you can hold the Provisional Auditor credential.