Skip to main content

ISO/IEC 27001 Information SecurityProfessionalI27K-LA

Certified ISO/IEC 27001 Lead Auditor

Demonstrates the competence to plan, lead and report audits of information security management systems against ISO/IEC 27001:2022 using ISO 19011 audit guidance.

Exam
2 h
Questions
60
Pass mark
70%
Valid for
3 years

About this certification

Holders apply the audit principles and guidance of ISO 19011 to manage an audit programme, plan and lead an audit team, and evaluate conformity with ISO/IEC 27001:2022 requirements and Annex A controls. They understand the purpose of stage 1 and stage 2 audits, gather and verify evidence through sampling, write objective nonconformity statements and conduct closing meetings and follow-up.

Who it is for: Internal and external auditors, security managers and consultants who audit ISMS.

Syllabus

What you'll be assessed on — 6 modules. The percentage is each module's share of the exam.
  1. 01Audit Principles and Concepts15% of the exam
    • Explain the audit principles described in ISO 19011, including integrity, fair presentation and evidence-based approach
    • Distinguish between first-, second- and third-party audits
  2. 02Managing an Audit Programme15% of the exam
    • Design a risk-based audit programme with objectives, scope and resources
    • Explain the purpose of stage 1 and stage 2 certification audits as guidance knowledge
  3. 03Planning the ISMS Audit15% of the exam
    • Design an audit plan and assign audit team roles
    • Apply document review of the ISMS scope, risk assessment and Statement of Applicability
  4. 04Conducting the Audit25% of the exam
    • Apply interviews, observation and record sampling to gather audit evidence
    • Evaluate the effectiveness of Annex A controls against stated risks
    • Apply opening and closing meeting techniques
  5. 05Findings and Reporting20% of the exam
    • Write nonconformity statements that cite requirement, evidence and finding
    • Design an audit report with conclusions proportionate to evidence
  6. 06Follow-Up and Auditor Conduct10% of the exam
    • Evaluate corrective action plans and verify their implementation
    • Apply ethical conduct, independence and confidentiality throughout the audit

Competencies assessed

  • Audit Programme Management — Manages a risk-based audit programme.
  • Audit Planning — Plans ISMS audits and leads audit teams.
  • Evidence Gathering — Collects and verifies objective audit evidence.
  • Conformity Evaluation — Evaluates conformity with ISO/IEC 27001:2022 requirements.
  • Audit Reporting — Reports clear, evidence-based findings and conclusions.

Exam blueprint

Closed-book, timed examination with single-choice, multiple-response and scenario-based questions.
Questions per module60 questions · 2 h · pass 70%
  • Audit Principles and Concepts9
  • Managing an Audit Programme9
  • Planning the ISMS Audit9
  • Conducting the Audit15
  • Findings and Reporting12
  • Follow-Up and Auditor Conduct6
Question types
Scenario-based 20% · Single choice 60% · Multiple response 20%
Delivery
Online (remote proctored), Test centre, On-site (corporate)
Retakes
Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

Your path to certification

  1. 1

    Register

    Create a free account and start the programme.

  2. 2

    Practice

    Online practice test, 8 questions.

  3. 3

    Training

    Optional

    Online course or classroom — or skip it.

  4. 4

    Certification

    Independent exam and certification decision.

  • Practice test8 questions · 20 min · 70% to pass · free with the programme
  • ISO/IEC 27001 Lead Auditor — online course28 h self-paced€699
  • ISO/IEC 27001 Lead Auditor — classroom courseLumen Cyber Institute (Demo), Dublin · 21 hDemo organisation€895
    • 27 Nov 2026 – 29 Nov 2026 · Lumen Cyber Institute (Demo), Dublin
    • 25 Dec 2026 – 27 Dec 2026 · Lumen Cyber Institute (Demo), Dublin

Training is optional and does not by itself confer certification. Find a training partner

Eligibility & prerequisites

Required

  • Minimum 3 years' professional experience, including at least 2 years in information security
  • Documented participation in management system audits (internal or external)
  • Agreement to abide by the AQSCERT Code of Professional Conduct

Recommended

  • I27K-F or equivalent knowledge
  • Working knowledge of information security controls

More information

Certification process
  1. 1. Application — Create an account and apply for this certification.
  2. 2. Eligibility review — AQSCERT checks the formal eligibility requirements.
  3. 3. Assessment — Sit the 2 h examination online or at a test centre.
  4. 4. Independent decision — A decision maker not involved in your training or assessment reviews all evidence.
  5. 5. Issuance — A digitally signed certificate with QR verification, valid for 3 years.
  6. 6. Recertification — Before expiry, evidence 60 hours of CPD or re-sit the examination.
  7. Certificates may be suspended, withdrawn or revoked in line with the Certification Scheme. Status is always shown on the public verification page.
Scheme & accreditation
Certification scheme
Information & Technology Certification Scheme
Scheme code
AQS-SCH-25
Scheme version
v1.0 (effective 1 Jan 2026)

Accreditation: AQSCERT is accredited by DA, an IAF MLA signatory, to ISO/IEC 17024. Our programmes are developed by leading experts from industry.

Ready to start I27K-LA?

Practise online, add optional training, then sit the independent exam.

Related ISO/IEC 27001 Information Security certifications

  • Foundation

    I27K-F

    Certified ISO/IEC 27001 Foundation

    Validates foundational knowledge of information security management systems based on ISO/IEC 27001:2022, including its requirements, risk-based approach and Annex A control themes.

    Exam duration
    1 h
    Questions
    40 questions

    Exam fee from

    €225

  • Professional

    I27K-LI

    Certified ISO/IEC 27001 Lead Implementer

    Demonstrates the competence to plan, implement, operate and continually improve an information security management system based on ISO/IEC 27001:2022 in any organisation.

    Exam duration
    2 h
    Questions
    60 questions

    Exam fee from

    €460

Certified ISO/IEC 27001 Lead Auditor (I27K-LA) · AQSCERT