CQI/IRCA ISMS Lead Auditor

It is a written examination set at the end of an IRCA-certified lead auditor course, combined with continuous assessment of your performance in audit-practice exercises and role-plays during the course. Expect scenario-based questions: you are given a situation and asked what you would do, what the finding is, or which clause or control applies. Candidates who have only memorised definitions tend to struggle with the scenario questions.

It is demanding but not a trick exam. The difficulty comes from applying standards to messy, ambiguous scenarios rather than recalling text. People with real audit or ISMS experience usually find the practical exercises straightforward and the written paper manageable with focused revision; people with no audit exposure often underestimate how much judgement the scenarios require.

Beyond attending the course, most successful candidates put in several weeks of structured revision. Read ISO/IEC 27001 and ISO 19011 in full, ideally more than once, and practise writing findings and nonconformities against real or invented scenarios. If you are new to auditing, add time for the ISO 19011 concepts, since they are the part most often skimmed.

Start with ISO 19011 to understand the audit process, then ISO/IEC 27001 clause by clause, then Annex A and how it connects to risk assessment and the Statement of Applicability. Finish with integrated scenarios that combine both standards. Studying Annex A before you understand the audit process makes it much harder to answer the practical questions.

Not word for word. You need to know what each control area covers well enough to recognise when it is relevant in a scenario, and you need to understand how controls link to the risk assessment and the Statement of Applicability. Recall of exact clause and control numbering helps under time pressure but is not the point of the exam.

Three recurring mistakes: writing findings that describe a solution instead of stating the requirement and the evidence; confusing an observation or opportunity for improvement with a nonconformity; and answering scenario questions generically instead of applying the specific clause. A fourth is poor time management in the written paper, leaving later questions thin.

Retake arrangements, fees and any waiting periods are set by the certification body and the course provider, and they change periodically. This site does not publish those figures because they would quickly go out of date. Check the current scheme documentation on the CQI/IRCA website, or ask your training provider directly before booking.

The current question count, duration and passing score are published by CQI/IRCA and by the course provider delivering the examination. They are deliberately not stated here, because anything other than the official current figure would mislead you. Confirm the details on the official body's site when you book.

Not automatically. The course and its examination satisfy the training component, but registration as a Lead Auditor also requires demonstrating audit experience and other criteria defined by the scheme. Verify the current requirements with CQI/IRCA before assuming the course alone is enough for your goal.

No. This is independent study material written to help you prepare. It is not affiliated with, endorsed by, or produced in partnership with CQI/IRCA or any training provider. Always treat the official standards and the official scheme documentation as authoritative over anything published here.