PECB ISO 18788 Lead Auditor
PECB Certified ISO 18788 Lead Auditor
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The PECB Certified ISO 18788 Lead Auditor credential is aimed at professionals who audit Security Operations Management Systems (SOMS) against ISO 18788. PECB positions the training for auditors who want to perform and lead SOMS certification audits, for managers and consultants who need to master the audit process, for staff responsible for maintaining conformance with SOMS requirements, for technical experts preparing to take part in a SOMS audit, and for expert advisors in security operations management. The course builds the expertise to plan and carry out internal and external audits in line with ISO 19011 and the ISO/IEC 17021-1 certification process, and to manage an audit programme, an audit team, customer communication and conflict resolution. The five-day agenda moves from SOMS and ISO 18788 fundamentals, through audit principles, preparation and launch, on-site activities, and closing the audit, to the certification exam on day five. The exam covers seven competency domains, from SOMS principles and the standard itself through audit fundamentals, preparation, conduct, closing and programme management. Preparation combines the training material (over 450 pages of information and practical examples), lecture sessions illustrated with practical questions and examples, practical exercises with discussion, and practice tests built to resemble the certification exam. PECB states that a fundamental understanding of ISO 18788 and comprehensive knowledge of audit principles are prerequisites. Note that PECB has discontinued updates to this training course, and a new version may be available on request. This page is independent study material and is not affiliated with, endorsed by, or sponsored by PECB.
What you'll study
About PECB ISO 18788 Lead Auditor preparation
What does the ISO 18788 Lead Auditor exam cover?
PECB lists seven competency domains: fundamental principles and concepts of a Security Operations Management System, Security Operations Management Systems themselves, fundamental audit concepts and principles, preparation of an ISO 18788 audit, conducting an ISO 18788 audit, closing an ISO 18788 audit, and managing an ISO 18788 audit programme. The course also builds on ISO 19011 and the ISO/IEC 17021-1 certification process.
How many questions are on the exam, and how long does it take?
PECB does not state the number of questions, the duration, the passing score, or the item format on the ISO 18788 Lead Auditor course page. It directs candidates to the List of PECB Exams and the Examination Rules and Policies for exam type, available languages and other details. Check those documents before booking.
Is the exam hard?
PECB sets a prerequisite of a fundamental understanding of ISO 18788 plus comprehensive knowledge of audit principles, so the exam assumes prior grounding rather than teaching it from zero. The five-day course includes practice tests similar to the certification exam. Candidates without audit experience should expect to invest extra time in ISO 19011 concepts.
What happens if I fail the exam?
PECB states that in case of exam failure, you can retake the exam within 12 months free of charge. Confirm the exact conditions in the PECB Examination Rules and Policies, since the retake window is tied to that 12-month period from your attempt.
Are exam and certification fees separate from the course price?
According to PECB, certification and examination fees are included in the price of the training course. Training material containing over 450 pages of information and practical examples is distributed, and attendees who complete the course receive an attestation worth 31 CPD credits.
What credential levels exist, and what experience do they require?
PECB lists four levels. Provisional Auditor requires no experience. Auditor requires two years, including one year in Security Operations Management, and 200 hours of audit activities. Lead Auditor requires five years, including two in Security Operations Management, and 300 hours. Senior Lead Auditor requires ten years, including seven in Security Operations Management, and 1,000 hours. All require signing the PECB Code of Ethics.
Which audit activities count toward the required hours?
PECB says audits must follow best audit practices and include audit planning, audit interviews, managing an audit programme, drafting audit reports, drafting nonconformity reports, drafting audit working documents, documentation review, on-site audit, follow-up on nonconformities, and leading an audit team.
In what order should I study for this exam?
Follow the course sequence: SOMS concepts and ISO 18788 first, then audit principles and audit preparation, then on-site audit activities, then closing the audit, and finally audit programme management. Finish with practice tests similar to the certification exam, and revisit any domain where your practice scores are weakest.
What are the most common ways candidates lose marks?
Two recurring traps are treating the exam as a pure ISO 18788 requirements test and ignoring ISO 19011 audit process content, and confusing audit programme management with managing a single audit. Weaker candidates also blur preparation activities with on-site conduct, and misstate the evidence needed to close nonconformities.
Is this training course still updated?
PECB states that updates to this training course have been discontinued and that a new version of the training course might be available upon request. PECB asks candidates to contact [email protected] to make such a request, so confirm the current course version before you enroll.