PECB ISO 28000 Lead Auditor study guide
PECB ISO 28000 Lead Auditor · Work through your exam, one topic at a time.
The PECB Certified ISO 28000 Lead Auditor credential is issued by PECB to candidates who pass the associated certification exam and then meet the professional experience requirements for the credential level they apply for. The training course behind it builds the competencies needed to perform security management system (SeMS) audits by applying recognized audit principles, procedures and techniques, integrating ISO/IEC 17021-1 requirements, ISO 19011 guidelines and other audit best practices. The PECB ISO 28000 Lead Auditor study guide has 7 sections and about 2,468 words.
01Fundamental Principles and Concepts of a Security Management System
In this domain the exam tests whether you can explain what a security management system is under ISO 28000:2022, what 'security' means in that standard, and how risk-based thinking and the process approach hold the system together. Expect questions that ask you to distinguish concepts rather than recite clause numbers.
381 words, about 2 min02Security Management System Requirements
This domain tests whether you know the requirements an ISO 28000:2022 audit is measured against, clause by clause, and whether you can recognise conforming and nonconforming evidence. Clause 4 Context: internal and external issues, interested parties and their requirements, the scope of the SMS, and the SMS as interrelated processes.
357 words, about 2 min03Fundamental Audit Concepts and Principles
This domain tests the vocabulary and rules of auditing itself, largely from ISO 19011:2018, and whether you can apply them to security management system evidence. Integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach.
350 words, about 2 min04Preparing an ISO 28000 Audit
This domain tests whether you can design an audit that will actually find something: scope, criteria, objectives, sampling and documentation. The audit programme is the set of audits over time; the audit plan is one audit.
326 words, about 2 min05Conducting an ISO 28000 Audit
This domain tests how you gather evidence, follow an audit trail and turn evidence into defensible findings while keeping the audit on schedule. Open with an opening meeting confirming scope, criteria, schedule, reporting method and confidentiality.
324 words, about 2 min06Closing an ISO 28000 Audit
This domain tests the closing sequence: agreeing findings, reporting, and following up without drifting into consultancy or promising an outcome. Prepare it with the team first, and confirm facts with the auditee during the audit rather than at the closing meeting - surprises there damage credibility.
338 words, about 2 min07Managing an ISO 28000 Audit Programme
This domain tests whether you can run audits as a managed portfolio - planning, resourcing, monitoring and improving - rather than as isolated events. A programme sets objectives, extent, schedule and resources for a set of audits over a period.
392 words, about 2 min