ISO 27001 Lead Auditor Training
An instructor-led course on planning, leading and reporting a full information security management system (ISMS) audit against ISO/IEC 27001:2022. Built by an accredited ISO 27001 certification body, with practical audit exercises and an assessment.
Upcoming ISO 27001 Lead Auditor Sessions
Dates, times, time zone and format come straight from our training calendar. If no date suits you, register your interest and we will contact you when the next session opens.
Loading sessions…
What You Will Learn in ISO 27001 Lead Auditor Training
This ISO 27001 lead auditor training course teaches you to plan, run and report a full ISMS audit, from the opening meeting to graded findings. You learn the standard from an auditor's side: what evidence each requirement needs, and how to test that controls work in practice.
The standard
- ISO/IEC 27001:2022 clauses 4 to 10, from context and scope to improvement
- Risk assessment, risk treatment and the Statement of Applicability
- The 93 Annex A controls in four themes: organizational, people, physical and technological
- The 11 controls new in the 2022 edition, such as threat intelligence and cloud services
- The documented information an ISMS must hold
Leading an audit
- Audit principles and the audit programme, based on ISO 19011
- Planning: scope, objectives, criteria, sampling and the audit plan
- Opening meetings, interviews and gathering objective evidence
- Testing controls at source: access reviews, change records, logs and backups
- Writing clear nonconformities and grading findings
- Closing meetings, the audit report and follow-up
- How certification audits work: Stage 1, Stage 2, surveillance and recertification
Want to read ahead? Our guide to ISO 27001 requirements lists every clause and Annex A control, and remote ISO audits explains how ISMS audits run online.
ISO 27001 Audit Training From a Certification Body
Accredify Global is an accredited ISO 27001 certification body. The course draws on how real certification audits are planned, sampled and graded, not only on the text of the standard.
Training is kept separate from certification. Our courses are open and generic, they do not advise on your own ISMS, and they do not influence any audit outcome. Read our impartiality policy.
Who Should Attend
A good fit if you are
- An information security manager or CISO
- An internal auditor ready to lead full ISMS audits
- A supplier or second-party security auditor
- A GRC, compliance or IT audit professional
- Aiming for a career in third-party ISMS auditing
Before you start
- A working knowledge of ISO/IEC 27001 and of how an ISMS runs
- Some audit or information security experience helps
- New to ISO 27001? Start with awareness training
- Only auditing your own organization? Internal auditor training may suit better
Course Format and Certificate
You receive a Certificate of Successful Completion when you meet the attendance and assessment requirements, or a Certificate of Attendance if you take part without meeting or taking the assessment. Each session listing shows the dates, times, time zone, format and language. Joining details are sent before the course starts.
This is a training certificate. It is not an accredited personnel-certification credential, it does not register you as a certified lead auditor, and it is not an ISO 27001 certificate for an organization.
Training Certificate or Certified Lead Auditor Credential?
Many people search for "ISO 27001 lead auditor certification". Two different things share that name, so check which one you need before you book.
| Training certificate (this course) | Personnel certification | |
|---|---|---|
| Who issues it | The training provider | A personnel certification body |
| What it shows | You completed the course and passed its assessment | Your training, audit experience and audit hours meet a scheme's criteria |
| Experience needed | None beyond the course prerequisites | Usually years of work and logged audit hours |
| Best for | Building skills to lead internal, supplier and second-party audits | Auditors who need a registered credential for their employer or clients |
If an employer or client asks for a registered lead auditor credential, confirm the scheme they accept. Our course builds the audit skills; it does not grant that registration.
Lead Auditor or Internal Auditor?
| Internal Auditor | Lead Auditor | |
|---|---|---|
| Main goal | Audit your own ISMS, as clause 9.2 requires | Plan and lead full ISMS audits, including of suppliers |
| Audit types covered | First-party | First, second and third-party |
| Leading a team | Not the focus | Core skill |
| Certification audit process | Overview | Stage 1, Stage 2 and surveillance in depth |
| Best for | Internal audit teams | Security leads, supplier and career auditors |
ISO 27001 Lead Auditor Training: Common Questions
What is ISO 27001 lead auditor training?
It is a course that teaches you to plan, lead and report a full audit of an information security management system against ISO/IEC 27001:2022. It covers the standard from an auditor's view, audit principles based on ISO 19011, and how certification audits run.
How long is the ISO 27001 Lead Auditor course?
Each session listing on this page shows the exact dates, times, time zone and format. If no date suits you, register your interest and we will contact you when the next session opens.
Is there an exam or assessment?
Yes. You need to meet the attendance and assessment requirements to receive the Certificate of Successful Completion. Otherwise you receive a Certificate of Attendance.
Will this course make me a certified ISO 27001 lead auditor?
No. It is a training certificate, not an accredited personnel-certification credential, and it does not register you as a lead auditor. A registered credential comes from a personnel certification body and usually also needs audit experience.
Do I need ISO 27001 knowledge before I start?
Yes, a working knowledge of ISO/IEC 27001 and of how an ISMS runs is recommended. If you are new to the standard, start with awareness training.
Which edition of ISO 27001 is taught?
ISO/IEC 27001:2022, the only edition organizations can be certified to. The transition from the 2013 edition ended on 31 October 2025.
What is the difference between ISO 27001 lead auditor and internal auditor training?
Internal auditor training prepares you to audit your own organization under clause 9.2. Lead auditor training adds planning and leading full audits, managing an audit team, and how second and third-party certification audits work.
Does taking your training help our company get ISO 27001 certified?
No. Training is kept separate from certification. Our courses are open and generic, they do not advise on your own ISMS, and they do not affect any audit decision.
Can you run this course for our team?
Yes. Tell us how many people, preferred dates, language and time zone, and we will confirm a private group plan.
Ready to Lead ISO 27001 Audits?
Pick a session from the schedule, or register your interest and we will contact you with the next dates.
See dates and register →Last reviewed by the Accredify Global training team.