Skip to main content
Ace Skills Consulting
PECB logoAdvanced

PECB LA: ISO/IEC 27001:2022 Lead Auditor

Lead ISO/IEC 27001 audits from opening meeting to final report, with practised interviewing and evidence skills.

  • 40 hours of live, trainer-led sessions
  • Audit principles based on ISO 19011 and ISO/IEC 17021-1
  • Role-play audit with interviews, sampling and findings
  • Practice writing clear, evidence-based nonconformities
  • Exam preparation for the PECB Lead Auditor exam
Aligned to PECB exam PECB LA
Duration
5 Days | 40 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Advanced
Exam
PECB LA
Language
English

Why learn PECB LA with Ace Skills

  • Audit with evidence

    Learn how to gather, sample and judge evidence so every finding can be traced and defended.

  • Practise interviewing

    Role-play audit interviews with the trainer as auditee, including difficult and evasive conversations.

  • Write better findings

    Get direct feedback on the nonconformity statements you draft, until they are clear and objective.

  • Exam-focused review

    Scenario questions mirror how the exam asks you to apply audit principles to realistic situations.

Course overview

A good ISMS auditor does far more than tick clauses. They plan an audit that targets the riskiest areas, interview people without leading them, sample evidence sensibly, and write findings that are fair, traceable and useful. This five-day course develops those skills for first-party, second-party and third-party audits of an information security management system based on ISO/IEC 27001:2022.

Day one revisits the standard from an auditor's angle: its clauses, the Annex A controls and what conforming evidence typically looks like. Day two introduces audit concepts and principles drawn from the auditing guidelines and certification requirements, including risk-based auditing, evidence and materiality. Day three covers preparation: the audit programme, stage 1 review, audit planning and work documents. Day four is the on-site audit itself, with opening meetings, interviews, observation, sampling and the drafting of nonconformities. Day five covers closing the audit, reporting, follow-up, managing an audit programme, and exam readiness.

Practice is central. Working in small groups on a fictional organisation, you will build an audit plan and checklists, conduct mock interviews with the trainer playing auditee roles, evaluate documents and records, and write up findings. The trainer reviews each group's nonconformity statements so you learn how to make them precise and defensible.

This course is aligned to the PECB Certified ISO/IEC 27001 Lead Auditor exam. Ace Skills Consulting does not provide PECB-licensed courseware; confirm the current exam rules and credential requirements with PECB before booking.

Key features

  • Trainer with experience auditing information security management systems
  • Full audit cycle: programme, planning, fieldwork, reporting, follow-up
  • Role-play interviews and evidence sampling
  • Feedback on nonconformity statements you write
  • Checklist and audit plan templates
  • Practice questions and mock exam
  • Course completion certificate from Ace Skills Consulting

Who should attend

  • Internal auditors of information security
  • Auditors who want to work for certification bodies
  • Consultants preparing clients for certification
  • Information security and compliance managers
  • Supplier and vendor assurance professionals

Prerequisites

  • Basic understanding of information security and ISO/IEC 27001
  • Some audit or compliance experience is helpful
  • Credential levels require audit experience as defined by PECB

Curriculum

5 Days · 40 Hours · 15 Modules · 7 Labs

  1. Standards and certification

    • ISO/IEC 27000 family
    • Certification scheme and accreditation
    • Role of certification bodies

    ISMS requirements

    • Clauses 4–10 and expected evidence
    • Annex A themes and controls
    • Statement of Applicability as an audit input
    • Lab: Identify the evidence you would request for each clause · 50 min

    Common implementation weaknesses

    • Scope and risk process gaps
    • Paper-only controls
    • Weak management review

  2. Audit fundamentals

    • Audit principles and auditor ethics
    • First-, second- and third-party audits
    • Audit criteria, evidence and conclusions

    Risk-based auditing

    • Risk-based approach to audit
    • Materiality and significance
    • Audit sampling methods
    • Lab: Choose a sampling approach for access reviews · 35 min

    Evidence and findings

    • Types and sources of evidence
    • Conformity and nonconformity
    • Major and minor nonconformities
    • Opportunities for improvement

  3. Initiating the audit

    • Audit objectives, scope and criteria
    • Feasibility and team selection
    • Communication with the auditee

    Stage 1 audit

    • Documentation review
    • Readiness assessment
    • Stage 1 report
    • Lab: Conduct a stage 1 documentation review · 50 min

    Planning stage 2

    • Audit plan
    • Work documents and checklists
    • Allocating time and auditors
    • Lab: Build an audit plan and checklist for the case organisation · 50 min

  4. On-site activities

    • Opening meeting
    • Interviews and observation
    • Technical verification of controls
    • Managing time and the audit team

    Interview skills

    • Open and probing questions
    • Avoiding leading questions
    • Handling difficult auditees
    • Lab: Role-play audit interviews with feedback · 60 min

    Drafting findings

    • Writing nonconformity statements
    • Evaluating evidence against criteria
    • Team review of findings
    • Lab: Write and peer-review nonconformities · 45 min

  5. Closing the audit

    • Audit conclusions
    • Closing meeting
    • Audit report
    • Certification recommendation

    After the audit

    • Corrective action plans
    • Follow-up and verification
    • Surveillance and recertification audits
    • Managing an audit programme

    Exam readiness

    • Competency domains review
    • Scenario-based questions
    • Mock exam and review
    • Lab: Mock exam with scenario questions · 90 min
Download full syllabus (PDF)

Skills you will gain

  • ISO/IEC 27001:2022
  • ISMS auditing
  • Audit planning
  • Audit programme management
  • Evidence sampling
  • Audit interviewing
  • Nonconformity writing
  • Audit reporting
  • Corrective action follow-up
  • Annex A controls
  • Stage 1 and stage 2 audits

Tools & technologies

  • Audit plan template
  • Audit checklists
  • Nonconformity report template
  • Sample ISMS documentation set

Certification exam

Exam details
Exam namePECB Certified ISO/IEC 27001 Lead Auditor
Exam codePECB LA
Voucher includedNo — book directly with the vendor

Skill areas measured

  1. Fundamental principles and concepts of an information security management system
  2. Information security management system requirements
  3. Fundamental audit concepts and principles
  4. Preparation of an ISO/IEC 27001 audit
  5. Conducting an ISO/IEC 27001 audit
  6. Closing an ISO/IEC 27001 audit
  7. Managing an ISO/IEC 27001 audit programme

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 40 hours of live, trainer-led sessions
  • 7 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 3 · 50 min

    Build an audit plan and checklist for the case organisation

  • Day 4 · 60 min

    Role-play audit interviews with feedback

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The PECB certification itself is awarded by PECB when you pass exam PECB LA.

Frequently asked questions

Will I be qualified to audit for a certification body after this course?

The course and exam are one step. Certification bodies also expect audit experience and their own internal qualification, and PECB credential levels depend on documented experience.

Is the exam included?

Exam arrangements depend on the batch. Ask our team before enrolling and confirm the current exam rules with PECB.

Do I need to have implemented an ISMS first?

No, but familiarity with ISO/IEC 27001 helps. Day one reviews the requirements from an auditor's perspective.

Is this useful for internal auditors?

Yes. The same planning, interviewing and reporting skills apply to internal audits and supplier audits.

Can we run a private batch for our audit team?

Yes. Request a corporate quote for an online or onsite batch.

Related courses

Explore more

All Cybersecurity courses PECB certifications

PECB is a trademark of Professional Evaluation and Certification Board. ISO/IEC 27001 is a standard published by ISO and IEC.

Train your team on PECB LA

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.