Skip to main content
Contact Us

UK career guide

How to Become an ISO 27001 Lead Auditor in the UK: Course, Exam, Audit Hours and UKAS

Mindset Cyber, an authorised PECB training partner, sells PECB's ISO/IEC 27001 Lead Auditor eLearning in the UK with the exam included. This guide covers what you need before you start, the course and the exam, the audit hours behind each PECB credential level, what UKAS schedule 21923 lists, and how people move into audit from quality, compliance, IT, admin and finance roles.

Last reviewed 12 November 2026

UK customers pay 20% VAT, added at checkout.

Mindset Cyber is a PECB Authorised Titanium Partner, PECB's highest partner level.

What do you need before you start?

No degree, audit background or earlier certificate: Mindset Cyber enrols you on the PECB ISO/IEC 27001 Lead Auditor eLearning as you are, and PECB lets you sit the exam with no work experience at all.

What helps is a different list from what is required. Three things make the course easier:

  • Some information security vocabulary. If risk treatment, the Statement of Applicability and Annex A controls are new terms to you, take the ISO/IEC 27001 Foundation first (£209 + VAT). If they are familiar, go straight to the Lead Auditor course.
  • Your own copy of ISO/IEC 27001. The exam is open book, and PECB allows a hard copy of the standard and the course materials. The standard is not part of the course, so buy it separately if you want one.
  • A plan for experience. Everyone sits the same exam; the credential level depends on your work and audit history, so start a dated audit log early.

The course and the exam

The course Mindset Cyber sells for the PECB ISO/IEC 27001 Lead Auditor credential is PECB's own eLearning, and its price, £449 + VAT, includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community.

Pre-recorded video lessons by PECB Certified Trainers, with quizzes and the official course materials on myPECB. Plan on about 30 to 40 hours of study (our estimate, not a PECB figure), the content of a five-day classroom course, at whatever pace suits your week.

When you are ready, you book one of PECB's online exam sessions and sit it in the PECB Exams application, supervised remotely by a PECB invigilator. It has 80 multiple-choice questions, some standing alone and some built around a scenario, and you need 70% to pass. Two of its seven domains test the information security management system itself; the other five test audit method, from audit principles to preparing, conducting and closing an audit and managing an audit programme. If the first attempt does not go your way, a second within your 12 months is included.

While you study, the Mindset Cyber learner hub, included with the course, lets you put questions to a PECB Certified Trainer, answered within two days, and join a members-only community of learners on the same exam.

PECB's credential levels and the experience each needs

One exam, four credentials: the PECB ISO/IEC 27001 Lead Auditor exam that comes with Mindset Cyber's course leads to whichever level your experience supports when you apply, and you can move up later.

Credential Work experience Of which in information security management Audit hours
PECB Certified ISO/IEC 27001 Provisional Auditor None None None
PECB Certified ISO/IEC 27001 Auditor 2 years 1 year 200
PECB Certified ISO/IEC 27001 Lead Auditor 5 years 2 years 300
PECB Certified ISO/IEC 27001 Senior Lead Auditor 10 years 7 years 1,000

Provisional Auditor needs nothing beyond the exam. Each level above it adds years of work, a share of them in information security management, and audit hours: 200 for Auditor, 300 for Lead Auditor and 1,000 for Senior Lead Auditor.

Every level also asks you to sign the PECB Code of Ethics, and every level above Provisional asks for two professional references who have worked with you; they cannot be someone you supervise or a relative. PECB's certification rules accept internal audits, second-party audits of suppliers, third-party audits, pre-audits, gap analyses and opinion audits as audit experience, and the handbook expects the hours to include activities such as planning an audit, conducting on-site audits, drafting nonconformity reports and leading an audit team.

Apply within 12 months of buying the eLearning, with your job titles, dates and descriptions. PECB's Certification Department checks the application and emails you its decision. If you start at Provisional or Auditor, you upgrade from your myPECB dashboard once your log reaches the next level.

Moving into audit from another job

You can start from where you are: the PECB ISO/IEC 27001 Lead Auditor eLearning from Mindset Cyber needs no audit background, and your first audit hours can come from the controls, records or evidence your current job already touches.

If you work in UK job titles What you bring Where your audit hours can come from
Quality Quality manager, QA officer, ISO 9001 internal auditor Audit planning, sampling, nonconformities and corrective action, and a working knowledge of how a management system standard is audited. Join your organisation's ISMS internal audit programme as a team member. Your quality years count as work experience; the information security years still need building.
Compliance Compliance officer or analyst, including at FCA-regulated firms; data protection officer Turning rules into tests, weighing evidence and writing findings that management has to answer. A gap analysis or pre-audit against ISO/IEC 27001 counts as audit experience for PECB, as do internal audits. Compliance work on security obligations may count towards the information security years.
IT Infrastructure engineer, service desk lead, IT manager, managed service provider engineer How access control, backups, logging and change management really run, and where the evidence for them sits. Technical interviews and evidence checks in internal ISMS audits, and audits of suppliers (second-party audits, in PECB's terms).
Admin Office manager, PA or executive assistant, document controller Document control, version history, registers, diaries and minutes: the records an ISMS runs on and the logistics an audit runs on. A place on internal audit teams: PECB counts drafting audit working documents and reviewing the audit's documented information. Supporting the ISMS document register builds the security years.
Finance Management accountant, finance business partner, internal auditor Evidence, sampling, working papers and independence, and the habit of reporting findings to an audit committee. A financial audit is not an ISMS audit, so add ISMS internal audits or audits of IT controls to your log, and note the scope of each.

Each background brings part of an auditor's skill set. Most of them leave a gap in the information security management experience PECB asks for at Auditor and Lead Auditor level, so plan that alongside the audit hours.

Where each level's experience comes from. Provisional Auditor needs nothing but the exam pass, so it is where anyone changing jobs starts. Auditor, Lead Auditor and Senior Lead Auditor are built from the same sources at growing totals: internal audits, supplier audits, gap analyses and pre-audits logged while you work in or alongside an ISMS, and later third-party audits for a certification body. You reach each one by applying to upgrade in myPECB.

The conditions for any of these moves: the course is £449 + VAT, about 30 to 40 hours of study (our estimate, not a PECB figure) with 12 months of access. Provisional Auditor needs no experience; Auditor needs 2 years' work (1 in information security management) and 200 audit hours; Lead Auditor 5 years (2) and 300 hours; Senior Lead Auditor 10 years (7) and 1,000 hours.

UKAS, IRCA and the scheme a UK role names

The credential Mindset Cyber's course leads to, PECB Certified ISO/IEC 27001 Lead Auditor, is listed in UKAS schedule 21923: UKAS, the United Kingdom Accreditation Service, accredits PECB under ISO/IEC 17024:2012 to provide certification of persons.

Issue 008 of the schedule, dated 3 November 2026, lists six PECB credentials: ISO/IEC 27001 Lead Implementer and Lead Auditor, ISO 9001 Lead Implementer and Lead Auditor, and ISO/IEC 42001 Lead Implementer and Lead Auditor. The accreditation is PECB's, as the certification body that issues the credential, not Mindset Cyber's. You can read the UKAS schedule yourself.

CQI and IRCA. UK candidates also meet CQI and IRCA certification, a separate scheme. The CQI publishes a register of IRCA auditors that can be searched by scheme and grade, and IRCA's audit log rules count audits performed after passing an IRCA Certified Training Course, within the five years before you apply, against the scheme's standard and in line with ISO 19011 or ISO 17021. Those rules do not accept gap analyses, close-out visits or follow-up visits.

A PECB course leads to the PECB credential, not to IRCA certification. If an advert, a client or a certification body names one scheme, check which it asks for before you enrol.

UK job titles, and how often adverts name these skills

UK adverts list ISO 27001 audit work under titles from internal ISMS auditor to certification body assessor, and the PECB ISO/IEC 27001 Lead Auditor credential that Mindset Cyber's course leads to shows an employer two things: that you passed PECB's exam on auditing an information security management system, and, from Auditor level up, that PECB has checked your experience and audit hours.

The titles to look for include:

  • internal ISMS auditor, information security auditor or IT auditor, in internal audit and assurance teams;
  • lead auditor or assessor at a certification body, carrying out third-party certification audits;
  • GRC analyst or GRC manager;
  • cyber security assurance analyst or manager;
  • supplier assurance or third-party risk analyst, auditing suppliers;
  • information security compliance manager.

Read each advert's requirements as well as its title: some ask for audit experience or a named certification scheme on top of a credential.

How often UK adverts cite the skills. In the six months to 11 November 2026, ITJobsWatch counted 1,586 UK permanent job adverts citing ISO/IEC 27001, 1.29% of all the permanent adverts it tracks. In the same six months it counted 654 UK permanent job adverts citing GRC, against 247 a year earlier, and GRC's share of all the permanent adverts it tracks rose from 0.48% to 0.53%.

These are counts of adverts, not of people hired, and they say nothing about any one applicant. The course is £449 + VAT, about 30 to 40 hours of study (our estimate, not a PECB figure) with 12 months of access. A pass with no experience earns Provisional Auditor; Auditor needs two years' work experience, including one in information security management, plus 200 hours of audits; Lead Auditor needs five years' work experience, including two in information security management, plus 300 hours of audits; Senior Lead Auditor needs ten years' work experience, including seven in information security management, plus 1,000 hours of audits.

Frequently asked questions

How do I become an ISO auditor?

Pass an auditor exam, then build audit experience: in the UK, Mindset Cyber sells the PECB ISO/IEC 27001 Lead Auditor eLearning (£449 + VAT, and about 30 to 40 hours of study: our estimate, not a PECB figure) with the exam included, and PECB awards the credential level your experience supports. Study the course, pass PECB's open-book exam, apply in myPECB and keep a dated audit log so you can upgrade. Provisional Auditor needs no experience; Auditor needs two years' work experience, including one in information security management, plus 200 hours of audits; Lead Auditor needs five years' work experience, including two in information security management, plus 300 hours of audits; Senior Lead Auditor needs ten years' work experience, including seven in information security management, plus 1,000 hours of audits. The credential is listed in UKAS schedule 21923, PECB's accreditation under ISO/IEC 17024. Some UK roles name CQI and IRCA certification instead, a separate scheme with its own certified training courses and audit log rules, so check which scheme a role asks for.

Can I become an ISO 27001 auditor with no experience?

Yes, at the first level: after Mindset Cyber's PECB ISO/IEC 27001 Lead Auditor course, a pass with no experience earns the PECB Certified ISO/IEC 27001 Provisional Auditor credential. PECB's rules say work experience and references do not apply to Provisional certificates. The higher levels need years of work, part of them in information security management, and logged audits, and you upgrade in myPECB once you have them.

Is the PECB ISO 27001 Lead Auditor credential recognised in the UK?

It is UKAS accredited: the PECB Certified ISO/IEC 27001 Lead Auditor credential that Mindset Cyber's course leads to is listed in UKAS schedule 21923 (issue 008, 3 November 2026), under which UKAS accredits PECB to ISO/IEC 17024:2012 to certify persons. The accreditation is PECB's, as the certification body, not Mindset Cyber's. An employer or client may still ask for a particular scheme, so check what a role names.

What is the difference between PECB and IRCA lead auditor certification?

They are separate schemes: Mindset Cyber's course leads to the PECB Certified ISO/IEC 27001 Lead Auditor credential, issued by PECB, while IRCA certification is the CQI's. IRCA's audit log rules count audits performed after passing an IRCA Certified Training Course, within the five years before you apply. PECB sets its levels by work experience and audit hours, and PECB's rules accept gap analyses as audit experience, which IRCA's audit log rules do not. A PECB course does not lead to IRCA certification, so check which scheme a role asks for before you enrol.

How long does it take to become an ISO 27001 Lead Auditor in the UK?

The study is the short part: Mindset Cyber's PECB ISO/IEC 27001 Lead Auditor eLearning is about 30 to 40 hours of study (our estimate, not a PECB figure), with 12 months of access and a second exam attempt included. The full Lead Auditor credential then depends on experience: five years' work experience, including two in information security management, plus 300 hours of audits. Until you have it, you can hold the Provisional Auditor or Auditor credential and upgrade later.

What does the ISO 27001 Lead Auditor course cost in the UK?

At Mindset Cyber, the PECB ISO/IEC 27001 Lead Auditor eLearning is £449 + VAT, including the exam voucher and two attempts, the certification fee, the first year of PECB maintenance, 12 months of access, a Mindset Cyber study guide and the Mindset Cyber learner hub. The optional ISO/IEC 27001 Foundation is £209 + VAT. UK customers pay 20% VAT, added at checkout.

Next steps

Every course is priced in pounds and includes the PECB exam voucher, two exam attempts and the certification fee.

Official PECB eLearning

PECB Certified ISO/IEC 27001 Lead Auditor

£449 + VAT

UK customers pay 20% VAT, added at checkout.

Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 31 CPD credits.

View course → Official PECB eLearning

PECB Certificate Holder in ISO/IEC 27001 Foundation

£209 + VAT

UK customers pay 20% VAT, added at checkout.

Includes the PECB exam voucher, two exam attempts, the certification fee, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 14 CPD credits.

View course →

Sources

Every source was read on 12 November 2026. Quotations keep their original spelling.

  • UKAS, Schedule of Accreditation 21923, PECB, issue 008 (3 November 2026): https://www.ukas.com/wp-content/uploads/schedule_uploads/963637/21923Personnel-Certification.pdf
  • PECB, Accreditations and affiliations: https://pecb.com/en/about/accreditations-and-affiliations
  • PECB, Candidate Handbook, ISO/IEC 27001 Lead Auditor, version 1.5 (2026): https://pecb.com/pdf/candidate-handbooks/pecb-candidate-handbook-iso-27001-lead-auditor-mc.pdf
  • PECB, Certification Rules and Policies: https://pecb.com/en/certification-rules-and-policies
  • CQI and IRCA, Find an auditor: the IRCA register (members.quality.org): https://members.quality.org/SelfService/find-an-auditor.aspx
  • CQI and IRCA, Audit Log help: IRCA audit requirements, sections 5.2 to 5.4 (members.quality.org): https://members.quality.org/ss/SelfService/Joining_Forms/IRCA/Audit_Log_help.aspx
  • ITJobsWatch, "GRC" (UK permanent), data to 11 November 2026, read 12 November 2026: https://www.itjobswatch.co.uk/jobs/uk/grc.do
  • ITJobsWatch, "ISO/IEC 27001" (UK permanent), data to 11 November 2026, read 12 November 2026: https://www.itjobswatch.co.uk/jobs/uk/iso27001.do
  • PECB partner directory, Mindset Cyber record: https://pecb.com/en/partners?companyName=Mindset+Cyber&modal=188350