Dejan Kosutic Updated: November 14, 2022.
Many people think that just by attending the ISO 27001 Lead Auditor Course they have become the ISO 27001 Lead Auditor. Well, this is not entirely true.
This article will show the steps you need to take if you want to work as an auditor for a certification body. If you want to work as an internal auditor, you basically do not need the Lead Auditor Course or anything else mentioned here – you can perform internal audits by just proving you have enough experience and knowledge.
Steps for becoming the ISO 27001 Lead Auditor
- Obtain Lead Auditor certificate
- Gain prior experience
- Find a certification body
- Go through training
- Gain audit experience
ISO 27001 Auditor Training
There are two types of auditor training: internal auditor training, which is a 2-day program, and lead auditor training as a 5-day program. Both types of auditor training are based on ISO 19011:2018 concepts, terminology, and guidelines. These concepts include how to plan audits, select the audit team, initiate the audit, and conduct opening meetings. Both ISO 27001 auditor trainings cover topics of ISO 27001 in detail, as well as how to perform the entire audit process, from planning an audit program to reporting on audit results. Therefore, ISO 27001 auditor training attendants learn how to apply auditing techniques according to ISO 27001 and controls given in Annex A.
Unlike in internal auditor training, in ISO 27001 Lead Auditor training future auditor candidates learn communication techniques during the audit, understand audit team responsibilities, conduct on-site activities, and identify findings. The last part of the training is preparation and conducting closing meetings and, finally, reporting audit techniques. During ISO 27001 Lead Auditor training there are also related exercises, including role-plays. In addition, to complete the course successfully, you have to pass the exam.
ISO 27001 Auditor Certification
So, you passed the exam to finish the auditor training and you received your certificate, but this still doesn’t mean that you can go and conduct audits.
ISO 27001 auditor certification is a starting point for working as an auditor for certification bodies providing certification audits.
If you are not interested in working for a certification body, having an ISO 27001 auditor certification is very useful for consultants and/or for internal auditors: You can prove your competence to your potential clients or your employer.
Steps for becoming the ISO 27001 Lead Auditor
So, if you want to become lead auditor, here is what ISO 27006 (standard that defines the requirements for certification bodies) requires:
- Obtain Lead Auditor certificate – To obtain this certificate, you need to attend the ISO 27001 Lead Auditor Course and pass the exam. The course lasts five days, and on the fifth day you need to pass the written exam. Therefore, you need to invest considerable effort, not only by studying for the exam but also by attending the full five days of the course. If you miss a single day, you will not be permitted to take the exam.
- Gain prior experience – You need to have at least four years of experience in information technology, of which at least two years must be in a job related to information security.
- Find a certification body – You need to find a certification body which needs an ISO 27001 certification auditor – that may prove to be a difficult task, since most of the certification bodies already have their auditors.
- Go through training – When you find the certification body which is interested, this doesn’t mean you’ll start auditing tomorrow – ISO 27006 requires you to go through a trainee program (or similar) during which you will attend real certification audits (done by more experienced colleagues) where you will learn how to perform such audits. Usually, this trainee period lasts 20 audit days after which you’ll be entitled to perform ISMS audits as part of the audit team.
- Gain audit experience – To become the ISO 27001 Lead Auditor, i.e. to lead a team of auditors performing ISO 27001 audit, you need to have experience in at least three complete ISMS audits.
After you finish all these steps, you will be able to perform the ISMS audits as the team leader. So, the ISO 27001 Lead Auditor Course is just the beginning of your journey…
Click here to join a free ISO 27001 Lead Auditor Online Course where you can learn everything about the role of Lead Auditor.
