Take ISO/IEC 27001 Lead Implementer if your job is to build or run an information security management system (ISMS). Take Lead Auditor if your job is to assess one. Both are five-day PECB courses at the same level. They share the same knowledge of the standard and differ in what they teach you to do with it.
The difference at a glance
| Lead Implementer | Lead Auditor | |
|---|---|---|
| What you learn to do | Plan, build, run and improve an ISMS | Plan, conduct, report and follow up an ISMS audit |
| Typical roles | Information security manager, ISMS project lead, consultant | Certification body auditor, internal auditor, compliance or assurance lead |
| Main skills | Scoping, risk assessment and treatment, selecting controls, Statement of Applicability, measuring performance | Audit planning, interviewing, collecting and evaluating evidence, writing nonconformities, reporting |
| Other standards used | ISO/IEC 27002 for control guidance | ISO 19011 and ISO/IEC 17021-1 for auditing |
| Length | 5 days, 31 CPD credits | 5 days, 31 CPD credits |
| Experience counted for the credential | ISMS project activities | Audit activities |
What Lead Implementer covers
The ISO/IEC 27001 Lead Implementer course follows an implementation project from start to finish. You define the scope, get management commitment, assess and treat risk, choose controls from Annex A, write the Statement of Applicability, put the controls in place, measure how the system performs and prepare for the certification audit.
Choose it if you are the person an organization relies on to get certified or stay certified.
What Lead Auditor covers
The ISO/IEC 27001 Lead Auditor course follows an audit from start to finish. You learn the audit principles in ISO 19011, plan an audit, lead the team, collect evidence through interviews, observation and document review, decide whether it shows conformity, write nonconformities and present conclusions.
Choose it if you audit for a certification body, run your organization’s internal audit programme, or need to know how your ISMS will be judged.
Which one is right for you
- You run or are building an ISMS: Lead Implementer.
- You work for, or want to work for, a certification body: Lead Auditor.
- You are an internal auditor: Lead Auditor.
- You are a consultant: start with Lead Implementer, then add Lead Auditor.
- You are new to the standard: start with ISO/IEC 27001 Foundation.
- You hold a 2013-edition credential: the ISO/IEC 27001 Transition course covers what changed in the 2022 edition.
The exam and the credential
Each course ends with its own PECB exam. Passing the exam does not by itself make you a “Lead”. PECB awards the credential that matches your experience:
| Auditor credential | Professional experience | Audit activities |
|---|---|---|
| Provisional Auditor | None | None |
| Auditor | Two years, one in information security management | 200 hours |
| Lead Auditor | Five years, two in information security management | 300 hours |
| Senior Lead Auditor | Ten years, seven in information security management | 1,000 hours |
The implementer credentials follow the same four levels, with ISMS project activities in place of audit activities. All credentials require signing the PECB Code of Ethics. The full tables are on each course page.
How the courses are delivered
Both courses are available as e-learning, as hybrid (self-paced plus one day of one-to-one coaching) and as a live online class. The course pages list the current dates and prices. All ISO/IEC 27001 courses are on one page.
Sources: ISO/IEC 27001:2022, Information security management systems (ISO) and the PECB ISO/IEC 27001 certification scheme.
Frequently asked questions
Which is harder, Lead Auditor or Lead Implementer?
Neither is harder in general. They test different skills. Lead Implementer asks you to apply the requirements to building a management system. Lead Auditor asks you to apply audit principles and judge evidence. Most people find the one closer to their daily work easier.
Can I take both courses?
Yes. Many consultants hold both. Knowing how an auditor judges a system makes you a better implementer, and knowing how a system is built makes you a better auditor.
Do I need the Foundation course first?
No. Foundation is not a formal prerequisite for either Lead course. It helps if you are new to ISO/IEC 27001, because the Lead courses assume you already know the basics of the standard.
Does passing the exam make me a Lead Auditor straight away?
Passing the exam is the first step. The PECB Certified ISO/IEC 27001 Lead Auditor credential also requires five years of professional experience, two of them in information security management, 300 hours of audit activities and signing the PECB Code of Ethics. With less experience you can apply for the Provisional Auditor or Auditor credential.
