On this page (11)
- The exam at a glance
- The seven competency domains, weighted
- What you are actually being tested on
- The three traps that catch most candidates
- Three things PECB tests harder than other providers
- Open-book strategy
- Time management
- The 2-to-4-week plan
- On exam day
- The single biggest failure pattern
- Where to start
You finished the Lead Auditor course four weeks ago. The slides are still in your head. The clause numbers are starting to blur. The exam is in two weeks and you are doing the maths on whether to cram every weekend or whether you should already be panicking.
This guide covers the exam itself - the format, the pass mark and the seven weighted domains, verified against the PECB Candidate Handbook v1.5 - and the prep plan that closes the gap, the one we wish someone had handed us when we were the candidate, not the trainer. If you are sitting with CQI/IRCA, Exemplar Global or TRECCERT (the other personnel certifiers), or training via BSI, TÜV or DNV whose courses are typically CQI/IRCA-accredited, the exam mechanics differ but the underlying knowledge - the ISO/IEC 27001:2022 standard, ISO 19011:2018 audit guidance, and ISO/IEC 17021-1:2015 certification-body requirements - is identical. For how each provider runs its exam side by side, see the Lead Auditor exam format comparison.
The exam at a glance
questions
minutes
mark
proctored
For PECB ISO/IEC 27001 Lead Auditor:
- 80 multiple-choice questions with three options each (one correct, two distractors). A mix of stand-alone questions and scenario-based sets - each scenario is a short company case, followed by five linked questions that all draw on that scenario.
- 3 hours (180 minutes) - works out to a brisk ~2.25 minutes per question, with the scenario sets adding a few minutes of reading on top.
- Open-book. PECB explicitly allows three reference items: a hard copy of ISO/IEC 27001, your training course materials, and any personal notes taken during the training course (via the PECB Exams app or printed).
- 70% to pass. Below that is a fail. Some PECB-accredited courses bundle a re-sit attempt - check with your training partner.
- Remote-proctored (online) or paper-based in-person via your PECB-accredited training partner. Online uses the PECB Exams application with continuous webcam supervision.
The 80-question multiple-choice format is recall-light, recognition-heavy. Half the exam (~40 questions) tests evaluation - “given this scenario, which answer is correct?” - not “what does Clause 6.1.3 say?” Pure memorisation does not get you across the line. You need clause-application judgement under time pressure.
The seven competency domains, weighted
PECB distributes the 80 questions across seven competency domains, with explicit weights published in the candidate handbook. The domains are not equally weighted. Calibrating prep against the actual weights leaves marks on the table.
PECB 27001 LA verified domain weighting (Candidate Handbook v1.5)
- Fundamentals of an ISMS (13 questions / 16.25%) - what an ISMS is, why 27001 exists, the PDCA cycle, the High-Level Structure.
- ISMS and ISO/IEC 27001 requirements (8 questions / 10%) - the 27001:2022 main-body clauses 4-10 in operational detail.
- Fundamental audit concepts and principles (14 questions / 17.5%) - ISO 19011 vocabulary, the seven audit principles, audit evidence types.
- Preparing an ISO/IEC 27001 audit (12 questions / 15%) - audit plan, criteria, feasibility, audit team selection.
- Conducting an ISO/IEC 27001 audit (18 questions / 22.5%) - opening meeting, evidence gathering, interview technique, findings. Biggest single chunk of marks.
- Closing an ISO/IEC 27001 audit (7 questions / 8.75%) - report drafting, distribution, follow-up.
- Managing an ISO/IEC 27001 audit programme (8 questions / 10%) - the programme-manager view, multi-audit coordination.
Domain 5 (Conducting) alone is worth more than 1 in every 5 questions. Front-load it.
Half the exam tests comprehension/application/analysis; the other half tests evaluation. The evaluation half is where scenario-based questions cluster.
What you are actually being tested on
Lead Auditor exams test three things, in roughly equal measure:
- Clause recall - can you locate and apply a specific requirement under time pressure.
- Audit-process judgement - can you decide what counts as evidence, what becomes a finding, and what escalates to a nonconformity.
- Auditor-conduct judgement - can you separate competence, independence, impartiality, and confidentiality under realistic scenarios.
Almost everyone walks in knowing the content. Almost no-one walks in knowing how the exam will misuse the content to test whether they really know it.
The three traps that catch most candidates
Across hundreds of candidates we have coached, the same three trap patterns account for the majority of avoidable losses.
Trap pattern
Evidence vs finding
The exam shows you something - log entries, an interview statement, a missing record - and asks you what it is. The wrong answer almost always sits one stage along the vocabulary chain. A correct answer of “audit evidence” reads as if “audit finding” would be just as right. It is not.
The vocabulary chain the exam tests on every audit-process question
Evidence is raw; a finding is evidence evaluated against criteria; a conclusion is the outcome considered across all findings. The standard’s terminology is precise and the exam rewards you for treating it precisely.
Trap pattern
Shall vs should
ISO 27001:2022 is full of “shall” clauses. ISO 19011:2018 is full of “should” clauses. Under exam pressure your eye slides past the modal verb and a wrong option that softens “shall” to “should” reads as if it is correct. It is not. Train your eye to flag the modal verb on every requirement-related question.
Trap pattern
Competence vs independence
These are two different things. Competence is what the auditor knows; independence is the auditor’s relationship with this specific client. The exam will routinely give you a scenario where the auditor is competent AND has an independence issue, then ask which one matters. You answer the one in question, not the one in good shape.
There is a fourth, related trap that catches senior candidates: confusing any two of the seven principles in ISO 19011:2018 Clause 4 (integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach). Practise naming each one cold.
Three things PECB tests harder than other providers
PECB-specific
Scenario sets - five questions, one mistake
Each scenario-based set is a single short case followed by five linked questions. If you misread the scenario, you can lose all five. The scenarios are paragraphs long and embed details that the questions interrogate one at a time (the policy was published but not communicated, the auditor noted X but did not record Y, etc.). Read the scenario in full, twice, before touching the questions, and mark the details that look like findings or nonconformities as you go. Misreading the scenario is the single biggest avoidable mistake on the PECB exam.
PECB-specific
ISO/IEC 17021-1 alongside 27001
Most providers test ISO/IEC 27001 and ISO 19011. PECB also tests ISO/IEC 17021-1:2015 - the requirements for bodies providing audit and certification of management systems. Candidates often miss this. The questions that draw on 17021-1 tend to live in Domains 3, 4 and 7.
If your course materials are light on 17021-1, supplement with the standard itself while you study: the impartiality requirements (clause 5), the competence requirements (clause 7), and the certification-process requirements (clause 9).
PECB-specific
Vocabulary distractors that look identical
PECB distractor pairs are written to look almost identical to the correct answer, differing by a single keyword - “audit evidence” vs “audit finding”, “shall” vs “should”, “observation” vs “nonconformity”, “first-party” vs “second-party”. You can know the standard cold and still pick the wrong option if you skim. The MCQ format rewards careful reading more than recall depth.
Bank a clean mental copy of ISO 19011:2018 Clause 3 (Terms and definitions) before exam day. Knowing the exact PECB vocabulary closes those distractor pairs in one pass.
Specifically, drill the four Annex A control families:
- 5.X Organisational controls - policies, roles, supplier management, ISMS in practice.
- 6.X People controls - background checks, awareness, employment lifecycle.
- 7.X Physical controls - secure areas, equipment.
- 8.X Technological controls - cryptography, access control, secure development.
Knowing which family a given scenario lives in is faster than searching through 93 numbered controls under time pressure.
Open-book strategy
Most Lead Auditor exams (PECB in particular) are open-book. New candidates hear this and relax. They should not. Three hours for 80 questions is not enough time to look up everything you do not remember.
The rule
Open-book means you can verify, not learn.
If you do not know it cold, the standard on your desk is not going to teach it to you in two minutes. It is there so you can confirm a clause number or check the precise wording of a definition - not so you can read your way to the answer. PECB allows a hard copy of ISO/IEC 27001, your training course materials and your personal notes from the course; other providers set their own rules, so check what yours allows before you tab anything.
Two rules:
- Pre-tab your copy of the standard. Tab the main-body clauses you know come up - 4.3 scope, 6.1.3 risk treatment + SoA, 7.5 documented information, 9.2 internal audit, 9.3 management review, 10.2 nonconformity - and tab Annex A by control family (5.X, 6.X, 7.X, 8.X). Number-tabs are faster than topic-tabs under stress.
- Look up to verify, not to learn. If you genuinely do not know an answer, do not waste five minutes hunting. Flag it, move on, come back. The candidates who fail open-book exams are usually the ones who looked up everything and ran out of time on the last block of questions.
Time management
PECB’s format is 80 multiple-choice questions in 3 hours: about 2.25 minutes per question on average. Stand-alone items should take about a minute, which buys time for the scenario sets and a pass over your flagged questions at the end. (PECB is retiring its older 12-question essay exam; if your booking is still for that format, budget 15 minutes per question instead.)
question
question
at the end
question
Leave time for the flag pass. Candidates who miss by a few marks usually ran out of time on questions they had flagged, or rushed the read on the last block of scenario questions, not on questions they did not know.
The 2-to-4-week plan
If you are 2 weeks out:
- Days 1-4: Go through your course material end-to-end - the slides, handouts, exercises from the five-day course. Most candidates need ~4 focused days for this. Skim ISO/IEC 17021-1 once if you have not, front-load Domain 5 (Conducting the audit), the heaviest-weighted domain, and mark the clauses you feel least sure on as you go. Do not re-watch the recorded sessions.
- Days 5-8: Active retrieval only. Drop the re-reading. Scenario-based practice questions with rationales in Mindset Prep, drilling the evidence-vs-finding and shall-vs-should traps and the scenario-set rhythm. (10 free per exam are on this site.)
- Days 9-11: One full 80-question mock under timed conditions. Score yourself honestly against the 70% mark. Note which domains you lost most marks in.
- Days 12-13: Targeted re-read of the course-material sections + clauses you got wrong, plus a glossary review of ISO 19011 Clause 3. Drill the trap patterns Mindset Prep surfaced in the mock.
- Day 14: Light review, light exercise, early sleep. Do not study the night before.
If you are 4 weeks out, double the active-retrieval phase and add a second mock exam. Skip the temptation to read the standard cover-to-cover - it is the lowest-ROI prep activity available to you.
On exam day
- Government-issued photo ID required. Have it on the desk.
- Camera on the entire time (online sittings). The proctor monitors continuously.
- Workspace must be clear other than your pre-tabbed printed standard, course material, and personal notes (or these uploaded via the PECB Exams app). Check your booking confirmation for the specifics of your sitting.
- Bathroom breaks are permitted but the clock keeps running.
- Submission is electronic into the PECB Exams application.
Online MCQ results arrive immediately. Paper-based sittings take two to four weeks for results. You receive pass/fail plus, if you fail, a domain-level breakdown that helps you understand where you lost marks for the re-sit.
The single biggest failure pattern
After hundreds of candidates, the single most common failure pattern is this: candidates pass the practice quiz comfortably, then sit the real exam and lose 25% of their marks on three or four questions where they used the wrong clause locator, the wrong modal verb, or the wrong audit-vocabulary term. The content was right. The precision was not.
Active practice with tagged trap patterns - knowing which trap each wrong answer uses - is what fixes precision. Re-reading the standard is not. This is what Mindset Prep is built around.
Where to start
Try the 10 free ISO 27001 Lead Auditor practice questions. Each one is tagged with the trap pattern it tests and the exact clause it draws from. If three or more catch you out, the full Lead Auditor bank (600+ clause-cited questions across all seven PECB domains, with the scenario sets drilled at the same rhythm the real exam uses) is the next logical step - the 3-day free trial gets you in.
If you were comparing exam-prep apps, note that Pocket Prep carries no PECB or ISO exams - see the full Mindset Prep vs Pocket Prep comparison.