ISO 42001 Lead Auditor exam: format, pass mark and how to pass

ISO/IEC 42001 was published in late 2023. Past papers do not exist. The first cohorts of certified Lead Auditors are still being seated. If you are sitting this exam in the next few weeks, you are doing it without the multi-year deck of practice material that 27001 candidates take for granted.

This guide covers the exam itself - the format, the pass mark and the seven weighted domains, verified against the PECB Candidate Handbook v1.4 - and the prep plan we wish someone had handed us when we were the candidate, not the trainer. If you are sitting with CQI/IRCA, Exemplar Global or TRECCERT (the other personnel certifiers offering 42001 schemes), or training via BSI, TÜV or DNV whose 42001 courses are typically CQI/IRCA-accredited, the exam mechanics differ but the underlying knowledge - ISO/IEC 42001:2023, ISO 19011:2018 audit guidance, and ISO/IEC 23894:2023 AI risk guidance - is identical. For how each provider runs its Lead Auditor exam side by side, see the Lead Auditor exam format comparison.

The exam at a glance

For PECB ISO/IEC 42001 Lead Auditor:

• 80 multiple-choice questions with three options each (one correct, two distractors). A mix of stand-alone questions and scenario-based sets - each scenario is a short company case, followed by five linked questions.
• 3 hours (180 minutes) - ~2.25 minutes per question on average, with scenario sets adding reading time on top.
• Open-book. PECB allows three reference items: a hard copy of ISO/IEC 42001, your training course materials, and any personal notes from the training course (via the PECB Exams app or printed).
• 70% to pass. Below that is a fail; you can re-sit (some PECB-accredited courses bundle a re-sit attempt - check with your training partner).
• Remote-proctored by default. You sit at your own desk on your own machine, with a live proctor watching via webcam. Paper-based sittings are available through your PECB-accredited training partner.

Other providers (BSI, Exemplar Global) run slightly different format mixes. The knowledge tested is the same; the timing and answer style differ.

The seven competency domains, weighted

PECB distributes the 80 questions across seven competency domains, with explicit weights published in the candidate handbook. The domains are not equally weighted. Calibrating prep against the actual weights leaves marks on the table.

PECB 42001 LA verified domain weighting (Candidate Handbook v1.4)

1. Fundamental AIMS principles and concepts (12 questions / 15%) - what an AIMS is, why ISO 42001 exists, ethical considerations baked into the standard.
2. AI management system requirements (8 questions / 10%) - 42001 clauses 4-10: context, leadership, planning, support, operation, performance evaluation, improvement.
3. Fundamental audit concepts and principles (16 questions / 20%) - ISO 19011 vocabulary, the seven audit principles, evidence types.
4. Preparing an ISO/IEC 42001 audit (9 questions / 11.25%) - scope, criteria, audit programme, audit plan, document review.
5. Conducting an ISO/IEC 42001 audit (19 questions / 23.75%) - opening meeting, evidence gathering, interview technique, findings. Biggest single chunk of marks.
6. Closing an ISO/IEC 42001 audit (7 questions / 8.75%) - report, distribution, follow-up, corrective action verification.
7. Managing an ISO/IEC 42001 audit programme (9 questions / 11.25%) - the programme manager view, multi-audit coordination, competence management.

Domain 5 (Conducting) alone is worth nearly 1 in every 4 questions. Front-load it.

Roughly 45% of the exam tests comprehension/application/analysis; 55% tests evaluation. The evaluation half is where scenario-based questions cluster.

What you are actually being tested on

42001 Lead Auditor exams test three things, in roughly equal measure:

1. AIMS structure and clause recall - can you locate and apply a specific 42001 requirement under time pressure, and explain why it sits in the management-system layer (clauses 4-10) versus the AI-specific layer (clauses 6.1.4 and 8.4).
2. AI-specific audit judgement - can you tell an AI system impact assessment from an AI risk assessment, an AIMS scope from an AI-system scope, and a 42001 control from a generic management-system requirement.
3. ISO 19011 audit-process judgement - the same evidence-vs-finding, competence-vs-independence, shall-vs-should judgement that any Lead Auditor exam tests, applied to AI-system audits.

The three traps that catch most 42001 candidates

Across the candidates we have coached, the same three trap patterns account for the majority of avoidable losses.

Different clauses, different purposes, different operational feeds

Two more ways candidates lose marks. Modal verbs: ISO 42001:2023 is full of “shall” clauses and ISO 19011:2018 is full of “should” clauses, so under three-hour MCQ pressure a distractor that softens “shall” to “should” reads as correct - flag the modal verb on every requirement question. Scenario sets: each one is a short company case followed by five linked questions, so misreading the case can cost all five marks. Read the scenario twice before touching the questions, and mark the details that look like findings or nonconformities as you go.

Open-book strategy

PECB 42001 Lead Auditor (and most other providers) is open-book. Open-book means you can verify, not learn. Three hours for 80 questions is not enough to look up everything you do not remember.

Time management

PECB’s format is 80 multiple-choice questions in 3 hours: about 2.25 minutes per question on average. Stand-alone items should take about a minute, which buys time for the scenario sets and a pass over your flagged questions at the end. (PECB is retiring its older 12-question essay exam; if your booking is still for that format, budget 15 minutes per question instead.)

Spend the flag pass on term precision. ISO 42001 is new enough that examiners test it hard: options that swap impact and risk are written to look right at a glance.

The 2-to-4-week plan

If you are 2 weeks out:

• Days 1-4: Go through your course material end-to-end - the slides, handouts, exercises from the five-day course. Most candidates need ~4 focused days for this. Focus on clauses 6.1 (all of it - General, AI risk, AI risk treatment, AI system impact), 8 (operations), and Annex A control families, and front-load Domain 5 (Conducting the audit), the heaviest-weighted domain.
• Days 5-8: Active retrieval only. Drop the re-reading. Practice questions with rationales in Mindset Prep, especially on the impact-vs-risk trap. (10 free per exam are on this site.)
• Days 9-11: One full mock under timed conditions. Score yourself honestly. Note every term-precision slip.
• Days 12-13: Targeted re-read of the course-material sections + clauses you got wrong AND a fresh pass through 23894 risk-treatment language. Drill the trap patterns Mindset Prep surfaced in the mock.
• Day 14: Light review, light exercise, early sleep. Do not study the night before.

If you are 4 weeks out, double the active-retrieval phase and add a second mock exam. The biggest mistake 42001 candidates make at the 4-week mark is reading 42001 cover-to-cover again instead of drilling the impact-vs-risk and AIMS-vs-AI-system distinctions.

What 27001 experience does and does not buy you

If you already hold an ISO 27001 Lead Auditor credential, you start ~40% prepared. The High-Level Structure (clauses 4-10) is identical across both standards; ISO 19011 audit method is identical; the audit-vocabulary rules (evidence, finding, nonconformity) are identical.

Annex A is smaller too: 38 controls against 27001’s 93, organised around AI-specific concerns - data quality, model lifecycle, AI ethics function, human oversight, redress mechanisms. And where 27001 candidates lean on ISO/IEC 27005 for risk treatment, 42001 leans on ISO/IEC 23894:2023. You need to know 23894 by name and broad shape, not deep clause.

A common failure pattern: senior 27001 auditors over-confidently sit 42001, treat it as 27001-with-different-controls, and lose marks across the AI-specific clauses. Treat 42001 as its own standard.

On exam day

Per the PECB remote-proctored format:

• Government-issued photo ID required. Bring it to the desk.
• Camera on the entire time. The proctor monitors continuously.
• Clear workspace. Allowed materials are your pre-tabbed printed standard, course materials, and personal notes (or those uploaded via the PECB Exams app). Check your booking confirmation.
• Bathroom breaks are typically permitted but the clock keeps running. Plan around that.
• Submission is electronic into the PECB Exams application.

Online MCQ results arrive immediately. Paper-based sittings take two to four weeks. You receive a pass/fail and, if you fail, a domain-level breakdown for the re-sit.

The most under-prepared part of the syllabus

In our experience coaching 42001 candidates, the most under-prepared area is clauses 6.1.4 and 8.4 - the AI system impact assessment lifecycle. Almost every candidate can talk about the AIMS-level risk assessment because it looks like 27001. Very few can confidently explain when an impact assessment is triggered, what it must include, how often it gets refreshed, and how it feeds the operational controls.

The single biggest failure pattern

After dozens of 42001 candidates, the most common failure pattern is term confusion under time pressure. Candidates use “risk assessment” when they mean “impact assessment”, “AIMS” when they mean “AI system”, and reference 27001 clauses (6.1.3) when the equivalent 42001 clause (6.1.3 too - similar number, different content) is what the question is actually testing.

Where to start

Try the 10 free ISO 42001 Lead Auditor practice questions. Each one is tagged with the trap pattern it tests and the exact 42001 or 23894 clause it draws from. If three or more catch you out, the full 42001 Lead Auditor bank (500+ clause-cited questions across all seven competency domains) is the next logical step. The 3-day free trial gets you in.

Sitting Lead Implementer instead? Read the ISO 42001 Lead Implementer exam guide.