48%

of breaches now involve a third party, with third-party involvement up 60% in a year. Verizon Data Breach Investigations Report 2026.

PECB ISO/IEC 27001 Lead Auditor certification

Trust Is Audited, Not Assumed.

Nearly half of breaches now involve a third party. Lead Auditor gives you the method to test whether an information security management system really works, supplier controls included, and to report what you find.

HRD Corp claimableYayasan Peneraju: may be eligibleKL or online

Exam

PECB Lead Auditor

Course

5 days

Course fee

RM7,500

Exam fee

Included

Next intake

30 Nov 2026

Quick answer

What is ISO/IEC 27001 Lead Auditor?

PECB Certified ISO/IEC 27001 Lead Auditor shows you can plan, conduct, close and manage audits of an information security management system (ISMS) against ISO/IEC 27001:2022. The method follows ISO 19011 and ISO/IEC 17021-1, the guidance and rules used for internal audits and certification audits. The exam is 80 multiple-choice questions, open book, over three hours.

Exam facts verified against pecb.com on 23 Oct 2026

FOR

Internal and external auditors, ISMS managers, GRC and compliance staff

ROLES

ISMS auditor, lead auditor, GRC consultant, compliance manager

SKIP IF

You want to build an ISMS rather than audit one. Take Lead Implementer

01

The Credential

What you study, practise and sit to earn it.

Complete the five-day course, pass the exam on day 5 and sign the PECB Code of Ethics. You then apply for the credential level that matches your experience, from Provisional Auditor up to Senior Lead Auditor.

COURSE

5 days, exam on day 5

MATERIALS

450+ pages, audit case studies

EXAM

3 hrs, 80 Qs, open book

CREDENTIAL

PECB Certified Lead Auditor

Awarded by

PECB

Level

Lead, by experience

Standard

ISO/IEC 27001:2022

No experience yet?

Start as Provisional Auditor

Validity

3 years, with CPD

CPD

31 credits for attendance

02

Decide in 60 Seconds

Four options people compare.

If you want to

Choose

Why

Audit an ISMS, internally or for certification

→

ISO/IEC 27001 Lead Auditor

Five days on auditing against ISO/IEC 27001

Build and run an ISMS

→

ISO/IEC 27001 Lead Implementer

Five days on planning, building and running an ISMS

Audit IT and controls more broadly

→

ISACA CISA

IS audit, control and assurance across the organisation

Learn the standard first

→

ISO/IEC 27001 Foundation

Two-day grounding in ISMS concepts and requirements

Is Lead Auditor the right course for you?
0/4

Tick what applies. 3 or 4: you are ready for Lead Auditor. Fewer: start with ISO/IEC 27001 Foundation.

03

What the Exam Covers

Seven competency domains from PECB’s candidate handbook. Bars to scale.

7 domains, 80 questionsLargest: Conducting an audit, 22.5%

Conducting an ISO/IEC 27001 audit 23%
Fundamental audit concepts and principles 18%
Fundamental principles and concepts of an ISMS 16%
Preparing an ISO/IEC 27001 audit 15%
ISMS and ISO/IEC 27001 requirements 10%
Managing an ISO/IEC 27001 audit programme 10%
Closing an ISO/IEC 27001 audit 9%

Source: PECB ISO/IEC 27001 Lead Auditor Candidate Handbook, version 1.5.

04

What the Course Covers

Five days: the standard, then the audit from start to close.

Five days of instructor-led PECB training. You learn ISO/IEC 27001:2022 from an auditor’s view, then work through an audit from planning to the final report, with the certification exam on day 5.

Day 1

The ISMS and ISO/IEC 27001

  • Standards and regulatory frameworks
  • The certification process
  • Core information security and ISMS concepts
  • ISO/IEC 27001 requirements

Day 2

Audit Principles and Initiation

  • Fundamental audit concepts and principles
  • Evidence-based and risk-based auditing
  • Initiating the audit and Stage 1

Day 3

On-site Audit Activities

  • Preparing for and running Stage 2
  • Communication during the audit
  • Audit procedures and test plans

Day 4

Closing the Audit

  • Drafting findings and nonconformity reports
  • Audit documentation and quality review
  • Closing the audit and follow-up
  • Managing an internal audit programme

Day 5

Certification Exam

  • 80 multiple-choice questions, open book
  • Three hours, 70% to pass

450+

pages of PECB training material, with audit scenarios and practice questions similar to the exam.

05

Why Now

Third-party risk, global adoption, local readiness, and why train with us.

65%

of large companies cite third-party and supply chain vulnerabilities as their greatest cyber resilience challenge, up from 54%

WEF Global Cybersecurity Outlook 2026

125K

ISO/IEC 27001 certificates valid worldwide at the end of 2025, each one audited

ISO Survey 2025

3%

of Malaysian organisations reach a Mature level of cyber readiness

Cisco Cybersecurity Readiness Index 2025

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. Audits are how organisations show they meet duties like these, and ISO/IEC 27001 is the benchmark auditors test against.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

PECB Authorized Gold Partner

Delivering PECB’s official ISO/IEC 27001 Lead Auditor course

Exam included

Fee covers training, exam, certification and one free retake

HRD Corp registered

This course is HRD Corp claimable

KL or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Five-day courseIncluded

Exam, certification fee and one free retakeIncluded

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM7,500

Dates

Where

Fee

Mon 30 Nov to Fri 4 Dec 2026

Kuala Lumpur or online

RM7,500 incl. exam

Mon 18 to Fri 22 Jan 2027

Kuala Lumpur or online

RM7,500 incl. exam

Mon 15 to Fri 19 Mar 2027

Kuala Lumpur or online

RM7,500 incl. exam

Mon 5 to Fri 9 Apr 2027

Kuala Lumpur or online

RM7,500 incl. exam

Mon 31 May to Fri 4 Jun 2027

Kuala Lumpur or online

RM7,500 incl. exam

Credential levels: Auditor needs 2 years’ experience and 200 audit hours, Lead Auditor 5 years and 300 hours, Senior Lead Auditor 10 years and 1,000 hours. No experience? You start as Provisional Auditor.

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Credential

PECB Certified ISO/IEC 27001 Lead Auditor

Format

Multiple choice, open book, scenario-based

Questions

80

Duration

3 hours

Passing score

70%

When

Day 5 of the course, on paper or online

Retake

One free retake within 12 months

Exam fee

Included in the course fee

EVERY 3 YEARS

90 CPD hours

Lead Auditors log 90 hours of audit work, training or study over each three-year cycle. Auditor needs 60, Senior Lead Auditor 180.

MAINTENANCE FEE

US$390 per cycle

PECB charges US$390 for each three-year cycle. Provisional Auditor needs no maintenance.

FAQ

Questions People Ask

What is ISO/IEC 27001 Lead Auditor?

It is PECB’s credential for auditing an information security management system against ISO/IEC 27001:2022. It shows you can plan, conduct, close and manage ISMS audits using ISO 19011 and ISO/IEC 17021-1.

No. You need a basic understanding of ISO/IEC 27001 and audit principles. Pass with no experience and you hold PECB Provisional Auditor, then apply for Auditor, Lead Auditor or Senior Lead Auditor as you log experience and audit hours.

Five years of professional experience, two of them in information security management, and 300 hours of management system audit activity.

At Trainocate Malaysia the five-day course is RM7,500 per person, including the exam, certification fee and one free retake. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

Three hours, 80 multiple-choice questions, open book, with stand-alone and scenario-based questions. You need 70% to pass. You can bring a hard copy of ISO/IEC 27001, the course materials and your notes.

Lead Auditor teaches you to test and report on an ISMS. Lead Implementer teaches you to plan and build one. Pick the side of the audit you work on; many GRC professionals hold both.

PECB credentials are valid for three years. Lead Auditors log 90 CPD hours per cycle and pay the US$390 maintenance fee for each cycle.

Audit With Confidence

Pick an intake. An advisor confirms your seat, HRD Corp claims and Yayasan Peneraju eligibility with you.

  • Next intake: 30 Nov to 4 Dec 2026
  • RM7,500, exam and one free retake included

Sources

  1. PECB: ISO/IEC 27001 Lead Auditor
  2. PECB: ISO/IEC 27001 Lead Auditor candidate handbook (PDF)
  3. PECB: ISO/IEC 27001 Lead Auditor brochure (PDF)
  4. PECB: ISO/IEC 27001 training and certification
  5. PECB: Certification Maintenance Policy 2026 (PDF)
  6. PECB Support: Duration of PECB exams
  7. Verizon: 2026 DBIR news release (19 May 2026)
  8. World Economic Forum: Global Cybersecurity Outlook 2026
  9. DQS: ISO Survey 2025 results
  10. Trainocate: PECB-27001LA course page
  11. Cisco 2025 Cybersecurity Readiness Index, Malaysia findings (via Cybersecurity Asia)
  12. NACSA: Cyber Security Act 2024 (Act 854)
  13. MAICSA: Act 854 regulations summary