Download the certification brochure (Spanish): Click here

Exam Details

• Exam Name: ISO/IEC 27001:2022 Lead Auditor Certified Expert (27001-LAE)
• Exam Format: Multiple choice, online with remote supervision (proctoring)
• Exam Delivery: Safe Exam Browser
• Number of Questions: 65 questions: 70% scenarios / 30% conceptual
• Exam Duration: 120 minutes
• Passing Score: 75% (49 out of 65 correct answers)
• Available Languages: Spanish / English
• Attempts: Maximum 2 attempts (minimum 15 days between attempts)
• Validity: 3 years · 15 CPD credits per year

Main Subjects

• Audit and information security management fundamentals (10%): ISO 19011 applied to leading audit teams; First-, second- and third-party audits; Major NC, minor NC, observation and audit opinion; Clauses 4 to 10 and Annex A:2022; Amendment 1:2024 as a cross-cutting audit theme; ISO/IEC 17021-1 requirements for certification bodies.
• Audit program management and team leadership (15%): Audit program aligned with risks and strategy; Team roles, competence and independence; Selecting, evaluating and mentoring auditors; Audit duration and stage 1 review, including climate determination; Multi-site and integrated plans; Situational leadership and conflict management.
• Leading the audit: clauses 4 to 10 (25%): Context and climate determination (4.1 and 4.2, Amd 1:2024); Leadership, accountability and planning; Support and operation, including supplier management; Performance evaluation and improvement; Root cause analysis; Statistical sampling, traceability, remote auditing and confrontation interviews.
• Advanced evaluation of the Annex A:2022 controls (20%): The four control domains with critical judgment; Auditing the SoA and exclusion justifications; Dependencies between domains and coverage gaps; Integrated effectiveness and controls 7.5, 8.13 and 8.14 against climate threats.
• Communication, executive reporting and follow-up (15%): Opening and closing meetings with top management; Validating and classifying findings; Executive reports and audit opinions; Recommending certification, non-certification or suspension; Managing disputes and following up corrective actions.
• Integrated auditing, regulatory context and program improvement (15%): Integrated audits with ISO 9001, ISO 22301, ISO/IEC 27701, 27017 and 27018; Climate action common to integrated systems; GDPR, NIS2, PCI DSS and regulated sectors; NIST CSF, COBIT, ITIL, CIS Controls and ENS; ISMS maturity and audit program improvement; Data-driven auditing, CAAT and AI.

Who is this certification for?

• Information security internal auditors: Who want to lead audits and take on more responsibility in the audit program.
• Certification body auditors: Who need to demonstrate competence as ISO/IEC 27001 lead auditors.
• Consultants and second-party auditors: Who assess critical suppliers or customers from an information security perspective.
• 27001-IC and 27001-IAE certified professionals: Who take the final step of the ISO/IEC 27001 path toward leading audits.

Prerequisites

Mandatory: ISO/IEC 27001:2022 Implementer Certified (27001-IC) and ISO/IEC 27001:2022 Internal Auditor Certified (27001-IAE). 27001-LAE is the highest level of the CertJoin ISO/IEC 27001 path.