Plan and lead audits of an ISO 27001 ISMS with confidence. Choose flexible Self-Study, a live Online Class, or structured in-person Classroom training in Melbourne & Sydney — from $849 + GST, with official PECB auditor exam entry and a free resit included.
Available Australia-wide, in New Zealand and across Asia Pacific — and, because self-study and eLearning are delivered online through the myPECB platform, from anywhere in the world. Live online classes run in Australian time zones; in-person classroom delivery in Melbourne and Sydney is available on request. Base prices are published in AUD, and every course page supports available local currencies including NZD. An Australian billing address adds 10% GST; a non-Australian billing address has no Australian GST.
The PECB ISO 27001 Lead Auditor training course costs $849 + GST through Aegentra Academy, an official PECB authorised training partner in Australia. That price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free exam resit within 12 months. The eLearning format is $928 + GST.
Online classes are arranged through the Aegentra Academy team for individual learners and groups.
Contact us for online classLearn · Practise · Implement
Aegentra combines official PECB training with free exam-preparation resources, practical ISO 27001 implementation tools and optional full exam practice through Aegentra Labs.
Learn
Included with courseThis is what the $849 + GST Self-Study price covers, or $928 + GST with PECB eLearning.
Choose your coursePractise
Free + optional paidTry before you buy
Want more practice?
$89 + GST for Academy learners
Regular price: $99 + GST · Save $10
Aegentra Labs is independently authored supplementary exam preparation. It is not official PECB course content and does not guarantee an examination result.
Implement
Free · No email requiredGo beyond passing the exam. Practical resources built around the work itself — the documents you will actually have to produce.
Explore free ISO 27001 resourcesNothing extra. The official PECB examination voucher is included in the course price, so there is no separate exam fee to pay later. The ISO 27001 Lead Auditor course costs $849 + GST through Aegentra Academy as flexible Self-Study, or $928 + GST as guided eLearning delivered by PECB master trainers. Both include two exam attempts — the initial sit plus one free resit within 12 months — 12 months of myPECB access, and the full course materials.
| What you are paying for | Aegentra Academy |
|---|---|
| Course — Self-Study | $849 + GST |
| Course — eLearning (PECB master-trainer video) | $928 + GST |
| Course — live Online Class | Contact us for online class |
| Official PECB exam voucher | Included — no separate exam fee |
| Exam attempts | Two — initial sit plus one free resit within 12 months |
| myPECB platform access | 12 months |
| In-person Classroom (Melbourne & Sydney) | Available on request |
| Tax invoice with GST and ABN | Issued automatically at checkout |
This is official PECB ISO 27001 training, and the ISO 27001 exam cost is included rather than charged on top. The same applies across the Foundation and Lead Implementer tracks: one price, exam and two attempts included.
The optional $89 + GST Aegentra Labs add-on offered on this page is supplementary exam preparation, not a fee for the official PECB examination. The PECB exam voucher is already included in the course price.
Both are official PECB certifications against ISO/IEC 27001:2022, both cost $849 + GST, and both use the same three-hour open-book exam format. The difference is which side of the audit table you sit on.
| Lead Auditor | Lead Implementer | |
|---|---|---|
| What you do | Plan and lead first-, second- and third-party audits; sample evidence; classify and write nonconformities | Scope and build an ISMS from a blank sheet; run the risk assessment; write the Statement of Applicability |
| Reference standard | ISO/IEC 27001:2022 plus ISO 19011 auditing guidelines | ISO/IEC 27001:2022 and the 93 Annex A controls |
| Typical roles | Internal auditor, supplier assurance, IT audit consultant, certification-body assessor | ISMS manager, security manager, GRC lead, compliance consultant |
| Take it if | You will check that a management system works | You will get an organisation audit-ready |
Neither is a prerequisite for the other, and neither requires Foundation first. Many practitioners hold both — the implementer credential proves you can build it, the auditor credential proves you can verify it. See the ISO 27001 Lead Implementer course.
The PECB examination is three hours, open-book, with a 70% pass mark, and it covers seven competency domains — ISMS fundamentals, information security controls, audit principles and concepts, preparing an ISO 27001 audit, conducting the audit, closing the audit, and managing an audit programme.
PECB’s standard instructor-led Lead Auditor course agenda is structured over five days, with the certification exam on Day 5. Contact Aegentra Academy to arrange a live Online Class.
Open-book does not mean easy. The questions are scenario-based: you are given an audit situation and asked what a competent lead auditor would do next, so the material only helps if you already know where to find things in it. The most common failure is treating it as a lookup exercise rather than a judgement one.
There are two exam formats, and providers routinely quote only one of them. PECB publishes a separate candidate handbook for each. The essay-type exam is 12 questions worth 75 points. The multiple-choice exam is 80 questions, mixing stand-alone and scenario-based items. Both are open book, both run three hours, and both pass at 70%. PECB is progressively transitioning this examination from essay to multiple-choice, which is why both handbooks are current — so ask which format your sitting uses rather than assuming the figure you read elsewhere. The domain weightings and sample questions for both are published in the PECB ISO/IEC 27001 Lead Auditor candidate handbook.
Every enrolment includes two attempts — the initial sit plus one free resit within 12 months — so a first-attempt failure costs you time, not money. Passing without prior audit experience awards Provisional Auditor; the full Lead Auditor credential follows once you attest to the professional experience and audit hours PECB requires.
Every authorised PECB course teaches the same syllabus. What differs is whether you leave able to produce the documents a certification body will accept. These are the real working papers from the course, published in full and free to use — no email required. All four describe the same worked organisation, so you can trace one audit end to end.
Building the ISMS rather than auditing it? The Statement of Applicability, risk register and CPS 234 mapping are published the same way.
The official PECB course and exam package starts at $849 + GST — with no separate exam fee after enrolment. Optional Aegentra Labs exam preparation is clearly priced separately.
The exam voucher is included in your enrolment, and so is one free resit if you don't pass first time. Both the exam and the credential are issued directly by PECB.
PECB credential hierarchy: Provisional → Implementer/Auditor → Lead Implementer/Lead Auditor → Senior Lead, based on professional experience and project hours. Maintained through continuing professional development (CPD) credits.
Official training + independent exam preparation
Aegentra Academy provides the official PECB course, learning materials and examination pathway. Aegentra Labs is the separate practice workspace for a sourced exam guide, original PECB-style questions, timed exam mode, answer review and domain-level results for this exact qualification.
Labs practice is supplementary, independently authored and not official PECB course content or an examination guarantee.
/ Before you enrol
These answers use this course's current catalogue record and PECB's published exam, certification, and maintenance policies.
The published price is A$849 for Self-Study or A$928 for eLearning, before tax. It includes the official PECB course materials, 12 months of access, the first exam attempt, one free retake, and the certification application fee. PECB’s partner-course policy also includes the first year of the Annual Maintenance Fee where maintenance applies; Foundation and Provisional credentials are maintenance-exempt. There is no separate first-exam or certification-application charge after enrolment.
PECB’s current maintenance policy lists no maintenance fee for Foundation, Provisional, or Transition credentials. For all other PECB certifications, the published fee is $390 per three-year certification cycle, together with the applicable CPD requirements and continued adherence to the PECB Code of Ethics. PECB sets this fee and may change it, so check the linked policy before renewal.
Yes. Every Academy course supports AUD and multiple local currencies, including NZD, USD, SGD, GBP, EUR, INR, AED, MYR, PHP, IDR, and VND when a live quote is available. Currency and tax are separate: an Australian billing address adds 10% GST, while a non-Australian billing address has no Australian GST. For example, an Australian working in New Zealand may pay in NZD and use an Australian billing address, but 10% GST will still be added because the billing address is Australian.
Self-Study costs A$849 before tax and uses the official PECB slide-based materials. eLearning costs A$928 before tax — A$79 more — and adds recorded trainer-led lessons and interactive learning activities. Both routes lead to the same PECB exam and credential, and both include the same exam package. Choose eLearning if explanations and video guidance help you learn; choose Self-Study if you are comfortable working through standards-based material independently and want the lowest price.
Yes. PECB publishes remote online exam sessions that candidates can take from home or another suitable location through the PECB Exams application. The published course record lists these exam facts: duration — 3 hours; format — Open-book, mixed multiple-choice and scenario-based questions; assessment — Two formats are current while PECB transitions: essay-type (12 questions, 75 points) or multiple-choice (80 questions). Both cover 7 competency domains; pass mark — 70%; language — English (other PECB languages available on request). New Zealand candidates should choose a published session that suits their local time, meet PECB’s identity and technical requirements, and complete the system check before exam day. PECB’s general exam policy does not publish a New Zealand restriction.
PECB credential hierarchy: Provisional → Implementer/Auditor → Lead Implementer/Lead Auditor → Senior Lead, based on professional experience and project hours. Maintained through continuing professional development (CPD) credits. Passing the exam does not by itself guarantee the highest experience-based credential tier. PECB requires an online certification application and reference contact details, and its Certification Department decides whether the education, professional experience, and audit or assessment activity requirements are met.
PECB’s public certification-process page does not publish a closed list of documents that automatically proves project hours. It requires the online application and contact details for references who may be contacted to validate your experience. Keep a dated activity log showing the organisation or client, your role, the audit or assessment activity, dates, responsibilities, and hours; retain employer or client confirmations, statements of work, timesheets, or similar records in case PECB asks for support. The PECB Certification Department assesses the application and makes the final decision.
Yes. You can hold both the ISO 27001 Lead Implementer and ISO 27001 Lead Auditor credentials. They are separate, complementary certifications: Lead Implementer demonstrates that you can build and operate the management system, while Lead Auditor demonstrates that you can audit and verify it. To earn both, complete each course, pass each exam, and apply for each credential. PECB assesses implementation-project experience for the Implementer tier and audit experience for the Auditor tier separately. If you pass an exam before meeting its full experience requirements, you can receive the applicable Provisional credential and upgrade later when those requirements are met; you do not need to retake that exam. Neither credential automatically grants the other.
6 modules, fully on-demand. Click any module to see the topics inside.
Named trainers are shown only where their role and public credentials can be verified. Delivery mode varies by course and selected cohort.
Cybersecurity Professional & Penetration Tester
A highly experienced cybersecurity professional and penetration tester with deep expertise across regulated environments — CMMC, HIPAA, PCI, FFIEC, CCPA, and GDPR. A certified auditor and instructor holding ISO/IEC 27001 Senior Lead Auditor, CISA, CISM, and PCI-QSA, and a Cisco, Microsoft, CompTIA, and PECB-certified specialist.
Cybersecurity & Information Security Expert
A Security, Technology, Risk, and Compliance professional with vast experience across private and public sector roles spanning financial services, government, manufacturing, healthcare, and retail. A certified PECB trainer delivering ISO/IEC 27001, ISO 22301, ISO/IEC 42001, CISSP, CISM, and CISA courses globally across the UK, USA, Canada, and Europe.
Security Governance Expert & Management Consultant
A Security Governance expert and management consultant with over a decade of international experience leading complex security projects. She delivers CISO-as-a-service, senior compliance and risk management, and DPO services, and coaches organisations through growth and restructuring to build resilient, future-ready teams.
PECB credentials stack — Foundation establishes the language, Lead Implementer builds the system, Lead Auditor verifies it. Pick the level that matches the work you will actually be doing.
Core ISO 27001 concepts, ISMS principles, and the Annex A control families.
8–12 hours · self-paced
Plan, deploy, and operate a full ISMS end to end.
30–40 hours · self-paced
Plan and conduct ISO 27001 audits — internal, supplier, and certification.
30–40 hours · self-paced
Lead Auditor is the certification a hiring manager looks for when the work is to plan, conduct, and report on an ISO 27001 audit — internal, supplier, or third-party. It is the difference between a generalist who has implemented a control and a specialist who can walk into any organisation, gather objective evidence against ISO 19011 principles, classify nonconformities, and defend findings to an executive review. It is the credential that unlocks certification-body lead-auditor roles and internal-audit head-of-function roles.
Internal Audit Manager, Information Security Auditor, Lead Auditor (certification body), Compliance and Risk Auditor, Third-Party Risk Manager, Supplier Assurance Manager — every one of these roles in the Australian market either requires Lead Auditor or treats it as a strong substitute for years of equivalent experience. JAS-ANZ accredited certification bodies require Lead Auditor credentials for their assessment teams. Tier-1 consultancies use it as the baseline for internal-audit and security-assurance hires.
Many practitioners progress from Lead Implementer to Lead Auditor — the implementation lens makes you a sharper auditor because you can see when a control is "evidenced" only on paper. Conversely, an auditor moving back into implementation roles brings a high-confidence eye for what survives a stage-2 assessment. The two credentials together are the gold standard for security-assurance leadership.
In Australia, only individuals appropriately credentialled and registered with a certification body programme can lead a third-party audit under JAS-ANZ accreditation rules. Lead Auditor is the PECB credential that satisfies the personnel-competency requirement of ISO/IEC 17021-1 — the standard that governs certification bodies themselves. Without it, you can support a third-party audit but you cannot lead one.
JAS-ANZ accredited certification bodies in Australia staff their ISO 27001 assessment teams almost exclusively with PECB Lead Auditor (or equivalent IRCA) credentialled assessors. The credential is the entry door to certification-body lead-assessor roles, surveillance-audit teams, and recertification-cycle audit work. Day rates for credentialled lead auditors in Australia typically range from $1,800 to $3,000 AUD.
APRA-regulated entities (banks, mutuals, super funds, insurers) maintain second and third line of defence functions that must conduct independent reviews of the information-security management system under CPS 234 and CPS 220. Lead Auditor is the dominant credential for the staff conducting those reviews. The Big-four consultancies and the mid-tier advisory firms also use the credential as a baseline for internal-audit-as-a-service engagements.
Large Australian enterprises and government departments operate supplier-risk programmes that include on-site or virtual audits of critical suppliers. Lead Auditor is the credential the supplier-assurance team holds when conducting those audits — particularly for suppliers handling PROTECTED data or otherwise inheriting compliance obligations under DISP, the Privacy Act, or APRA CPS 234.
Commonwealth and state government cybersecurity functions, defence-industry suppliers operating under DISP, and critical-infrastructure operators captured by the SOCI Act all run internal audit programmes against information-security management systems modelled on ISO 27001. The Lead Auditor credential is the standard credential for the practitioners conducting those audits.
The exam is open-book, but the questions reward fluency, not lookup. Plan your study around these checkpoints.
Step-by-step certification process, realistic AUD costs, audit timelines, and how this course fits into a wider readiness program — senior-engineer written, updated for 2026.
ReadCareer guideThe auditor career path — the PECB credential tiers, the exact audit hours each one needs, the exam, and the assurance roles it opens in Australia.
ReadFree learning resources
Use Aegentra’s existing templates, checklists, registers and mappings alongside your course. No account or email is required.
Case study
Internal
audit
ISO 27001
Transitioning to ISO/IEC 27001: overcoming internal audit bottlenecks
Prepared by
Aegentra Information Security & Compliance Team
Aegentra does not only teach ISO 27001 — we implement and audit it. The engagement record below is a real Clause 9.2 internal audit for an Australian technology company: all of Clauses 4 to 10 and a risk-based sample of 47 Annex A controls, across 73 lines of enquiry. Scope, method, every finding and how each was closed out are published in full.
Free companion reading for anyone studying or implementing ISO/IEC 27001:2022:
Compare the family
The ISO 27001 family page compares current levels, prices, delivery, audiences and exam facts before you choose a pathway.
Compare ISO 27001 pathwaysSource and review status
Price, delivery and course content are generated from Aegentra’s authoritative catalogue record. The official PECB course page and exam policy are linked directly below. Source-link checks and substantive human review are tracked separately so one is never presented as the other.
Official PECB sources
Editorial accountability
Harry Sidhu owns publication of this record. A separate course-specific substantive reviewer has not yet been recorded.
Substantive review status
Official source links are checked separately. A course-specific substantive review date will be published when completed.
Yes. PECB certifications are internationally accredited and are accepted on Australian resumes, tender responses and procurement panels. Australia has no separate national licence for ISO 27001 Lead Auditor — the recognition comes from the accreditation behind the credential, which is international.
PECB’s professional certifications are accredited under ISO/IEC 17024 — the international standard for bodies certifying persons — by IAS, UKAS, KAB and COFRAC. Its Foundation certificate programs are separately accredited by ANAB (ANSI National Accreditation Board) under ANSI/ASTM E2659.
Aegentra Academy is an official PECB authorised training partner in Australia, which is what allows this course to include the official PECB examination voucher rather than billing it separately. You can confirm that directly with PECB through the official PECB partner directory.
This official PECB course is sold and supported by Aegentra Academy. PECB supplies the course material, examination and professional credential scheme. Aegentra's wider practice also runs ISO 27001 readiness and GRC engagements and Microsoft 365 hardening for Australian organisations. Named eLearning trainers are credited separately on this page when the course record supplies them.
Courses run online and self-paced through the myPECB platform, so professionals across Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra and New Zealand enrol online. Instructor-led cohorts and in-person delivery in Melbourne and Sydney are available on request. Multi-seat team pricing is available for five or more seats — email Academy@aegentra.com.au for an enterprise quote. Tax invoices with GST and ABN are issued automatically at checkout.
It is the most demanding of the three, but open-book. The PECB ISO 27001 Lead Auditor exam is three hours, open-book, with mixed multiple-choice and scenario-based questions across seven competency domains and a 70% pass mark. It tests whether you can apply ISO 19011 audit principles to a described situation, so practice with audit scenarios matters more than memorisation. One free resit is included within 12 months.
The PECB ISO 27001 Lead Auditor course costs $849 + GST through Aegentra Academy, including the official PECB exam voucher, course materials, 12 months of myPECB access, and one free resit within 12 months. Comparable instructor-led lead auditor courses in Australia generally cost $2,500 to $3,900 + GST.
It is the entry credential for internal audit and assurance roles — Internal Auditor (ISMS), Third-Party Risk / Supplier Assurance Analyst, IT Audit Consultant, and certification-body assessor positions with JAS-ANZ accredited bodies. It is also what lets an existing GRC practitioner own the internal audit programme required by ISO 27001 clause 9.2. The credential level awarded (Provisional Auditor through Senior Lead Auditor) depends on the audit experience you attest to. For the full pathway — prerequisites, exam, experience attestation, and how to log audit hours — read aegentra.com.au/insights/how-to-become-iso-27001-lead-auditor
Six modules covering the foundations of auditing under ISO 19011, audit planning and resource allocation, the on-site audit programme (opening meeting, evidence gathering, document review), nonconformity classification and finding-writing, the stage 1 / stage 2 / surveillance / recertification audit cycle, and certification-body practice. Total effort is 30-40 hours of self-paced study.
No. Lead Auditor is a self-contained credential. That said, many practitioners take Lead Implementer first because the build-side knowledge makes them sharper auditors — you can see when a control is evidenced only on paper. The opposite progression (Auditor → Implementer) is also common for ex-certification-body staff moving into implementation roles.
Three hours, open-book, mixed multiple-choice and scenario-based questions across seven competency domains. Pass mark is 70%. The credential awarded depends on attested professional audit experience — Provisional Auditor (no experience), Auditor (2 years), Lead Auditor (5 years with 300 hours leading audits), or Senior Lead Auditor (10 years).
Every authorised PECB Lead Auditor course leads to the same credential — the certificate is identical wherever you buy it. The differences are price, format, and who supports you. Aegentra delivers Lead Auditor at $849 + GST (self-study) or $928 + GST (eLearning) with the exam voucher and one free resit included. The Australian-context references are informed by current management-system assurance and readiness practice.
Yes — Lead Auditor is the personnel-competency credential certification bodies look for. Certification bodies will still run their own onboarding programme (witness audits, internal calibration, code of conduct), but PECB Lead Auditor (or the equivalent IRCA credential) satisfies the certification-body-personnel competency requirement of ISO/IEC 17021-1.
Lead Implementer is the build-side credential — designing and operating an ISMS from a blank sheet of paper. Lead Auditor is the verification-side credential — planning, conducting, and reporting on audits against ISO 27001. The two are deliberately separate skill sets governed by different competency frameworks. Many practitioners hold both; few do them in the same year.
Yes. The course explicitly covers all three audit types — first-party (internal audits inside your own organisation), second-party (supplier and contractor audits), and third-party (certification-body audits leading to issuance of an ISO 27001 certificate). The credential qualifies you for all three contexts, subject to attested professional experience.
Yes. JAS-ANZ accreditation requires certification bodies to staff audit teams with appropriately competent auditors per ISO/IEC 17021-1. PECB Lead Auditor is one of the two globally recognised credentials that meet this competency requirement (IRCA is the other). Holding Lead Auditor is the standard entry credential for an Australian certification-body assessment team.
Typical effort is 30-40 hours of self-paced study spread over four to six weeks. You have 12 months of myPECB access so the pace is yours. Most working professionals complete it in 6-8 weeks of evenings; a focused full-time week is also feasible.
PECB awards 31 CPD credits on completion of the ISO 27001 Lead Auditor course. These count toward CPD requirements at ISACA, (ISC)², IIA, AISA, and other professional bodies on submission, and toward maintenance of other PECB credentials.
Yes. Lead Auditor qualifies you to plan and conduct internal audits inside your own organisation, regardless of attested external experience. The internal audit programme is one of the most common starting points for Lead-Auditor-credentialled practitioners.
Yes. Either complete checkout yourself and forward the Stripe tax invoice for reimbursement, or write to Academy@aegentra.com.au and we will issue an invoice direct to your organisation with payment terms. Groups of five or more receive a discount.
Immediately after payment. The Academy team confirms your seat with PECB and you receive login details by email — usually within one business day.
You have 12 months of access from enrolment. That window covers the course material, the official PECB exam, and one free resit if you need it.
One PECB-issued resit is included in your enrolment at no extra cost. Aegentra does not publish a pass-rate claim without an audited cohort dataset.
Questions about invoicing, GST, group bookings, refunds or instructor-led delivery? Read the Academy FAQ.