ISO 37301 Lead Auditor — course at a glance
- Course
- PECB Certified ISO 37301 Lead Auditor
- Standard
- ISO 37301:2021 — compliance management systems
- Methodology
- ISO 19011 and ISO/IEC 17021-1
- Duration
- 5-day equivalent, 35–45 hours self-paced
- Exam
- 3 hours, open book, 80 multiple-choice questions, 100 points, 70% to pass
- Materials
- 450+ pages
- CPD
- 31 credits
- Price
- $849 + GST
How is the ISO 37301 Lead Auditor exam structured?
Three hours, open book, 80 multiple-choice questions worth 100 points, 70% to pass.
Audit practice — concepts, preparing and conducting — is 46 of the 80 questions, the highest audit weighting of any PECB Lead Auditor exam in this catalogue. Figures are from PECB Candidate Handbook version 1.5.
How does a CMS audit actually run?
Stage 1 reviews the compliance obligations register, the scope, the compliance risk assessment, and whether internal audit and management review have run. The register is where a Stage 1 succeeds or fails: if obligations are listed without owners, controls or evidence, the system is a spreadsheet rather than a management system.
Stage 2 tests operation — sampling obligations end to end, from the source instrument through the control to the evidence, and testing whether non-compliance is actually detected, escalated and closed. Certification runs three years with annual surveillance.
Compliance obligations vs voluntary commitments
ISO 37301 splits everything an organisation must or chooses to follow into two categories, and getting the split right is most of the work.
- Compliance requirements — what you must comply with: legislation, regulations, permits, licences, court rulings, and binding contractual terms.
- Compliance commitments — what you choose to comply with: internal policies, codes of conduct, industry standards, agreements with communities or NGOs, and public undertakings.
Both go in the compliance obligations register, and both are auditable once adopted. The common failure is treating a voluntary commitment as decoration — once it is published and the CMS claims it, an auditor will test whether it is met. Our free ISO 37301 compliance obligations register shows the shape auditors expect.
Internal auditor or lead auditor — which do you need?
An internal auditor audits their own organisation’s CMS to satisfy Clause 9.2, independent of the work audited. A lead auditor plans and leads audits of other organisations, manages a team and owns the conclusions, under ISO 19011 and ISO/IEC 17021-1.
PECB issues no separate ISO 37301 internal auditor credential — managing an audit programme is part of this syllabus, so this course covers internal auditing; actual eligibility depends on experience and the engaging organisation’s requirements.
How does ISO 37301 relate to ISO 37001?
They are complementary and frequently confused. ISO 37301 is the general compliance management system — all obligations, whatever their source. ISO 37001 is a specific anti-bribery management system, deeper on one risk.
Organisations with both usually run ISO 37301 as the frame and ISO 37001 as a specialised programme inside it, sharing governance, training, internal audit and management review. Auditors comfortable with both are worth materially more to a certification body, because one person can cover both scopes. Both also share the high-level structure with ISO 27001 and ISO 9001, so a fourth or fifth standard is a smaller step than the first.
Who hires compliance auditors in Australia?
- Financial services — banks, insurers, superannuation funds and payments businesses under AUSTRAC and ASIC oversight, where compliance assurance is a standing function.
- Certification bodies needing CMS assessors — a small pool, since ISO 37301 is young.
- Regulated infrastructure, health and government suppliers, where compliance capability is scored in procurement.
- Internal audit functions and consultancies running compliance programmes for clients.
What is included for $849 + GST
Aegentra Academy is an official PECB authorised training partner. Courses are bought online and studied at your own pace from anywhere in Australia — Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra or regional — with the exam sat under remote proctoring. For group enrolments, email Academy@aegentra.com.au to request a written quote confirming the current price, payment terms and inclusions before purchase.