By the Aegentra Security Team — NV1-cleared ISO 27001 practitioners · Published 1 August 2026
Somebody has to check whether an organisation’s AI governance is real. That is a job now, and almost nobody has done it for long. This guide covers the individual PECB credential behind it — the tiers, the audit hours each one needs, the exam, and what the work actually involves.
To become a PECB Certified ISO 42001 Lead Auditor you complete the official ISO/IEC 42001 Lead Auditor training, pass the PECB exam, then hold five years of professional experience (two in AI) and 300 hours of AIMS audit activity. Lower tiers need less — the Provisional Auditor credential needs only the exam. Aegentra Academy runs the official course online and in Melbourne, Sydney and across Australia for $849 + GST, with the exam voucher and a free 12-month resit included.
Buy the PECB ISO 42001 Lead Auditor course and exam — $849 + GST, including the official exam voucher and two attempts. If instead you need someone to run an AI management system audit for you rather than train to run one yourself, see our independent ISO 42001 internal audit service.
ISO/IEC 42001:2023 is the management-system standard for artificial intelligence — the AI equivalent of what ISO 27001 is for information security. A Lead Auditor checks whether that system actually works: planning the audit, sampling evidence about models, data and human oversight, testing whether impact assessments were done and acted on, classifying nonconformities, and writing an opinion someone else will rely on. The Lead Implementer builds the system; these are separate credentials and separate career tracks. It is an assurance role, not a machine-learning role — you do not need to build a model, you need to know what evidence should exist that it behaves as claimed.
“Lead Auditor” is the third rung of a four-tier ladder, and all four tiers sit the same exam. What separates them is attested professional experience and hours of AIMS audit or assessment activity.
| Credential tier | Total experience | In AI | AIMS audit hours |
|---|---|---|---|
| Provisional Auditor | None | — | 0 |
| Auditor | 2 years | 1 year | 200 |
| Lead Auditor | 5 years | 2 years | 300 |
| Senior Lead Auditor | 10 years | 7 years | 1,000 |
These are PECB scheme requirements, not requirements of the standard itself, and every tier requires signing the PECB Code of Ethics.
Three hours, open book, 70% to pass, across seven competency domains: AIMS fundamentals, AI management system requirements, fundamental audit concepts and principles, preparing an ISO/IEC 42001 audit, conducting it, closing it, and managing an audit programme. It is scenario-based — you are given an audit situation and asked what a competent lead auditor would do next. Passing without prior audit experience awards Provisional Auditor; the full credential follows once you attest to the experience and hours.
ISO/IEC 42001 was published in 2023. Almost nobody has years of AIMS audit hours yet, because the hours have not existed long enough to accumulate. That is unusual and it will not last: the practitioners who log audit hours over the next two years will be the ones certification bodies and consultancies compete for, in the same way early ISO 27001 auditors were. Log every engagement as it happens — audit work is episodic, and reconstructing it later from calendar entries is miserable.
The audit method is ISO 19011 either way and clauses 4 to 10 follow the same Annex SL skeleton, so an experienced ISO 27001 lead auditor converts quickly. What changes is the evidence. You are sampling model test results against stated acceptance criteria, training-data provenance that often sits with a vendor you cannot inspect, and whether human oversight is real or nominal. Clause 8.4, the AI system impact assessment, has no ISO 27001 equivalent and is where most audit time goes. The common nonconformity is not a missing document — it is an impact assessment that is really a risk assessment, examining harm to the organisation and never addressing harm to individuals, groups or society.
The second is oversight that exists on paper. A control stating “a human reviews every decision” is not evidence; the evidence is whether the reviewer has the time, information and authority to overturn one, and whether any were overturned. See also how to become a certified ISO 27001 Lead Auditor, and the ISO 42001 Lead Implementer course if building rather than auditing is where you are headed.
Five steps, and only one of them is the course.
Demand here is procurement-driven rather than legislated. The Australian Government published the Voluntary AI Safety Standard with its ten guardrails and has consulted on mandatory guardrails for high-risk AI, but nothing compels certification today. What does compel it is the enterprise security questionnaire that now asks how AI is governed, government supplier terms inheriting AI obligations by contract, and the EU AI Act for anyone selling into Europe.
That produces an unusual market. The organisations needing AIMS audits are appearing faster than the people qualified to perform them, because ISO/IEC 42001 was only published in December 2023 and the audit hours have not existed long enough for anyone to accumulate them. Certification bodies face the same shortage — they cannot assess against a standard without assessors. We publish the ten guardrails mapped to ISO 42001 clauses free, which is the fastest way to see what an Australian AIMS audit actually covers.
The credential supports assurance roles rather than engineering ones. Indicative Australian ranges, drawn from public technology, risk and cyber salary guides — a market guide, not a quote:
| Role | Indicative range (AUD) |
|---|---|
| Internal Auditor (AI systems) | $125,000 – $165,000 |
| Third-party / AI supplier assurance | $135,000 – $175,000 |
| AI Assurance Consultant | $140,000 – $185,000 |
| Certification body AIMS assessor | $150,000 – $195,000 |
| Head of AI Assurance | $190,000 – $255,000 |
Most of these are existing audit, GRC or privacy roles with AI scope added rather than new headcount, which is why the credential converts well for people already in assurance. The full role-by-role picture for the build side is in how to become an ISO 42001 Lead Implementer.
It is worth it if you want to assess AI governance rather than build it. ISO 42001 is currently the only certifiable international management-system standard for artificial intelligence, and because it was published in 2023 almost nobody has years of AIMS audit experience yet. That scarcity is the opportunity — the practitioners who log audit hours over the next two years will be the ones certification bodies and consultancies compete for.
No. There is no prerequisite credential. ISO 42001 uses the same Annex SL structure as ISO 27001 and is audited under the same ISO 19011 method, so an existing lead auditor converts faster than someone new to auditing entirely. If you hold neither and expect to audit both, most people take ISO 27001 Lead Auditor first because the evidence is more mature and easier to learn on.
Around 30 to 40 hours of self-paced study, which most people spread across a few weeks alongside their job. The exam is three hours, open book, with a 70% pass mark across seven competency domains. Instructor-led delivery is available on request.
Aegentra Academy runs the official PECB ISO 42001 Lead Auditor course for $849 + GST as self-study and $928 + GST as eLearning. Both include the official PECB exam voucher and one free resit within 12 months, so there is no separate exam fee. A GST tax invoice with our ABN is issued at checkout.
Take Lead Auditor if you will assess someone else’s AI management system. Take Lead Implementer if you will build one. Both cost $849 + GST, both are three-hour open-book exams at 70%, and neither is a prerequisite for the other. A good number of practitioners eventually hold both.
Not credibly. Clause 9.2 requires internal auditors to be objective and impartial, and certification bodies routinely challenge internal audits performed by the people who designed the controls. Keep engagements where you were independent clearly separated in your hours log.
No. You do not need to build a model. You need enough understanding of how AI systems are developed and behave — training data provenance, evaluation, drift, human oversight — to know what evidence should exist and to recognise when it does not.
Ready to start? Aegentra Academy is an official PECB authorised training partner and runs the ISO 42001 Lead Auditor course for $849 + GST, exam voucher and free 12-month resit included, with instructor-led delivery available on request. More field notes are on the Aegentra Insights hub.