ISO 27001 LA study guide · 2026

The 7 ISO 27001 LA domains, explained

7 domains and 74 official knowledge statements. Conducting an ISO/IEC 27001 Audit carries the most weight at 22.5%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 5 See all domains
Questions
80 multiple-choice questions (three options each; standalone and scenario-based)
Time
3 hours, open book
Passing score
70%
Outline
PECB ISO/IEC 27001 Lead Auditor Candidate Handbook (multiple-choice exam, 2025-2026 editions; ISO/IEC 27001:2022) (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 16.25%
  2. 2 10%
  3. 3 17.5%
  4. 4 15%
  5. 5 22.5%
  6. 6 8.75%
  7. 7 10%
  1. 1 Fundamental Principles and Concepts of an Information Security Management System (ISMS)
  2. 2 Information Security Management System (ISMS) and ISO/IEC 27001 Requirements
  3. 3 Fundamental Audit Concepts and Principles
  4. 4 Preparation of an ISO/IEC 27001 Audit
  5. 5 Conducting an ISO/IEC 27001 Audit
  6. 6 Closing an ISO/IEC 27001 Audit
  7. 7 Managing an ISO/IEC 27001 Audit Program

All 7 domains

74 official knowledge statements 58–78 hrs suggested study

  1. Domain 01 16.25%

    Fundamental Principles and Concepts of an Information Security Management System (ISMS)

    The information security vocabulary an ISMS auditor needs before judging any control: where requirements come from, how risk is built, and how preventive, detective and corrective controls differ.

    Inside this domain

    • Laws, regulations, international and industry standards, contracts, market practices and internal policies an organization must comply with
    • Main standards related to information security
    • Main concepts and terminology of ISO/IEC 27001
    • The concept of risk and its application in information security
    • and 4 more knowledge statements

    Watch for Guidance as criteria

    Knowledge statements
    8
    Questions est.
    ~13
    Study time est.
    8–10 hrs
  2. Domain 02 10%

    Information Security Management System (ISMS) and ISO/IEC 27001 Requirements

    The ISO/IEC 27001:2022 requirements you audit against: context, leadership, planning, support, operation, performance evaluation and improvement, plus the 93 Annex A controls and the Statement of Applicability.

    Inside this domain

    • ISO/IEC 27001:2022 and its complementary standards
    • Concepts, principles and terminology related to management systems
    • Main characteristics of an integrated management system
    • Requirements of ISO/IEC 27001 in clauses 4 to 10
    • and 9 more knowledge statements

    Watch for All Annex A controls required

    Knowledge statements
    13
    Questions est.
    ~8
    Study time est.
    10–14 hrs
  3. Domain 03 17.5%

    Fundamental Audit Concepts and Principles

    The audit principles and evidence rules behind every ISMS audit decision: ISO 19011 terminology, first-, second- and third-party audits, the seven principles, PECB ethics, evidence types, applicable law, big data and outsourced operations.

    Inside this domain

    • Main audit concepts and terminology described in ISO 19011
    • Differences between first-, second- and third-party audits
    • Audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach
    • Auditor's professional responsibility and the PECB Code of Ethics
    • and 5 more knowledge statements

    Watch for Helpful auditor

    Knowledge statements
    9
    Questions est.
    ~14
    Study time est.
    8–12 hrs
  4. Domain 04 15%

    Preparation of an ISO/IEC 27001 Audit

    Everything an ISMS lead auditor settles before the opening meeting: the audit plan, audit risk, materiality, reasonable assurance, team roles, objectives, scope and criteria, feasibility, culture and first contact with the auditee.

    Inside this domain

    • Procedure for preparing an audit plan
    • Risk-based approach and audit risk types: inherent, control and detection risk
    • The concept of materiality and its application in an audit
    • The concept of reasonable assurance and its application in an audit
    • and 6 more knowledge statements

    Watch for Checklist first

    Knowledge statements
    10
    Questions est.
    ~12
    Study time est.
    8–10 hrs
  5. Domain 05 22.5%

    Conducting an ISO/IEC 27001 Audit

    The largest PECB domain: running the opening meeting, Stage 1 and Stage 2, communicating under pressure, collecting and analyzing evidence through interviews, observation, sampling and technical checks, and turning evidence into audit findings.

    Inside this domain

    • Objectives and content of the opening meeting
    • Difference between Stage 1 and Stage 2 audits
    • Requirements, steps and activities of a Stage 1 audit
    • Criteria for evaluating documented information and the requirements of ISO/IEC 27001
    • and 13 more knowledge statements

    Watch for Accept offered samples

    Knowledge statements
    17
    Questions est.
    ~18
    Study time est.
    12–16 hrs
  6. Domain 06 8.75%

    Closing an ISO/IEC 27001 Audit

    How an ISMS audit ends: evaluating findings into conclusions, presenting them to top management, running the closing meeting, recommending certification and judging the auditee's corrective action plans.

    Inside this domain

    • Evidence evaluation process for preparing audit conclusions
    • Presentation of audit conclusions
    • Guidelines and best practices for presenting audit conclusions to top management of the auditee
    • Possible recommendations an auditor may issue during a certification audit
    • and 2 more knowledge statements

    Watch for Lead auditor certifies

    Knowledge statements
    6
    Questions est.
    ~7
    Study time est.
    6–8 hrs
  7. Domain 07 10%

    Managing an ISO/IEC 27001 Audit Program

    Managing ISMS audits over time: surveillance and recertification, changes to certification status, running an audit programme with PDCA, resources, tools and records, combined audits, and the competence and behavior expected of professional auditors.

    Inside this domain

    • Requirements, steps and activities of follow-up, surveillance and recertification audits
    • Conditions for modifying, extending, suspending or withdrawing an organization's certification
    • Application of the PDCA cycle to managing an audit programme
    • Requirements, guidelines and best practices regarding audit resources, procedures and policies
    • and 7 more knowledge statements

    Watch for Immediate withdrawal

    Knowledge statements
    11
    Questions est.
    ~8
    Study time est.
    6–8 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 58–78 hrs of study.

  1. 5 Conducting an ISO/IEC 27001 Audit 22.5% · 12–16 hrs
  2. 3 Fundamental Audit Concepts and Principles 17.5% · 8–12 hrs
  3. 1 Fundamental Principles and Concepts of an Information Security Management System (ISMS) 16.25% · 8–10 hrs
  4. 4 Preparation of an ISO/IEC 27001 Audit 15% · 8–10 hrs
  5. 2 Information Security Management System (ISMS) and ISO/IEC 27001 Requirements 10% · 10–14 hrs
  6. 7 Managing an ISO/IEC 27001 Audit Program 10% · 6–8 hrs
  7. 6 Closing an ISO/IEC 27001 Audit 8.75% · 6–8 hrs

Try one

Practice questionDomain 5: Conducting an ISO/IEC 27001 Audit

During Stage 2, an auditor asks a developer how code reviews are performed. The development manager, acting as guide, repeatedly answers instead of the developer. What should the auditor do?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Guidance as criteria

    Clue Words like should or guidance in the cited source.

  • Domain 2

    All Annex A controls required

    Clue The SoA gives a reason consistent with the risk assessment.

  • Domain 3

    Helpful auditor

    Clue The option includes designing, writing or implementing for the auditee.

  • Domain 4

    Checklist first

    Clue The question asks for the first step in a new engagement.

  • Domain 5

    Accept offered samples

    Clue Records were prepared or chosen by the auditee.

  • Domain 6

    Lead auditor certifies

    Clue Options mention granting or issuing the certificate.

  • Domain 7

    Immediate withdrawal

    Clue First occurrence with no prior suspension.

Other Cybersecurity certifications

Study guides for exams that overlap with ISO 27001 LA.

Practise what you read

ISO 27001 LA domains: common questions

How many domains are in the ISO 27001 LA exam?

ISO 27001 LA has 7 domains with 74 official knowledge statements between them: Fundamental Principles and Concepts of an Information Security Management System (ISMS), Information Security Management System (ISMS) and ISO/IEC 27001 Requirements, Fundamental Audit Concepts and Principles, Preparation of an ISO/IEC 27001 Audit, Conducting an ISO/IEC 27001 Audit, Closing an ISO/IEC 27001 Audit and Managing an ISO/IEC 27001 Audit Program.

Which ISO 27001 LA domain carries the most weight?

Conducting an ISO/IEC 27001 Audit is the heaviest at 22.5%, followed by Fundamental Audit Concepts and Principles (17.5%). The lightest is Closing an ISO/IEC 27001 Audit (8.75%). Weights come from PECB's official outline.

What is the ISO 27001 LA exam format?

Questions: 80 multiple-choice questions (three options each; standalone and scenario-based). Time allowed: 3 hours, open book. Passing score: 70%.

How long should I study for ISO 27001 LA?

Our planning estimate is 58–78 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Conducting an ISO/IEC 27001 Audit, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows PECB ISO/IEC 27001 Lead Auditor Candidate Handbook (multiple-choice exam, 2025-2026 editions; ISO/IEC 27001:2022) (current), published by PECB. It was last reviewed in October 2026.

Domain names, weights and knowledge statements come from PECB's official outline (PECB ISO/IEC 27001 Lead Auditor Candidate Handbook (multiple-choice exam, 2025-2026 editions; ISO/IEC 27001:2022) (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.