1.1 Current Exam Facts & PECB Credential Path

1.1 Current Exam Facts & PECB Credential Path

Quick Answer: The PECB ISO/IEC 42001 Lead Auditor exam is 80 multiple-choice questions answered in 3 hours, open book, with a 70% pass mark. It validates competence to plan, lead, and report audits of an Artificial Intelligence Management System (AIMS) against ISO/IEC 42001:2023. Passing the exam is necessary but not sufficient for the Lead Auditor credential—you must still document the audit hours and professional experience PECB requires for each tier.

The Professional Evaluation and Certification Board (PECB) administers the personal certification scheme for ISO/IEC 42001 Lead Auditors. ISO/IEC 42001:2023 is the first international management-system standard dedicated to governing the responsible development and use of AI. For auditors, that means you must combine classic management-system audit skill (ISO 19011 / ISO/IEC 17021-1 thinking) with AI-specific evidence: model documentation, data lineage, impact assessments, human oversight records, and third-party AI supplier controls.

PECB is the authoritative source for exam rules, open-book allowances, domain weights, and credential experience tables. Always confirm the current List of PECB Exams, Exam Rules, and the ISO/IEC 42001 Lead Auditor brochure before you sit—formats and logistics can be updated by the certification body.

---

Exam Logistics (What PECB Publishes)

Do not prepare for an essay paper. PECB still runs 12-question essay-type Lead Auditor papers for some standards, and that legacy figure is widely copied onto third-party training pages. It does not apply here: every ISO/IEC 42001 Lead Auditor entry in the List of PECB Exams, in all published languages, is 80 multiple-choice questions, open book, 3 hours, and the ISO/IEC 42001 Lead Auditor Candidate Handbook states the same.

Multiple choice does not mean recall. PECB writes 55% of the paper at the evaluation level of understanding, and the scenario sets ask you to judge whether an audit team acted correctly — was the stage 1 audit conducted at the right location? how should this finding be classified? You still have to reason about scope, criteria, evidence, nonconformities, and conclusions; you express the judgment by choosing one of three options instead of writing prose. Confirm the format on your own registration confirmation before you sit, since certification bodies do change schemes.

Open-book strategy that actually works

Open book is not a free pass. Successful candidates tab:

1. Clauses 4–10 of ISO/IEC 42001 (normative AIMS requirements).
2. Annex A control objectives (A.2–A.10) and the Statement of Applicability logic.
3. ISO 19011 principles and process steps (prepare → conduct → report → follow-up).
4. A one-page cheat sheet of AI evidence types (impact assessments, model cards/system cards, training-data provenance, monitoring logs, human-oversight records, third-party contracts).

With 80 items in 180 minutes you average 135 seconds per question, and a five-question scenario consumes more than five stand-alone items. Tabbing beats reading: candidates who plan to look everything up run out of time. Practise deciding the conformity judgment first, then confirming the clause or control number in your tabbed copy — not the reverse.

Who certifies whom

Domain 1 expects you to keep three roles straight, because scenario items exploit the confusion:

Trap: your PECB Lead Auditor certificate never certifies your employer, and an organization's ISO/IEC 42001 certificate never certifies an individual AI product. Neither is a licence to issue certificates — only an accredited CB does that.

---

The Seven Competency Domains

PECB organizes the Lead Auditor body of knowledge into seven domains and publishes the exact question allocation in the ISO/IEC 42001 Lead Auditor Candidate Handbook. These are not estimates — learn them, because they contradict most candidates' instincts:

Exam trap — the intuitive study plan is the wrong one. Candidates assume the standard is the exam and grind Clauses 4–10 and the 38 Annex A controls. Domain 2 is only 10% of the paper — 8 questions. The two heaviest domains are Domain 5, conducting an audit (23.75%, 19 questions) and Domain 3, fundamental audit concepts (20%, 16 questions) — 43.75% together, both set at the evaluation level. Clause and control knowledge is the raw material; the marks are in judging audit conduct. The mirror-image failure is just as costly: an AI specialist who skips ISO 19011 process discipline forfeits the single largest block on the paper.

Note what this does not mean. You cannot audit against criteria you do not know, and Domains 4–6 questions are written about ISO/IEC 42001 evidence — so the clause and Annex A chapters in this guide remain essential groundwork. Weight your final revision toward audit methodology, and toward the three evaluation-level domains (3, 5, 7 = 55% of the exam) rather than toward re-reading the standard.

How domains show up in scenarios

• A question that asks whether an organization can exclude AI impact assessment from planning maps to Domain 2 (Clause 6.1.4 / Annex A.5), not only Domain 1 vocabulary.
• A question about sampling model-retraining logs during Stage 2 is Domain 5, using Domain 3 principles (evidence-based, risk-based).
• A question about scheduling surveillance for a multi-site AIMS is Domain 7.

---

Who Should Attend & Recommended Prerequisites

PECB positions the course for professionals who will audit, lead audit teams, or manage audit programs for AI management systems—for example:

• Internal auditors expanding from ISO/IEC 27001, ISO 9001, or ISO 27701 into AI governance
• Third-party / certification auditors adding an AIMS scheme
• AI governance, risk, compliance (GRC), and responsible-AI leads who must evaluate suppliers and internal AI programs
• Consultants who need to distinguish implementation work from independent audit work

Prerequisites: There is no formal education barrier to sit the exam. PECB and the brochure strongly recommend a fundamental understanding of ISO/IEC 42001 and of AI concepts before the 5-day course. Without that foundation, Day 1–2 terminology (AI system vs model, impact assessment, human oversight) consumes time you need for audit methodology.

Who should not confuse this path: Implementers building the AIMS should pursue Lead Implementer content as well. Auditing your own recent implementation creates independence issues under ISO 19011 / certification rules—exam essays often test that boundary.

---

Credential Ladder After You Pass

Passing the Lead Auditor exam demonstrates knowledge. Holding a PECB auditor credential additionally requires documented experience, acceptance of the PECB Code of Ethics, and (for maintenance) continuing professional development and fees per the current PECB scheme.

Every tier additionally requires passing the ISO/IEC 42001 Lead Auditor exam (or a PECB-accepted equivalent) and signing the PECB Code of Ethics. Applications also need two professional references — not people you supervise and not relatives.

Exam trap: “I passed the Lead Auditor exam, therefore I am a Lead Auditor” is false in PECB language. Exam pass ≠ credential tier. Provisional is the immediate knowledge recognition; Lead Auditor requires the hour and experience package.

To count toward those hours, PECB requires the activities to follow best audit practice and to include: planning an audit; managing an audit programme; drafting audit reports; drafting nonconformity reports; drafting audit working documents; reviewing and managing documented information related to the audit; conducting on-site audits; following up on nonconformities; and leading an audit team. Keep contemporaneous logs (engagement, role, hours, standard, client) so applications are defensible — the Certification Department verifies the hours, and an unanswered request for documentation can result in a downgrade to a lower credential rather than a rejection.

---

Free Retake, CPD, and Maintenance Signals

• Free retake: Candidates who complete PECB partner training (instructor-led, eLearning, or self-study packages as offered) generally receive one free exam retake within 12 months of the training / purchase cycle. Subsequent retakes incur fees. Confirm the exact clock-start date on your registration.
• Course CPD: Attendance is associated with 31 CPD credits in PECB course materials—useful for professionals who already hold other PECB or industry credentials that demand annual CPD.
• Certificate lifecycle: PECB certifications are valid for three years. Maintaining one requires the credential's continuing professional development (CPD) hours and payment of the Annual Maintenance Fee (AMF). Missing CPD or AMF triggers a 12-month suspension, during which you may not promote the certification; failing to clear it in that window leads to revocation.
• What it costs if you skip training: PECB prices a standalone Lead exam at $1,000, and the certification application fee for a Lead Auditor credential is $500. A partner training course bundles the first exam attempt, one free retake, the certification application fee, and the first year of AMF — which is why most candidates take the course route. The bundled cycle must be completed within 12 months of course completion (instructor-led) or of purchase (self-study / eLearning).
• Appeals: you may request re-evaluation of an exam result or a certification decision within 30 days of receiving it, then appeal within a further 30 days. Later requests are not processed.

---

Auditor Mindset for This Credential

On exam day and on the job, you are not scoring “how smart the model is.” You are evaluating whether the organization’s AIMS systematically governs AI so that policy, risk, impact, lifecycle controls, competence, and improvement actually operate. That is a management-system audit, informed by AI risk—not a pure model-validation contest and not a legal opinion on the EU AI Act (though regulation may appear as context for interested parties and compliance obligations).

Scenario: A bank deploys a third-party large language model for customer chat. The CISO shows a SOC 2 report for the vendor and claims “AI is covered under our ISO 27001 certificate.” As a Lead Auditor candidate, you should recognize that ISMS ≠ AIMS: information security controls may be necessary but are not automatically sufficient for ISO/IEC 42001 requirements such as AI system impact assessment, AI-specific objectives, and Annex A lifecycle / data / transparency controls. Your finding logic must map evidence to 42001 criteria, not only to security controls.

Study implications for Domain 1 (~10%)

This chapter builds Domain 1 foundations so later chapters can audit requirements without vocabulary fights. Master exam logistics and the credential path first so you invest study hours where the blueprint puts weight—especially Domains 2 and 5—while still being able to answer orientation items about open-book rules, pass score, and who may claim which title.