PECB ISO/IEC 27701 Lead Auditor Training (2025 Edition): Audit a PIMS
Based on ISO/IEC 27701:2025, this five-day course prepares you to audit a privacy information management system (PIMS) from preparation to closure. The techniques taught build on ISO 19011, ISO/IEC 17021-1 and ISO/IEC 27706. The final day is dedicated to the Lead Auditor exam.
The essentials
Publisher : PECB
Certification : PECB Certified ISO/IEC 27701 Lead Auditor
Duration : 5 days, exam included on day 5 (31 CPD credits)
Level : Advanced
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : 80 multiple-choice questions · 3 h · open book · 70% to pass
Exam voucher : Official PECB offer: exam and certification fees are included, plus one free exam retake within 12 months if you do not pass the first time.
Explain PIMS principles and ISO/IEC 27701 requirements from the auditor's side.
Assess whether a PIMS conforms by applying audit principles.
Plan and initiate an audit, including stage 1.
Run the on-site audit: gathering information, test plans, auditing clauses 4 to 10.
Evaluate Annex A controls, write up nonconformities and close the audit.
Manage an ISO/IEC 27701 audit programme.
Program
Day 1 – The PIMS and ISO/IEC 27701
Certification process
Core privacy concepts
Overview of the requirements
Day 2 – Audit principles and initiation
Evidence-based and risk-based auditing
Initiating the audit
Stage 1
Day 3 – On-site activities
Preparing stage 2
Communication and information gathering
Test plans
Auditing clauses 4 to 10
Day 4 – Closing the audit
Assessing Annex A controls
Reporting nonconformities
Documentation review
Internal audit programme
Day 5 – Certification exam
Three-hour PECB exam
Prerequisites
A basic understanding of information security and privacy.
Solid knowledge of audit principles, as PECB requires.
Target audience
Auditors carrying out PIMS certification audits
Managers and consultants who want to master PIMS auditing
People responsible for keeping a PIMS compliant
Technical experts preparing for an audit
Personal data protection advisers
The exam
The three-hour exam takes place on day five, online with remote proctoring via the PECB Exams app or on paper through a partner. It has 80 multiple-choice questions over seven domains, with conducting the audit worth 20. It is open book with a 70% pass mark. Depending on your experience, you then hold Provisional Auditor, Auditor, Lead Auditor (five years' experience including two in privacy, 300 audit hours) or Senior Lead Auditor. Certification is valid for three years, subject to CPD and an annual maintenance fee.
Preparation tips
Revise from the 2025 edition; its stand-alone structure changes how a PIMS is audited.
Practise writing findings in three parts: requirement, evidence, gap.
Bring your case-study notes; they are allowed in the exam.
Frequently asked questions (FAQ)
What changed in ISO/IEC 27701:2025?
Published on 14 October 2025, the new edition turns ISO/IEC 27701 into a stand-alone management system standard: you no longer need to build it on top of an ISO/IEC 27001 ISMS. Some clauses and Annex A controls were added, changed or removed, and the terminology was updated.
Must I be an ISO 27001 auditor first?
No. Audit experience on another management system helps, but what PECB mainly asks for is solid knowledge of audit principles.
What title do I get without audit experience?
Provisional Auditor. You can move up to Auditor and then Lead Auditor once you document the required experience and audit hours.
Does the course cover internal audits?
Yes, day four deals with managing an internal audit programme, which is useful even outside a certification body.
Can I take the course online or in Casablanca?
Both. We run it as a live online class, in person in Casablanca, or on-site at your organization, taught in French or English depending on the group. For on-site sessions we can adapt examples and case studies to your sector and schedule the exam with you.