Become an ISO auditor: requirements, training and the route to lead auditor

An ISO auditor checks whether a management system meets the requirements of a standard. You do not need a degree in a specific subject, but you must know the standard, be able to audit, and show that you can do it. For internal audits you work within your own organisation, following the annual internal audit programme. For external audits you usually work for an accredited certification body. The Raad voor Accreditatie (RvA, Dutch Accreditation Council) supervises those bodies. The list of disciplines also includes personal certification bodies.

“ISO auditor” is a broad term. There are two types of work, and the requirements differ. First decide which one you want, then choose the training.

Internal auditor or lead auditor?

Feature	Internal auditor	External (lead) auditor
Works for	Your own organisation	A certification body
Does	Internal audits following the programme	Initial audit, surveillance audit and recertification
Requirements	Demonstrable competence (ISO 9001 requires this in clause 7.2), no fixed certificate	The certification body’s own qualification requirements, often a lead auditor training and audit experience
Independence	Must not audit their own work	Must be independent of the client
Example	A quality employee who audits purchasing	An auditor who carries out the surveillance audit at ten companies each year

The lead auditor leads the external audit team and is responsible for the audit report of the certification body.

What must an auditor be able to do?

The guideline for auditing is ISO 19011 (new edition since May 2026, replacing the 2018 edition). You can buy it from NEN (Royal Netherlands Standardisation Institute) . It describes the competence an auditor needs: knowledge and skills, and personal behaviour. You use training and experience to demonstrate that competence. A guideline is not a certification requirement. You use it as a guide.

Knowledge of the standard: the requirements and their intent, and how they work in practice.
Auditing skills: holding a conversation, finding evidence, formulating findings and making a plan.
Personal behaviour: ethical (honest and discreet), open-minded, diplomatic, observant and persistent. Example: you stay calm when an auditee disagrees with you, and you keep asking for evidence.
Experience: shadowing or carrying out audits yourself, preferably in the client’s sector. Example: someone doing a quality audit at a bakery needs to know how a production line works.

The list above summarises what the guideline means. It is not a quote from the standard text. For a training course or a certification, check the precise requirements with the provider and the certification body. These differ by standard and by scheme.

How do you become an ISO auditor?

Choose your role

Do you want to audit internally within your own company, or work externally for a certification body? That choice determines the training and experience you need.

Get to know the standard well

Start with the standard you want to audit. Read the requirements and look for the intent behind them. An auditor who only knows the chapters by heart misses the connections. See the High Level Structure for the shared structure of the management system standards.

Follow an internal auditor training

An internal auditor training teaches you the audit method: planning, interview technique, recording evidence and reporting. Many providers offer one. Check whether the training covers the internal audit and the audit report, not only the theory of the standard.

Audit under supervision

Shadow an experienced auditor, or carry out an internal audit with a colleague who guides you. You learn most by asking questions yourself and finding evidence.

Choose lead auditor if you want to work externally

A lead auditor training goes deeper into leading an audit team and writing the final report. To work for a certification body, you then follow that body’s qualification process. Ask in advance which training, experience and certificates they require.

Keep your knowledge up to date

Standards are revised. An auditor who does not know the new version cannot carry out an audit properly. ISO 19011 itself received a new edition in 2026, so the audit method is changing too. Plan time each year to update your knowledge of the standard and your audit method.

Personal certification: what is it?

Personal certification means an independent body confirms that you have a certain competence, for example as an auditor. That is different from a training diploma. A training certificate says you completed the course; a personal certificate says your competences have been assessed.

The RvA lists personal certification bodies as their own group in the list of disciplines . A course certificate is not automatically a personal certificate. Ask the provider which body issues the certificate, and whether that body is accredited.

A personal certificate is not required by every certification body. A certification body sets its own competence criteria and assesses its auditors against them. This follows from ISO/IEC 17021-1, the standard with requirements for bodies that audit and certify management systems. Many auditors also hold a certificate from a professional association, for example CQI/IRCA (the British organisation for quality and auditors). Ask each body what they require.

What does it cost?

The costs of a training course and a personal certificate vary widely by provider, standard and duration. Request a quote and compare what is included: training days, exam, certificate and any resits. A price without those components cannot be compared.

Common mistakes

Thinking a course is enough. A course teaches you the method. You learn experience by doing audits. An auditor without practice struggles.

Auditing what you do yourself. This is the biggest problem with internal audits. Choose an auditor from another team or another process.

Only knowing the standard. An auditor also has to hold conversations and weigh evidence. Knowledge of the standard is the start, not the end.

Choosing a training without knowing what for. If you want to work externally, first ask the certification body which trainings and certificates they accept. A course nobody recognises gives you little on paper.

Stopping learning after the course. You grow as an auditor through the audits you carry out afterwards. Plan experience deliberately, for example by shadowing two audits a year.

What if you are unsure?

Unsure between internal and external audits? Then start with the internal role. You learn the standard and the audit method within your own company, without the pressure of an external audit. Afterwards you can decide whether you also want to work externally. That step is easier to take later than starting directly in an external role.