What is a Lead Implementer?

What the credential covers

A Lead Implementer course walks through a standard clause by clause from the point of view of the person building the system: defining scope, setting policy and objectives, running the risk assessment, choosing controls, writing the Statement of Applicability, and preparing for internal audit, management review and the certification audit.

Courses usually end with an exam. Some issuers grade the credential by experience, so a person who passes the exam with little practical background may hold a provisional or associate level until they can show implementation work.

Lead Implementer or Lead Auditor

The two credentials cover the same standard from opposite sides. A Lead Implementer is trained to build and run the management system. A Lead Auditor is trained to plan and conduct audits of one, following the guidance in ISO 19011.

For a company preparing for its first certificate, implementation skills matter more. Audit training becomes useful when you set up the internal audit programme, because the internal auditor has to be independent of the work being audited and know how to sample evidence.

Do you need one?

ISO 27001 and ISO 42001 require that the people doing the work are competent, based on education, training or experience, and that you keep evidence of that competence (clause 7.2). Neither standard names a credential. A certification body will not refuse a certificate because nobody on the team holds a Lead Implementer title.

What the credential does give you is a shared vocabulary and a tested method. Many organisations either train one person internally or bring in a consultant who holds the credential for the first cycle, then keep the system running themselves.

• Train internally. Suits teams that will own the management system for years and want the knowledge in-house.
• Use a consultant. Suits a first certification with a deadline, provided someone internal takes over afterwards.
• Keep competence records. Whichever route you choose, record training and experience so the auditor can see clause 7.2 is met.

Related terms

ISMS

Information security management system: the scope, policies, risk process, controls and reviews that ISO 27001 certifies. The certificate covers the management system, not a product.

Statement of Applicability (SoA)

The ISO 27001 document listing every Annex A control, whether it applies, why, and whether it is implemented. The auditor’s map of your ISMS.

Internal audit

A review of the management system by someone independent of the area being audited. ISO 27001 and ISO 42001 require one before certification and at planned intervals after it.

Management review

A recorded review in which leadership looks at how the management system is performing: audit results, risks, incidents, objectives and resources. Required by ISO management system standards.

Certification body

An organisation accredited by a national accreditation body, such as UKAS or ANAB, to audit and certify management systems against ISO standards. Only a certification body can issue an ISO 27001 or ISO 42001 certificate.