Lead an information security risk management programme — the 5-day senior pathway, with OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA. Published Self-Study enrolment starts from $989 + GST and includes the official exam access stated on this page. Instructor-led delivery for organisations can be scoped on request; no public cohort is implied unless confirmed dates, mode, venue and trainer are shown.
Available Australia-wide, in New Zealand and across Asia Pacific — and, because self-study and eLearning are delivered online through the myPECB platform, from anywhere in the world. Instructor-led organisational delivery can be scoped on request; no public cohort or classroom venue is implied unless confirmed details are shown. Base prices are published in AUD, and every course page supports available local currencies including NZD. An Australian billing address adds 10% GST; a non-Australian billing address has no Australian GST.
The PECB ISO/IEC 27005 Lead Risk Manager Self-Study course costs A$989 excluding GST (A$1,087.90 including 10% GST for an Australian billing address) through Aegentra Academy, an official PECB authorised training partner in Australia. That price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free exam resit within 12 months. Typical total learning effort is 35–45 hours. A separate eLearning option is not currently published. For non-Australian billing addresses, Australian GST is not charged and any applicable local taxes are determined at checkout.
Instructor-led delivery is enquiry-only. Aegentra Academy is not currently publishing scheduled live online or classroom cohorts. Contact us to arrange a class for your organisation; Self-Study is available without waiting for a cohort.
Australian totals above include 10% GST. For non-Australian billing addresses, Australian GST is not charged; any applicable local taxes are determined at checkout.
Online classes are arranged through the Aegentra Academy team for individual learners and groups.
Contact us for online classAsk about prerequisites, delivery, employer invoicing, or which course fits your goal.
We normally reply within one Australian business day.
Learn · Implement
Official PECB training is included. The practical ISO/IEC 27005 resources are free to use after the course, with no email required.
Learn
Included with courseThis is what the A$989 + GST Self-Study price covers.
Choose your courseImplement
Free · No email requiredGo beyond passing the exam. Practical resources built around the work itself — the documents you will actually have to produce.
Explore free ISO 27005 resources$989 + GST, delivered self-paced. The official PECB examination voucher is included with one free retake within 12 months, so there is no separate ISO 27005 exam cost to budget for. Also included: 12 months of myPECB access and the full course materials. All ISO 27005 training through Aegentra Academy is official PECB certification training.
| Course | Course focus | Exam | Self-Study | eLearning |
|---|---|---|---|---|
| Risk Manager | Run information security risk assessments — assets, threats, vulnerabilities, likelihood, consequence, treatment | 60 questions, 2 hours, open book | $849 + GST | $949 + GST |
| Lead Risk Manager | Lead the risk management programme — criteria, methodologies, communication, monitoring and board reporting | 80 questions, 3 hours, open book | $989 + GST | — |
80 multiple-choice questions across 6 competency domains, open book, 3 hours, 70% to pass. The per-domain weighting from PECB’s certification scheme:
Two of those six domains do not appear on the Risk Manager paper at all: risk communication, monitoring and improvement, and risk assessment methodologies. That is the real difference between the levels, and it is worth reading the next section before choosing.
Source note: these figures come from the current ISO/IEC 27005:2022 certification scheme. PECB’s older candidate handbooks still describe the 2008 edition and a 12-question essay paper — two editions stale, and a common source of wrong information about this exam.
The deciding question is whether you run assessments or own the method.
Take Risk Manager if your job is to carry out information security risk assessments within a framework somebody else defined — identify the assets, score likelihood and consequence, propose treatment. Four domains, 60 questions, two hours, $849 + GST.
Take Lead Risk Manager if you own the programme: setting the risk criteria before anything is assessed, choosing between assessment methodologies and defending that choice, reporting risk to a board or an audit committee, and running the monitoring and improvement cycle. Six domains, 80 questions, three hours, $989 + GST.
The credential ladders differ too. This exam awards Provisional Risk Manager with no experience required, then Lead Risk Manager at five years with two in information security management and 300 hours of activity, then Senior Lead Risk Manager at ten years with seven and 1,000 hours.
ISO 27001 is the certifiable management system; ISO 27005 is the risk methodology inside it. Clause 6.1.2 of ISO 27001 requires a defined information security risk assessment process without prescribing one, and ISO/IEC 27005:2022 is the standard that fills the gap.
At lead level the distinction matters commercially. An ISO 27001 certification auditor will test whether your risk criteria were defined before assessment, whether the method was applied consistently, and whether residual risk was accepted by someone with the authority to accept it. Those are Lead Risk Manager responsibilities, and they are where ISO 27001 audits most often produce findings.
ISO 27005 itself is not certifiable for an organisation — no Stage 1 / Stage 2 audit, no company certificate. Only individuals hold the credential. Alongside it, ISO 31000 is the generic enterprise framework; most organisations run ISO 31000 as the umbrella and ISO 27005 for information security specifically.
An entire exam domain — 15 of the 80 questions — covers this, and it is the part Risk Manager does not touch. The 2022 edition is deliberate about there being more than one defensible approach.
The choice runs along two axes. Event-based versus asset-based: an asset-based assessment starts from what you hold and works outward to threats and vulnerabilities; an event-based one starts from scenarios that would hurt and works back. Asset-based is thorough and slow; event-based is faster and better at catching risks that cross system boundaries. Qualitative versus quantitative: scales and judgement, or modelled loss values. Most Australian organisations run qualitative with calibrated scales, because the data for genuine quantification rarely exists.
What a lead is expected to do is choose deliberately, document why, and apply it consistently — not to pick the most sophisticated option. An auditor tests consistency, not sophistication.
The two artefacts a lead actually owns, published in full and free — no email required.
If your organisation needs the ISMS built rather than a person trained, that is our governance and risk practice.
The official PECB course and exam package starts at A$989 + GST — with no separate exam fee after enrolment. Optional Aegentra Labs exam preparation is clearly priced separately.
The exam voucher is included in your enrolment, and so is one free resit if you don’t pass first time. Both the exam and the credential are issued directly by PECB.
Passing the exam makes you eligible to apply for the PECB Certified ISO/IEC 27005:2022 Provisional Risk Manager credential with no experience required. Lead Risk Manager requires five years of professional experience with two in information security management, plus 300 hours of information security risk management activity; Senior Lead Risk Manager requires ten years with seven in information security management, plus 1,000 hours. All tiers require signing the PECB Code of Ethics. Certification is valid three years and is maintained through 60 CPD hours per three-year cycle plus the annual maintenance fee.
An exam pass is the first step. You must submit PECB's certification application and required declarations and references. PECB decides whether the requirements for the requested credential tier are met.
/ Before you enrol
These answers use this course's current catalogue record and PECB's published exam, certification, and maintenance policies.
The published price is A$989 for Self-Study, before tax. It includes the official PECB course materials, 12 months of access, the first exam attempt, one free retake, and the certification application fee. PECB’s partner-course policy also includes the first year of the Annual Maintenance Fee where maintenance applies; Foundation and Provisional credentials are maintenance-exempt. There is no separate first-exam or certification-application charge after enrolment.
PECB’s current maintenance policy lists no maintenance fee for Foundation, Provisional, or Transition credentials. For all other PECB certifications, the published fee is $390 per three-year certification cycle, together with the applicable CPD requirements and continued adherence to the PECB Code of Ethics. PECB sets this fee and may change it, so check the linked policy before renewal.
Yes. Every Academy course supports AUD and multiple local currencies, including NZD, USD, SGD, GBP, EUR, INR, AED, MYR, PHP, IDR, and VND when a live quote is available. Currency and tax are separate: an Australian billing address adds 10% GST, while a non-Australian billing address has no Australian GST. For example, an Australian working in New Zealand may pay in NZD and use an Australian billing address, but 10% GST will still be added because the billing address is Australian.
The currently published self-paced option is Self-Study at A$989 before tax, using the official PECB slide-based materials. A separate recorded eLearning price is not currently published for this course. The official exam package is still included, and instructor-led delivery is available only when a confirmed cohort is shown or arranged with Aegentra Academy.
Yes. PECB publishes remote online exam sessions that candidates can take from home or another suitable location through the PECB Exams application. The published course record lists these exam facts: duration — 3 hours; format — Open-book multiple choice — stand-alone and scenario-based questions, three options each; assessment — 80 multiple-choice questions across 6 competency domains — fundamental principles and concepts of information security risk management (13 questions), implementation of an information security risk management program (7), information security risk assessment (20, the largest domain at 25% of the paper), risk treatment (15), risk communication, monitoring and improvement (10), and risk assessment methodologies (15); pass mark — 70%; language — English (other PECB languages available on request). New Zealand candidates should choose a published session that suits their local time, meet PECB’s identity and technical requirements, and complete the system check before exam day. PECB’s general exam policy does not publish a New Zealand restriction.
Passing the exam makes you eligible to apply for the PECB Certified ISO/IEC 27005:2022 Provisional Risk Manager credential with no experience required. Lead Risk Manager requires five years of professional experience with two in information security management, plus 300 hours of information security risk management activity; Senior Lead Risk Manager requires ten years with seven in information security management, plus 1,000 hours. All tiers require signing the PECB Code of Ethics. Certification is valid three years and is maintained through 60 CPD hours per three-year cycle plus the annual maintenance fee. Passing the exam does not by itself award a credential or guarantee the highest experience-based tier. PECB requires an online certification application and reference contact details, and its Certification Department decides whether the education, professional experience, and risk-management activity requirements are met.
PECB’s public certification-process page does not publish a closed list of documents that automatically proves project hours. It requires the online application and contact details for references who may be contacted to validate your experience. Keep a dated activity log showing the organisation or client, your role, the risk-management activity, dates, responsibilities, and hours; retain employer or client confirmations, statements of work, timesheets, or similar records in case PECB asks for support. The PECB Certification Department assesses the application and makes the final decision.
5 modules, fully on-demand. Click any module to see the topics inside.
Foundation establishes the language, Lead Implementer builds the management system, and Lead Auditor verifies it. Choose the level that matches the work you will perform.
Information security risk management based on ISO/IEC 27005 — plus OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA.
Lead an information security risk management programme — the 5-day senior pathway, with OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA.
Where the Risk Manager credential says you can run the process, Lead Risk Manager says you can own the framework — define the method, set the risk criteria, decide what gets escalated, and answer for the programme in front of an auditor or an executive committee. It is the credential for the person accountable for information security risk, not the person populating the register.
Head of Security Risk, Cyber Risk Manager, Senior GRC Consultant, ISMS Manager, and second-line information security risk roles. It is also the credential most often asked for when an organisation needs someone to stand up an information security risk function from nothing rather than inherit a working one.
Day 4 is given entirely to OCTAVE (including Allegro and FORTE), MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA, and Domain 6 is 18.75% of the exam. In consulting that matters — you are usually working inside a method a client already chose, and being able to operate in it, and say honestly where it is weak, is the job.
ISO 31000 is the enterprise risk framework, ISO/IEC 27005 is the information security companion, and ISO/IEC 27001 is the management system the output feeds. Holding the Lead credential alongside an ISO 27001 implementer or auditor certification covers both halves of what a certification audit actually examines.
Risk assessment is where ISO 27001 programmes most often come apart at Stage 2 — an undefined method, or a Statement of Applicability that cannot be traced to any assessed risk. This is the credential for the person who owns that method and has to defend it.
CPS 234 requires information security capability commensurate with the size and extent of threats — a risk judgement that has to be evidenced. A documented, repeatable ISO/IEC 27005 framework is a defensible way to show how that judgement was reached.
PSPF-aligned entities make risk-based decisions on information handling and system authorisation. A named, consistently applied information security risk method is a standing expectation rather than a one-off deliverable.
Responsible entities must maintain a Risk Management Program covering cyber and information hazards, and review it annually. ISO/IEC 27005 supplies a defensible method for the information security portion, and this credential covers leading that programme.
The exam is open-book, but the questions reward fluency, not lookup. Plan your study around these checkpoints.
Free learning resources
Use Aegentra’s existing templates, checklists, registers and mappings alongside your course. No account or email is required.
Free companion reading for anyone studying information security risk management — the risk method behind every ISO 27001 risk assessment:
Compare the family
The ISO 27005 family page compares current levels, prices, delivery, audiences and exam facts before you choose a pathway.
Compare ISO 27005 pathwaysSource and review status
Price, delivery and course content are generated from Aegentra’s authoritative catalogue record. The official PECB course page and exam policy are linked directly below. Source-link checks and substantive human review are tracked separately so one is never presented as the other.
Official PECB sources
Editorial accountability
Harry Sidhu owns publication of this record. A separate course-specific substantive reviewer has not yet been recorded.
Substantive review status
Official source links are checked separately. A course-specific substantive review date will be published when completed.
Official PECB training through an authorised partner. PECB is accredited by IAS and UKAS as a personnel certification body under ISO/IEC 17024 and by ANAB as a certificate issuer under ANSI/ASTM E2659-24. Accreditation is program- and scope-specific—verify the applicable credential before enrolment.
Official PECB training and credential pathway. Check PECB’s current accreditation information and the applicable program scope before enrolment.
This official PECB course is sold and supported by Aegentra Academy. PECB supplies the course material, examination and professional credential scheme. Aegentra's wider practice also runs governance, risk and compliance engagements and Microsoft 365 hardening for Australian organisations. Named eLearning trainers are credited separately on this page when the course record supplies them.
Published courses run online and self-paced through the myPECB platform, so professionals across Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra and New Zealand enrol online. Instructor-led delivery for organisations can be scoped on request. No public cohort or classroom venue is implied unless confirmed dates, mode, venue and trainer are shown on the course page. Multi-seat team pricing is available for five or more seats — email Academy@aegentra.com.au for an enterprise quote. Tax invoices with GST and ABN are issued automatically at checkout.
The published option is self-paced study. Instructor-led delivery for organisations can be scoped on request, subject to trainer availability, learner numbers and an agreed date. Aegentra does not publish a live or classroom cohort unless its dates, delivery mode, venue (where applicable) and trainer are confirmed. Email Academy@aegentra.com.au with your requirements.
Risk Manager is the three-day practitioner course — it trains you to run the information security risk process. Lead Risk Manager is the five-day senior pathway — it trains you to establish, maintain, and continually improve the whole framework, and gives a full day to the assessment methods. The Lead exam is broader too: six competency domains and 80 questions, against four domains for Risk Manager.
No. ISO/IEC 27005 Lead Risk Manager is offered as slide-based self-study only at $989 + GST. If you would prefer a format with recorded video lectures, the ISO/IEC 27005 Risk Manager course is available either as self-study or with eLearning.
Eighty multiple-choice questions across six competency domains, each with three options. Half the questions measure comprehension, application and analysis; the other half measure evaluation. Questions are a mix of stand-alone and scenario-based, where one scenario carries five questions. Pass mark is 70%, and the exam is open-book.
It is open-book. You may use a hard copy of the ISO/IEC 27005 standard, your training course materials (through the PECB Exams app or printed), and any personal notes taken during the course.
It depends on attested experience. Provisional Risk Manager requires none. Lead Risk Manager requires five years of professional experience with two of those in information security risk management, plus 300 hours of information security risk management activities. Senior Lead Risk Manager requires ten years with seven in information security risk management, plus 1,000 hours. All require signing the PECB Code of Ethics.
For courses delivered by a PECB partner, the training fee covers the first exam attempt, one free retake, the certification application fee, and the first year of the Annual Maintenance Fee. That cycle must be completed within 12 months of the purchase date for self-study.
Three years. To maintain it you need to meet the CPD requirement for your credential and pay the annual maintenance fee. The first year of that fee is included in the course price.
Thirty-one CPD credits — an attestation of course completion is issued on finishing the course. These count toward the CPD requirements of ISACA, IIA Australia, and other professional bodies on submission.
No. PECB expects a fundamental understanding of ISO/IEC 27005 plus knowledge of risk assessment and information security, but the Risk Manager course is not a formal prerequisite. If information security risk is genuinely new to you, starting at Risk Manager is the faster total path.
Yes. Either complete checkout yourself and forward the Stripe tax invoice for reimbursement, or write to Academy@aegentra.com.au and we will issue an invoice direct to your organisation with payment terms. For group enrolments, request a written quote confirming the current price, payment terms and inclusions before purchase.
Self-Study — Typical total learning effort: 35–45 hours. Course-day equivalent: approximately 5 training days. A separate eLearning option and workload are not currently published for this course. These are typical total-learning-effort estimates. They are separate from the 12-month access period, exam duration, any live-class calendar span, and professional-experience requirements.
After payment, the Academy team confirms your enrolment with PECB and you receive login details by email — usually within one business day.
You have 12 months of access from enrolment. That window covers the course material, the official PECB exam, and one free resit if you need it.
One PECB-issued resit is included in your enrolment at no extra cost. Aegentra does not publish a pass-rate claim without an audited cohort dataset.
Questions about invoicing, GST, group bookings, refunds or instructor-led delivery? Read the Academy FAQ.