The short version
- The pathway is short: official PECB training, one two-hour, 60-question open-book exam, then the applicable experience tier.
- You do not need years of risk experience to start — after passing the exam, you can apply for Provisional Risk Manager subject to PECB’s application and ethics requirements.
- The 2026 Risk Manager Candidate Handbook assigns that exam to Provisional Risk Manager and Risk Manager. PECB’s current course page also displays Lead tiers, so confirm a Lead-tier outcome with PECB in writing before relying on it.
- ISO 31000 is guidance, not a certifiable standard. Organisations are never "ISO 31000 certified"; only individuals hold the credential.
- No Australian law, regulator, employer, tender panel or professional body universally requires or recognises a PECB ISO 31000 credential.
What an ISO 31000 Risk Manager actually is
ISO 31000:2018 — published in Australia as AS ISO 31000:2018 — is the international standard giving principles, a framework and a process for managing risk. A Risk Manager is the person who runs that process in practice: the risk register, the criteria that define what is acceptable, the assessment workshops, the treatment plans, and the reporting that lets leadership act. For the standard itself and what it means in Australia, see our ISO 31000 certification guide. This page is about the individual credential and the career behind it.
Two clarifications worth making early, because they are where most of the confusion sits. First, no organisation is ever “ISO 31000 certified” — the standard is guidance, there is no organisational audit, and only individuals hold the credential. Second, Risk Manager and Lead Risk Manager are different exams on different schemes; if you will own the framework rather than work inside it, see the ISO 31000 Lead Risk Manager course instead. This is a governance role: you will spend your time on accountability, evidence and decisions, working alongside the business owners who carry the risk rather than owning it all yourself.
The step-by-step pathway
- 01
Get the vocabulary grounding
If you have never worked inside a formal risk framework, start with ISO 31000 Foundation. It covers the eight principles, the framework, the process and the ISO Guide 73 vocabulary that the Risk Manager course assumes you already have. If you already run risk assessments day to day, skip it.
- 02
Take the official Risk Manager course
The official PECB ISO 31000 Risk Manager course teaches you to establish a risk management framework and run the process end to end — scope, context and risk criteria, identification, analysis, evaluation, treatment, monitoring and reporting. PECB supplies over 300 pages of course material alongside it.
- 03
Sit and pass the PECB exam
Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 120 minutes. 60 multiple-choice questions across 3 competency domains — 12 questions on fundamental principles and concepts of risk management (20%), 14 on establishment of a risk management framework (23.33%), and 34 on implementation of a risk management process (56.67%).. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking. Passing the examination allows you to apply for the PECB credential tier supported by your verified experience. PECB reviews the application and makes the final credential decision. The current candidate handbook lists Provisional Risk Manager (no professional-experience or activity threshold) and Risk Manager (two years of professional experience, including one year in risk management, plus 200 hours of risk-management activities). Both require the applicable application and PECB Code of Ethics. Non-Provisional Risk Manager credentials are valid for three years and the current maintenance requirement is 60 CPD hours per three-year cycle, the applicable annual maintenance fee and the PECB Code of Ethics. Provisional credentials are exempt from CPD and annual maintenance fees. PECB’s current Risk Manager course page and candidate handbook are not fully consistent about higher credential tiers from this examination, so Aegentra does not promise a Lead or Senior Lead credential from this course. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
- 04
Log your experience and project hours
PECB counts two things separately — years of professional experience, with a minimum specifically in risk management, and hours of hands-on risk management project activity. Keep a running log with dates, the organisation, the deliverable and the hours. Reconstructing it two years later is painful.
- 05
Sign the Code of Ethics and apply for your tier
Every tier requires signing the PECB Code of Ethics and submitting an application with references. PECB evaluates submitted experience evidence and issues a digital credential that can be checked in its public directory.
- 06
Decide whether to take Lead Risk Manager
If you move from running risk inside a business unit to owning the framework itself — setting appetite, chairing the risk committee, reporting to a board — the three-hour Lead Risk Manager exam covers five domains rather than three and unambiguously carries the full credential ladder. PECB’s official sources conflict on whether the Risk Manager exam can reach Lead tiers, so choose Lead Risk Manager or obtain written confirmation from PECB if that outcome matters.
Aegentra Academy is an official PECB authorised training partner and delivers the ISO 31000 Risk Manager course as Self-Study and eLearning, with instructor-led organisational delivery scoped on request. Foundation-level grounding is available through the ISO 31000 Foundation course.
Credential tiers & the experience each one needs
PECB publishes four ISO 31000 credential names separated by professional experience and hands-on risk-management hours. Its current sources conflict on whether the 60-question Risk Manager exam supports the Lead tiers: the 2026 Risk Manager handbook lists the first two, while the current course page displays all four. The table shows the published experience thresholds; it does not promise an exam route to a Lead tier.
| Credential tier | Total experience | In risk management | Project hours |
|---|---|---|---|
| Provisional Risk Manager | None | — | 0 |
| Risk Managerthe target | 2 years | 1 yr | 200 |
| Lead Risk Manager | 5 years | 2 yrs | 300 |
| Senior Lead Risk Manager | 10 years | 7 yrs | 1,000 |
Project hours required, by tier
These are PECB scheme requirements, not requirements of the ISO standard itself — confirm the current criteria on the official PECB ISO 31000 Risk Manager page. Every tier also requires signing the PECB Code of Ethics.
What counts as risk management project hours
Two things are counted separately. Professional experience is your years of work, with a minimum specifically in risk management — one year for Risk Manager, two for Lead Risk Manager, seven for Senior Lead Risk Manager. Project activity hours are hands-on hours doing the risk work itself.
This is the part people underestimate and then, later, cannot evidence. The activities below are practical risk-management outputs. If you are already doing any of them — in a GRC, privacy, risk, audit, or security role — record the work actually performed and ask PECB to confirm uncertain eligibility.
Building and maintaining the risk register
Identifying risks across strategy, operations, compliance, people, technology and supply chain, scoring them inherent and residual, and keeping the register current rather than treating it as an annual-only record.
Defining risk criteria and appetite
The Clause 6.3.4 work: setting the thresholds that decide what is acceptable before assessment rather than after, so the result follows stated criteria rather than a case-by-case argument.
Calibrating likelihood and consequence scales
Turning adjectives into frequency bands and thresholds to improve consistency when different assessors apply the same scale.
Running risk assessment workshops
Facilitating identification and analysis sessions with business owners — which is as much about drawing out what people actually worry about as it is about the method.
Designing and tracking treatment plans
Selecting treatment options against the criteria, assigning named owners, and following through to the point where residual risk is formally accepted by someone with the authority to accept it.
Risk reporting and key risk indicators
Building reporting that shows trend and appetite context rather than a static heat map, and defining KRIs with thresholds that trigger action before the risk materialises.
Integrating risk with other management systems
Connecting enterprise risk to the ISO 27001 ISMS, business continuity under ISO 22301, and AI governance under ISO 42001 — one register and one appetite, not four that contradict each other.
Project activity and audit independence are separate questions. Confirm with PECB whether a specific activity is eligible before relying on it in a credential application. ISO 31000 is guidance and has no organisational certification audit.
How ISO 31000 relates to Australian obligations
No Australian law requires ISO 31000 or a PECB credential by name. Prudential standards, critical-infrastructure obligations and governance frameworks can still make a documented risk method relevant. The four contexts below explain the relationship without claiming recognition or job eligibility.
APRA CPS 220 and CPS 230
APRA-regulated institutions must maintain a risk management framework and board-approved risk appetite under CPS 220, and address critical operations, disruption tolerances and service-provider risk under CPS 230. Neither prudential standard names ISO 31000 or requires a PECB credential.
The SOCI Act risk management program
Responsible entities in designated critical-infrastructure sectors must maintain a written Risk Management Program addressing applicable hazards. ISO 31000 can help structure a general risk method, but the Act and Rules determine compliance and do not prescribe a PECB credential.
The PSPF and Commonwealth risk policy
Commonwealth entities have their own security-risk and risk-oversight obligations. ISO 31000 may be used as a supporting method, but those government frameworks do not establish government recognition of or a universal requirement for a PECB credential.
ASX Principle 7
The ASX Corporate Governance Principles ask listed entities to establish a sound risk management framework and review its effectiveness. Principle 7 does not prescribe ISO 31000 training or a personnel credential.
Each obligation must be assessed against its own legal or regulatory source. Training may build relevant capability, but it does not establish compliance, government recognition, tender eligibility or employment.
Roles and career pathways in Australia
ISO 31000 subject matter can be relevant across risk, compliance, governance, audit and consulting roles. The examples below are role families, not evidence that an employer requires the credential or that holding it qualifies someone for the role.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
Risk Manager vs Lead Risk Manager
The deciding question is not how much risk experience you have. It is whose risk you are accountable for. Take Risk Manager if you run risk inside a function, business unit or project, working within a framework somebody else designed. Take Lead Risk Manager if you are accountable for the framework itself — setting appetite, chairing the risk committee and answering to a board for whether the whole thing works.
| ISO 31000 Risk Manager | ISO 31000 Lead Risk Manager | |
|---|---|---|
| Course price | A$699 Self-Study; A$699 eLearning — excluding GST | A$857 Self-Study — excluding GST |
| Typical learning effort | 25–35 hours Self-Study; 20–30 hours eLearning (approximately 3–4 training days) | 35–45 hours Self-Study |
| Exam | 2 hours; 60 multiple-choice questions, open book | 3 hours; 80 multiple-choice questions, open book |
| Competency domains | 3 | 5 |
| Extra ground covered | — | Risk treatment and reporting; monitoring, review, communication and consultation |
| Credential pathway | 2026 handbook: Provisional and Risk Manager; current PECB course table conflicts | Full ladder, up to Senior Lead Risk Manager |
| Who it is for | Running risk in a function or business unit | Owning the framework — heads of risk, CROs, consultants |
| Typical background | Compliance, audit, operations, project delivery | Senior risk, governance, assurance, executive |
PECB’s 2026 Risk Manager Candidate Handbook assigns the 60-question exam to the first two tiers, while its current Risk Manager course table also displays Lead tiers. Aegentra does not promise a Lead-tier outcome from that exam. Choose Lead Risk Manager or confirm eligibility with PECB in writing if that outcome matters. If you are coming from information security instead, the companion guide is how to become a certified ISO 27001 Lead Implementer. If your organisation needs a risk framework built rather than a person trained, that is our governance and risk practice.
FAQs
Is the ISO 31000 Risk Manager credential worth it?
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
Can my organisation be ISO 31000 certified?
No. ISO 31000 is guidance, not a certifiable management system standard. There is no Stage 1 / Stage 2 certification audit and no accredited organisational ISO 31000 certificate. PECB’s scheme applies to individual practitioners. If you need a certifiable information-security management-system standard, see ISO/IEC 27001.
Does the Risk Manager exam lead to Lead Risk Manager?
Passing the examination allows you to apply for the PECB credential tier supported by your verified experience. PECB reviews the application and makes the final credential decision. The current candidate handbook lists Provisional Risk Manager (no professional-experience or activity threshold) and Risk Manager (two years of professional experience, including one year in risk management, plus 200 hours of risk-management activities). Both require the applicable application and PECB Code of Ethics. Non-Provisional Risk Manager credentials are valid for three years and the current maintenance requirement is 60 CPD hours per three-year cycle, the applicable annual maintenance fee and the PECB Code of Ethics. Provisional credentials are exempt from CPD and annual maintenance fees. PECB’s current Risk Manager course page and candidate handbook are not fully consistent about higher credential tiers from this examination, so Aegentra does not promise a Lead or Senior Lead credential from this course. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
How long does the ISO 31000 Risk Manager course take?
Typical total learning effort is 25–35 hours for Self-Study and 20–30 hours for eLearning, approximately 3–4 training days. These are estimated workloads, not video runtime, exam duration or completion guarantees. The course carries 21 CPD credits.
How hard is the exam, and how long is it?
Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 120 minutes. 60 multiple-choice questions across 3 competency domains — 12 questions on fundamental principles and concepts of risk management (20%), 14 on establishment of a risk management framework (23.33%), and 34 on implementation of a risk management process (56.67%).. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking.
How much does the course cost in Australia?
Self-Study: A$ 699.00 excluding GST. eLearning: A$ 699.00 excluding GST. Published inclusions (subject to the credential and retake clarification immediately below): PECB ISO 31000 Risk Manager slide deck (digital); 12 months access via myPECB; Module quizzes, practice scenarios, and exam-style cases; Risk-register, risk-appetite, and risk-treatment templates; Official PECB Risk Manager exam voucher; Open-book exam, 60 multiple-choice questions, remotely proctored; Two exam attempts (initial + one free resit); Eligibility to apply for the relevant PECB credential tier after passing, subject to PECB requirements; APRA CPS 220 + CPS 230 risk-framework worked example; ASX corporate-governance Principle 7 alignment notes; Commonwealth Risk Management Policy mapping. Clarification: references to a credential or certificate on pass do not mean automatic award. The eligible PECB credential requires an application and PECB approval, including applicable experience and ethics requirements. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. A retained inclusion referring to the initial examination date does not extend or restart this policy cycle. Australian GST follows the billing address. Check the course page for the full inclusions and current booking options. This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
Is ISO 31000 the same as AS ISO 31000?
Yes. Standards Australia publishes it as AS ISO 31000:2018, an identical adoption of the international standard — same eight principles, same framework, same process. If a tender or position description asks for AS ISO 31000, PECB ISO 31000 training covers it. Note the previous edition was the joint AS/NZS ISO 31000:2009; for the 2018 revision the "/NZS" was dropped, so a document still citing AS/NZS ISO 31000 as current is referring to a superseded edition.
Do I need ISO 27001 before ISO 31000?
No. ISO 27001 requires a documented risk assessment methodology but does not mandate which one. ISO 31000, or its information-security-specific companion ISO/IEC 27005, can inform that method.
More practitioner guides in the Aegentra Insights library.