PECB ISO/IEC 27005 Lead Risk Manager Training: Lead Information Security Risk Management
This five-day course equips you to build and run an information security risk management programme based on ISO/IEC 27005:2022 and ISO 31000. Beyond the standard, a full day compares recognized assessment methods such as OCTAVE, MEHARI, EBIOS and Harmonized TRA. The Lead Risk Manager exam takes place on day five.
The essentials
Publisher : PECB
Certification : PECB Certified ISO/IEC 27005 Lead Risk Manager
Duration : 5 days, exam included on day 5 (31 CPD credits)
Level : Advanced
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : 80 multiple-choice questions · 3 h · open book · 70% to pass
Exam voucher : Official PECB offer: exam and certification fees are included, plus one free exam retake within 12 months if you do not pass the first time.
Explain the risk management concepts of ISO/IEC 27005 and ISO 31000.
Set up and maintain an information security risk management framework.
Identify, analyse and evaluate risks, including with quantitative approaches.
Choose treatment options and formalize risk acceptance.
Organize risk communication, consultation, monitoring and review.
Compare several assessment methods and pick the one that suits the organization.
Program
Day 1 – ISO/IEC 27005 and risk management
Standards and reference frameworks
Risk concepts
Setting up the programme
Establishing the context
Day 2 – Assessment and treatment
Risk identification, analysis and evaluation
Quantitative methods
Treatment strategies
Day 3 – Acceptance, communication and follow-up
Risk acceptance
Communication and consultation
Recording and reporting
Monitoring and review
Day 4 – Risk assessment methods
OCTAVE
MEHARI
EBIOS
Harmonized TRA
Day 5 – Certification exam
Three-hour PECB exam
Prerequisites
A basic understanding of ISO/IEC 27005.
Solid knowledge of risk management and information security, as PECB specifies.
Target audience
Information security managers and ISMS professionals
Risk owners and risk managers
IT professionals and privacy officers
Project managers and consultants who advise on risk
The exam
The three-hour exam takes place on day five, online with remote proctoring via the PECB Exams app or on paper through a partner. According to the 2026 candidate handbook it has 80 multiple-choice questions over six domains; risk assessment accounts for 20 and assessment methods for 15. It is open book and you need 70%. Depending on your experience, you then hold Provisional Risk Manager, Lead Risk Manager (five years' experience including two in risk management, 300 hours) or Senior Lead Risk Manager. Certification is valid for three years, with CPD and an annual maintenance fee.
Preparation tips
Risk assessment is the heaviest domain: practise going from a scenario to a justified risk level.
Build a comparison sheet of the four day-four methods: strengths, limits, when to use them.
Tab ISO/IEC 27005 by process step so you can find the right section quickly.
Frequently asked questions (FAQ)
What is the difference between Risk Manager and Lead Risk Manager?
Risk Manager (three days) covers the ISO/IEC 27005 process. Lead Risk Manager (five days) goes further: running a full programme, quantitative methods and comparing recognized methods.
Does the course cover EBIOS Risk Manager?
EBIOS is one of the methods presented on day four, alongside others. For in-depth mastery of the method itself, a dedicated course is a better fit.
Do I need an ISO 27001 ISMS to apply ISO 27005?
No. ISO/IEC 27005 is often used to meet ISO/IEC 27001 risk requirements, but it also works outside any certification project.
What title do I get without experience?
Provisional Risk Manager. Lead Risk Manager requires five years' experience, two of them in risk management, and 300 hours of activity.
Can I take the course online or in Casablanca?
Both. We run it as a live online class, in person in Casablanca, or on-site at your organization, taught in French or English depending on the group. For on-site sessions we can adapt examples and case studies to your sector and schedule the exam with you.