An organization cannot be ISO 31000 certified, because ISO says the standard is guidance and cannot be used for certification. A person can earn a PECB credential instead: a Foundation certificate, then Provisional Risk Manager, Risk Manager, Lead Risk Manager and Senior Lead Risk Manager.
The course price includes the exam, and the credential level depends on your experience.
Key takeaways
- ISO 31000 cannot be certified at organization level. PECB certifies individuals.
- There is a Foundation certificate and four professional credentials, separated by experience and project hours, from none to 10 years and 1,000 hours.
- Foundation takes two days, Risk Manager three and Lead Risk Manager four, each followed by the exam.
- PECB states that the certificate and exam fees are inside the course price, with one retake.
- Choose the course by your role and experience. The credential you hold follows your experience record.
The ISO 31000 credential levels
ISO 31000 describes how to manage risk, and ISO is clear that it is guidance that cannot be used for certification. That means no company can be "ISO 31000 certified". What you can earn is a personal credential. PECB certifies individuals, and its ISO 31000 page says the certification shows that holders understand the standard's principles and can apply them to build risk management frameworks and processes.
There is an entry certificate and four professional credentials. The professional ones are separated by experience, not by exam difficulty: how many years you have worked, how many of those in risk management, and how many hours you have spent on risk management projects.
| Credential | Professional experience | Risk management experience | Project hours |
|---|---|---|---|
| Foundation certificate | None | None | None |
| Provisional Risk Manager | None | None | None |
| Risk Manager | 2 years | 1 year | 200 hours |
| Lead Risk Manager | 5 years | 2 years | 300 hours |
| Senior Lead Risk Manager | 10 years | 7 years | 1,000 hours |
Every professional credential also requires signing the PECB Code of Ethics. The Foundation holder is called a PECB Certificate Holder in ISO 31000 Foundation. The Provisional Risk Manager credential is the route for people who pass the Risk Manager exam but do not yet have the experience. PECB sets which exam each level requires, so confirm the pairing on PECB's course page before you apply.
The three courses side by side
Three courses lead to these credentials. Each one includes the exam, and each carries continuing professional development credits.
| Feature | Foundation | Risk Manager | Lead Risk Manager |
|---|---|---|---|
| Length | 2 days | 3 days plus the exam | 4 days plus the exam |
| Built for | People new to ISO 31000 risk concepts, and those considering a risk career | Managers and consultants responsible for managing risk, and people who want to learn the principles, framework and process | Managers and consultants who implement risk management programs, project managers and advisers, and people responsible for risk management processes |
| What you learn to do | Summarize the core concepts, explain how a framework is established and describe how the process is applied | Explain the concepts, establish and improve a framework, and implement the process | All of those, plus initiating and planning the implementation of the process and applying best practices |
| Prerequisite | None | A working knowledge of ISO 31000 and of risk management | A fundamental understanding of the risk management framework, process and principles |
| Credential | PECB Certificate Holder in ISO 31000 Foundation | Provisional Risk Manager, or Risk Manager with the experience | Lead Risk Manager, or Senior Lead with the experience |
| CPD credits | 14 | 21 | 31 |
Each course ends with the certification exam, and PECB says the quizzes inside the course are structured like it. The course agendas also scale. Foundation covers the concepts, the framework and the process in two days. Risk Manager spends its three days on the framework, the process, assessment, treatment, and recording, reporting and review. Lead Risk Manager adds a day, which gives risk analysis, evaluation and treatment a full day of their own. The detail behind each is in what the Risk Manager certification is and what the Lead Risk Manager certification is, and the length and domains of the Risk Manager exam are in exam duration and format.
Risk Manager or Lead Risk Manager?
This is the question people ask most after the basics. The courses overlap heavily, so the choice usually comes down to two things: how much experience you have, and what you will be doing with the credential.
| If this describes you | Take | Why |
|---|---|---|
| You are early in your career and want the credential first | Risk Manager | You can sit the exam and hold Provisional Risk Manager until you build the experience |
| You carry out risk assessments and treatment for a team or project | Risk Manager | The course is built around implementing the process |
| You run the risk program, advise several teams or lead risk work with consultants | Lead Risk Manager | It is aimed at people who initiate, plan and lead the implementation |
| You have about five years of experience, two in risk management, and 300 project hours | Lead Risk Manager | Those are the requirements for the Lead credential |
| You are not sure you know the basics | Foundation first | It has no prerequisites and leads into both |
One practical point. The credential you hold depends on your experience record, not on which course you took. A person with ten years in risk management who takes Risk Manager still has to meet the Lead and Senior Lead requirements through experience and hours. Taking Lead Risk Manager gives a better fit for the work, and it carries the extra training day. The experience rules are set out in do you need experience for the ISO 31000 exam, and what the Lead course itself asks of you is in Lead Risk Manager prerequisites.
The path to certification, step by step
The route is the same for every level. Only the course and the experience record change.
| Step | What you do | Where to look |
|---|---|---|
| 1. Understand the standard | Read how the principles, framework and process fit together | The ISO 31000 guide |
| 2. Compare the neighbors | See how ISO 31000 sits next to COSO ERM, NIST and ISO/IEC 27005 | ISO 31000 vs COSO ERM, NIST and ISO/IEC 27005 |
| 3. Choose the level | Match your experience and role to Foundation, Risk Manager or Lead Risk Manager | The tables above |
| 4. Take the course | Self-study, eLearning or live online, at your own pace or with a trainer | The course page |
| 5. Sit the exam | Taken after the training; the fee covers a first attempt and one retake | PECB's course page |
| 6. Apply for the credential | Sign the PECB Code of Ethics and show the experience for the level you want | PECB |
The Foundation certificate and the Provisional Risk Manager credential need no experience record, which makes them the practical start for career changers and graduates.
What ISO 31000 certification costs
The search for "ISO 31000 certification cost" has an odd answer, because the price is for the course, not the credential. PECB states that the certificate and examination fees are included in the course price, and that the fee covers one first attempt and one retake when the course is taken through a PECB partner, with the free retake used within 12 months of completing the course.
At the time of writing, reconn's English prices are below. They are in US dollars, before local VAT, and offers change them, so treat the course page as the final word.
| Course | Delivery | Price in USD, before local VAT |
|---|---|---|
| ISO 31000 Foundation | Self-study | $299 |
| ISO 31000 Risk Manager | eLearning | $449 |
| ISO 31000 Lead Risk Manager | Self-study | $599 |
Compare like with like when you price courses. Ask what the fee includes: the exam, the retake, the certificate, and what support you get if you are stuck. At reconn, every enrollment includes a free 1-on-1 session with a PECB Certified Trainer and email and WhatsApp support until you clear the exam, within 12 months of enrollment. That is support, not a pass guarantee.
Building a risk management career around the credential
A credential opens the conversation. What carries a risk career is the skills and the record of work behind it. PECB's pages say the certification helps people stand out and move into risk management, governance or compliance roles. Here is what to build alongside it.
| Skill | How to build it | Where ISO 31000 uses it |
|---|---|---|
| Setting risk criteria before scoring | Practice on real decisions: projects, suppliers, launches | Establishing scope, context and criteria |
| Facilitating risk workshops | Run sessions with the people who own the objectives | Communication and consultation; risk identification |
| Writing treatment plans that people act on | Own the follow-through, not just the register | Risk treatment |
| Reporting to decision makers | Turn the register into one page a manager can use | Recording and reporting |
| Connecting risk to strategy | Learn how enterprise approaches such as COSO ERM frame it | Integration into governance and strategy |
Specialize as you go. If your work is information security, ISO/IEC 27005 applies ISO 31000 to that field (and ISO 31000 vs ISO 27001 explains how the two standards differ), and reconn offers the PECB ISO/IEC 27005 Risk Manager course. If your work is enterprise risk, the comparison with COSO ERM and NIST shows where each framework fits.
Common mistakes when choosing a certification
The first is looking for an organization-level certificate. ISO 31000 does not offer one (see is ISO 31000 mandatory for the wider question of whether you must use it at all), so anyone selling "ISO 31000 certification" for a company is describing something else, such as a consultant's attestation. The second is buying the highest level without checking the experience you can show, then holding a lower credential than expected. The third is comparing course prices without checking whether the exam and retake are inside the fee. The fourth is treating exam preparation as a hunt for leaked questions. Use the course, its quizzes and the standard itself. The credential is only worth something if you can do the work.
Frequently asked questions
Can you get ISO 31000 certified?
An organization cannot. ISO says ISO 31000 is guidance and cannot be used for certification. A person can earn a PECB ISO 31000 credential instead, which shows that they understand the principles and can apply them to build a risk management framework and process. The levels run from Foundation to Senior Lead Risk Manager.
What are the ISO 31000 certification levels?
PECB offers an ISO 31000 Foundation certificate, which needs no experience, and four professional credentials: Provisional Risk Manager, Risk Manager, Lead Risk Manager and Senior Lead Risk Manager. The professional credentials differ in the years of experience and project hours they require, from none for Provisional to 10 years and 1,000 hours for Senior Lead.
How much does ISO 31000 certification cost?
At the time of writing, reconn's English prices are $299 for Foundation (self-study), $449 for Risk Manager (eLearning) and $599 for Lead Risk Manager (self-study), before local VAT. PECB states that the certificate and exam fees are included in the course price. Prices and offers change, so confirm the amount on the course page.
Is the ISO 31000 exam included in the course price?
Yes. According to PECB, the certificate and examination fees are included in the course price. The fee covers a first attempt and one retake, and for courses taken through a PECB partner, the free retake must be used within 12 months of completing the course.
What is the difference between ISO 31000 Risk Manager and Lead Risk Manager?
Risk Manager is a three-day course built around implementing the ISO 31000 risk management process. Lead Risk Manager is a four-day course with an extra day, so risk analysis, evaluation and treatment get a full day of their own, and it is aimed at people who will lead the work. Both end with an exam, and the Lead credential requires more experience: five years of professional experience, two in risk management, and 300 project hours.
Do I need experience to take an ISO 31000 course?
Not for Foundation, which has no prerequisites and no experience requirement. Risk Manager and Lead Risk Manager list a working knowledge of risk management and of ISO 31000 as a prerequisite. You can sit the Risk Manager exam without the experience and earn the Provisional Risk Manager credential, which has no experience requirement.
How long does it take to get ISO 31000 certified?
The courses run two days for Foundation, three for Risk Manager and four for Lead Risk Manager, with the exam after the training. Self-study and eLearning let you set your own pace, so the calendar time depends on how many hours you can give each week.
Which ISO 31000 certification is best for a risk management career?
There is no single best one, because the credentials form a ladder. Foundation suits people starting out. Risk Manager and Lead Risk Manager suit people who will run or lead the risk management process. Your experience decides which professional credential you hold, so the practical step is to take the course that matches your current role.
How do I become a risk manager with no experience?
Start with the ISO 31000 Foundation certificate, then take the Risk Manager course and sit its exam. With no professional experience you would hold the Provisional Risk Manager credential. Then build experience and project hours, and move up to Risk Manager and Lead Risk Manager as you meet the requirements.