This ISO 31000 ISO 27005 risk management course: Integrated Risk & Resilience Lead Manager prepares professionals to lead integrated risk and resilience programmes focused on decision-making, governance and evidence. It integrates ISO 31000 and ISO/IEC 27005, with practical application and defensible outputs for management and audit.
Quick Access: Introduction· Why this course exists· What this course enables· Frameworks and standards· Value· Objectives· Target audience· Prerequisites· Programme· Exam & Certification· Other information· Benefits· Logistics· FAQs· Registration
Upcoming dates
Confirmed dates.
Synchronous, live training. Interaction with the trainer and the group.
Live Online • next edition
Live Online • base price
Language: available in PT or ENG
Training: advanced and applied
Exam: 3h
EXCELLENCE AND LEADERSHIP LEVEL — proven authority, decision-making and risk governance in a real context
Why this course exists
To enable professionals to integrate risk into governance and decision-making, reducing strategic surprise and strengthening operational and technological resilience.
Many organisations manage risk because they record risks, but remain vulnerable when they need to decide under pressure, justify trade-offs, align risk with strategy, or demonstrate control and accountability to senior management, audit and regulators.
The ISO 31000 ISO 27005 risk management course: Integrated Risk & Resilience Lead Manager exists to transform Enterprise Risk Management (ERM) and information security/cyber risk (ISRM) into an integrated programme that is operational and defensible, linking risk → criteria → decisions → treatment → control → resilience → monitoring and continuous improvement.
What this course enables you to do
Govern
Define governance, responsibilities and decision-making authorities, integrating risk into strategy and operations.
Assess and prioritise
Identify, analyse and assess strategic, operational and technological risks using consistent and comparable criteria.
Treat and accept
Decide on treatment options, accept residual risk with appropriate authority and document defensible evidence.
Evidence
Produce KRIs, executive reporting and decision records aligned with governance, audit and continuous improvement.
Frameworks, standards and best practices addressed throughout the course
ISO 31073 / ISO Guide 73 (terminology)
ISO/IEC 27005 (Information Security & Cyber Risk / ISRM)
IEC 31010 (risk assessment techniques, where applicable)
ERM + ISRM integration (strategic, operational and technological risks)
Risk → Treatment → Control (justification and evidence)
Organisational resilience and critical dependencies
KRIs, executive reporting and residual risk decision-making
Value for the organisation
- Integrates strategic, operational and technological risk into a single governance and decision-making model.
- Reduces reactive decisions and operational “surprise” by clarifying criteria, risk appetite/tolerance and formal acceptance authorities.
- Improves the consistency of risk assessment and the quality of treatment decisions and residual risk acceptance.
- Strengthens the link between risk, controls and resilience, increasing capacity to absorb, adapt and recover.
- Produces defensible evidence (records, metrics and reporting) that is useful for management, audit and accountability.
Introduction
The ISO 31000 ISO 27005 risk management course: Integrated Risk & Resilience Lead Manager integrates ERM and security/cyber risk into an operational and defensible model. It is an advanced and applied integrated risk management course designed for professionals who intend to lead ERM programmes (ISO 31000) and consistently integrate information security and cybersecurity risk (ISO/IEC 27005).
In a context of uncertainty, technological dependence and regulatory pressure, this course prepares participants to act with executive maturity: define governance, establish criteria, conduct assessment, decide on treatment and acceptance, relate risk to controls and resilience, and sustain the programme with monitoring and reporting.
The methodology follows a practical approach, with progressive application and a focus on reusable outputs, supported by study and decision simulations.
This course prepares participants for the Certified Integrated Risk & Resilience personal certification, with progression by levels (Manager / Lead Manager), in accordance with a scheme aligned with ISO/IEC 17024.
This Training Plan and all associated documents are protected by Copyright and registered as a literary work with IGAC.
General Objectives
At the end of this course, participants will be able to:
- Understand and apply the principles, framework and process of risk management according to ISO 31000.
- Integrate information security and cybersecurity risk management according to ISO/IEC 27005.
- Define governance, responsibilities, risk owners and decision/acceptance authorities.
- Define scope, context and criteria, including risk appetite and tolerance.
- Identify, analyse, assess and prioritise strategic, operational and technological risks.
- Decide on treatment options and accept residual risk in a reasoned and documented manner.
- Relate risk to controls and to organisational resilience capabilities.
- Define KRIs, monitoring, executive reporting and continuous improvement of the risk programme.
Target Audience
- Risk managers and Enterprise Risk Management (ERM) professionals.
- Professionals responsible for governance, compliance and internal control.
- Information security and cybersecurity professionals (ISRM).
- Professionals responsible for business continuity and organisational resilience.
- Directors, middle management and senior management with decision-making responsibilities.
- Consultants and professionals involved in integrated risk and resilience programmes.
Prerequisites
There are no mandatory formal prerequisites. However, professional experience in an organisational context (any management/technology/compliance function) and exposure to governance, risk management, compliance and information security topics are recommended.
In addition, other specific requirements may apply, where relevant, depending on the quotation/proposal presented (please consult the proposal).
Programme
Risk Management Fundamentals (ISO 31000 and ISO/IEC 27005)
Governance, Organisational Context and Risk Criteria
Risk Identification, Analysis, Assessment and Prioritisation
Risk Treatment and Residual Risk Acceptance
Risk, Controls and Organisational Resilience
Monitoring, KRIs and Executive Reporting
Decision-Making, Continuous Improvement and Certification Preparation
Exam(s) and Certification
Exam “Certified Integrated Risk & Resilience”
The exam covers the following competence domains:
- Domain 1: Fundamentals, terminology and ERM + ISRM integration
- Domain 2: Governance, context, criteria, appetite and tolerance
- Domain 3: Risk assessment (identification, analysis, assessment and prioritisation)
- Domain 4: Treatment, controls, resilience and residual risk
- Domain 5: Monitoring, KRIs, reporting and continuous improvement
Language(s): Portuguese and English (please consult BEHAVIOUR regarding availability in other languages).
Duration: 3 hours.
Format: Open-ended questions based on a case study and related to the competence domains.
Pass mark: 700/1000 points.
Results: “Pass or Fail”.
Issuing entity: Behaviour (legal entity), through its certification service Behaviour Certification Services.
Retake: 1 free retake within a maximum period of 2 months after the date on which the exam result is made available.
Certification
After passing the exam, the candidate may apply for one of the levels according to experience:
- Certified Integrated Risk & Resilience Manager: no prior professional experience is required.
- Certified Integrated Risk & Resilience Lead Manager: 3 years in relevant risk/governance/security/resilience roles.
A Certificate and a Digital Certification Badge (i.e., “badge”) will be issued to participants who successfully complete the certification exam and satisfy all requirements of the certification for which they are applying. Certification is issued by Behaviour (legal entity), through its certification service Behaviour Certification Services.
Behaviour® professional certification (own scheme), with international recognition in the market. The scheme is designed and operated based on good practices for personal certification, principles of impartiality and exam quality, and applicable international references (including the principles of ISO/IEC 17024).
Certification programmes are valid only for individuals (not companies), and the award and maintenance of certification depend on the exam result, professional experience and compliance with the applicable agreement/Code of Ethics.
If the professional does not comply with the agreement/Code of Ethics, certification is not granted or is revoked.
Other Information
General Information
- Training available in Portuguese or English.
- Online training materials in Portuguese or English, with online access, in accordance with the awarded conditions.
- Practical and applied methodology, with exercises and reusable outputs.
- Behaviour digital Training Attendance Certificate with 40 CPD/CPE credits.
- Online Certification Exam, in Portuguese or English. The exam may be taken up to 2 months from the course start date.
- If the candidate does not pass the exam, they are entitled to one free retake within a maximum period of 2 months from the release date of the initial exam result.
- Digital Certification Diploma and Digital Certification Badge after successfully passing the exam and completing the application process. This process has no associated cost.
Trainer(s)
Benefits
View benefits
- Real integration between ERM (ISO 31000) and ISRM (ISO/IEC 27005).
- Practical ability to define criteria, prioritise and decide on residual risk with evidence.
- Direct connection between risk, controls and organisational resilience (critical dependencies and recovery capability).
- Improved executive reporting and communication of risk to senior management.
- Preparation for Behaviour certification with progression by levels (Manager / Lead Manager).
Logistics
Useful information
- Live Online (synchronous time): 09h30–13h00 and 14h00–17h30 (Lisbon time), with short breaks
- Classroom (synchronous time): 09h30–13h00 and 14h00–17h30 (Lisbon time), with short breaks
- 28 hours of synchronous training, distributed across 4 consecutive days
- Estimated 12 hours of guided autonomous work, intended for content consolidation and exam preparation, carried out flexibly outside the synchronous sessions
- Requirements: computer with stable internet, browser, PDF reader, audio/video
Hotels in Lisbon
Frequently Asked Questions
Objective answers to the most common questions about the ISO 31000 ISO 27005 risk management course: Integrated Risk & Resilience Lead Manager.
What distinguishes this course from training focused only on risk management or only on cybersecurity?
What kind of practical outputs can participants expect throughout the training?
Is this course suitable for multidisciplinary teams that need to work on risk and resilience together?
At what stage of organisational maturity does this course tend to generate more value?
Does this course help improve the quality of executive decision-making on risk?
For general questions about registration, delivery modes, exams, certification and recertification, please consult the BEHAVIOUR® FAQs.
Registration
Complete the form to request your registration for the preferred edition. Check the upcoming dates.
Request more information
If you would like help to frame the course within your professional or organisational context, contact us and we will indicate the most suitable path.
Request Information
Companies: request a proposal
For team registrations, we provide volume conditions and a proposal tailored to the organisational need.
Request Proposal