Organisational Insider Risk Analyst
The Organisational Insider Risk Analyst is an advanced specialist credential for practitioners who apply structured behavioural frameworks to the identification, analysis, and management of insider risk within organisational contexts. OIRA is offered at Level II (Specialist) only, reflecting the substantive professional experience required to practise competently in this domain.
OIRA is available at Level II (Specialist) only. Candidates are required to demonstrate substantive professional experience in security risk, HR risk, or closely related functions, and must meet the documented eligibility criteria before examination. OIRA credentials are professional development qualifications and do not confer government authority of any kind.
Credential Overview
Insider risk — the risk posed to an organisation by individuals with legitimate access, whether through malicious intent, negligence, or external compromise — is a recognised and substantive challenge for organisations across sectors. OIRA addresses the professional competency required to apply structured behavioural frameworks to this challenge systematically, ethically, and within an evidence-informed methodology.
The OIRA is not a credential in surveillance, counterintelligence, or security investigations of government personnel. It addresses private sector and organisational insider risk management: the analysis of behavioural indicators within a structured multi-disciplinary programme, the design and governance of insider risk frameworks, and the ethical and legal responsibilities of practitioners who undertake this function.
OIRA is positioned as an advanced credential reflecting the seniority of practitioners who typically lead or advise on insider risk programmes. The Level II minimum is a floor, not a ceiling: OIRA candidates are generally experienced security managers, HR risk professionals, or corporate intelligence practitioners who bring substantive domain knowledge and require a formal credential to represent their behavioural science competency within this specific function.
Candidate Profile
OIRA candidates are typically senior practitioners with existing professional responsibility for security risk, human factors risk, or related organisational risk management functions. The credential provides formal recognition of competency in the behavioural science dimensions of this work.
- Security managers with portfolio responsibility for insider risk, personnel security, or organisational security behaviour
- HR risk professionals leading or contributing to insider risk programmes within people management functions
- Insider threat programme leads responsible for design, governance, and operation of organisational insider risk frameworks
- Corporate intelligence practitioners supporting organisational risk analysis with behavioural assessment components
- Compliance officers with substantive security responsibility in regulated sectors including financial services and critical infrastructure
- Security consultants advising organisations on insider risk programme design and governance
- Risk analysts in organisations implementing formal insider risk management frameworks
OIRA is not appropriate for government intelligence personnel undertaking national security insider threat functions, or for practitioners in law enforcement roles conducting criminal investigations into insider activity under statutory authority. Such practitioners may pursue OIRA as a personal professional development credential subject to meeting the eligibility requirements.
Competency Framework
The OIRA competency framework reflects the specialist nature of the credential. Competencies address both the technical application of behavioural frameworks in insider risk contexts and the governance, ethical, and legal responsibilities of practitioners who operate in this sensitive domain.
Evidence-informed behavioural models applied to insider risk, including understanding of the academic literature on insider threat precursors, the limitations of behavioural prediction, and the appropriate scope of behavioural analysis in organisational settings.
Design, implementation, and governance of organisational insider risk programmes: scope, policy framework, stakeholder engagement, proportionality principles, and integration with broader security and HR functions.
Multi-disciplinary approaches to insider risk assessment: integrating behavioural, technical, and contextual indicators within structured assessment frameworks; team-based assessment processes; and the role of behavioural analysis within broader insider risk evidence.
The ethical and legal responsibilities of insider risk practitioners: privacy and data protection obligations, proportionality, informed policy frameworks, the rights of subjects, and the GIB Code of Ethics as applied to insider risk practice.
The role of organisational culture, management practices, and structural factors in insider risk: understanding the organisational and environmental precursors to insider risk behaviour alongside individual behavioural indicators.
Professional standards for insider risk reporting: communicating findings to senior management and governance bodies; advisory competency in sensitive risk contexts; and standards for documentation that appropriately qualifies the uncertainty in behavioural risk assessments.
Eligibility Requirements
OIRA eligibility reflects the advanced nature of the credential. GIB's Admissions Panel reviews all OIRA eligibility documentation and may request supplementary information where required to confirm eligibility. Eligibility is not assumed from job title alone; documented experience and demonstrated professional development in the domain are assessed.
- Minimum five years of relevant professional experience in a security risk, HR risk, corporate security, compliance, or closely related function
- At least two years of direct or substantive involvement in insider risk, personnel security, or organisational security behaviour as a component of professional responsibilities
- Active GIB credential in a relevant division (CSBA Level II, BAIC Level II, or GIB Division I or II credential), or equivalent prior learning reviewed and approved by the Admissions Panel at their discretion
- Professional development portfolio demonstrating OIRA competency development — portfolio guidance is provided following admissions confirmation
- Professional references from two individuals with direct knowledge of the candidate's insider risk or security risk practice
- Completion of a GIB-approved OIRA preparation programme or documented self-study against the OIRA competency framework
- Agreement to the GIB Code of Ethics and the additional conduct requirements applicable to OIRA credential holders
Candidates who are uncertain about their eligibility are encouraged to contact the GIB Admissions Office for an informal eligibility review before submitting a formal application. GIB does not charge for eligibility reviews at the enquiry stage.
Examination Structure
The OIRA examination is designed to assess applied specialist competency in organisational insider risk through both a formal examination and an assessed professional portfolio. Both components must reach the required standard for the credential to be awarded.
Given the sensitivity of insider risk practice, OIRA examination questions do not require candidates to disclose confidential case information. The portfolio uses structured anonymisation guidance to enable reflective case documentation without disclosure of organisational or individual identifying information. GIB Examination Board members who review OIRA portfolios are subject to confidentiality obligations.
Certification Process
OIRA has a more extended admissions and preparation pathway than entry-level credentials, reflecting the advanced nature of the examination and the portfolio requirements. Most candidates spend 8–14 months from initial enquiry to credential award.
Contact GIB Admissions to discuss your background and confirm that you are likely to meet the OIRA eligibility requirements before investing in the formal application process. This informal review is free and does not constitute a formal eligibility determination.
Submit the formal OIRA application including professional references, experience documentation, and evidence of any prerequisite GIB credential or equivalent. The Admissions Panel reviews all documentation and may request additional information. Eligibility decisions are communicated within 15 working days of receipt of complete documentation.
Following eligibility confirmation, candidates receive the OIRA candidate handbook, portfolio guidance, and preparation resources. Portfolio development typically takes 3–6 months alongside professional practice. GIB-approved training organisations offering OIRA programmes provide structured support through this phase.
Submit the completed portfolio to the GIB Examination Board and schedule your examination sitting. Portfolio review and examination scheduling run concurrently. A confirmed examination date will be allocated within the examination cycle following portfolio submission.
Sit the OIRA examination at a GIB-authorised centre. Results are communicated within 35 days, incorporating both the examination and portfolio assessments. Successful candidates receive the OIRA credential and are entered in the GIB public registry with the reference format GIB-YYYY-IR-XXXXXX.
Recertification
OIRA credentials are valid for two years. Recertification reflects the expectation that insider risk is a developing field and that practitioners maintain current knowledge of the evidence base and legal frameworks applicable to their practice.
- Completion of the GIB CPD log demonstrating relevant professional development including engagement with current insider risk research and legal developments over the credential period
- Recertification declaration confirming continued active practice in an insider risk or closely related role and continued compliance with the GIB Code of Ethics
- Submission of a brief reflective practice summary (OIRA-specific requirement, guidance provided at credential award)
- Payment of the applicable OIRA recertification fee