Advanced Enterprise Risk Management Training Course

Duration 10 days 20 modules · 65 contact hours
Level Advanced Certificate on completion
Who attends Enterprise Risk Managers, Risk Analytics Managers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-RM-040

Before you join: Participants should have practical experience in risk management, finance, treasury, internal audit, compliance, data analysis or business control.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Enterprise risk management teams must turn scattered financial, operational and strategic risk information into decisions that boards and executives can act on. This requires more than a risk register: teams need defined taxonomies, risk appetite measures, reliable data, repeatable calculations, scenario analysis, escalation routes and reports that connect exposure to capital, liquidity, controls and business decisions. Failures in any of these areas can leave material concentrations, model weaknesses or control breakdowns hidden until losses occur.

This advanced course develops the methods used to design, operate and improve an enterprise risk management function supported by risk analytics. Participants work with COSO ERM, ISO 31000, BCBS 239 principles, Basel III measures and SAS Risk Management concepts. They build risk taxonomies, appetite statements, key risk indicators, assessment methods, data lineage records, stress scenarios, aggregation models and executive reporting. Credit, market, liquidity, operational, cyber, third-party, climate and emerging risks are examined through realistic banking, public-sector and corporate cases.

Instruction combines focused briefings, worked calculations, facilitated case analysis, group design work, simulations and individual application planning. Participants progressively assemble an enterprise risk pack from the first week, then deepen its analytics, governance, reporting and implementation components during the second week. The final capstone requires participants to build, review and present a complete risk profile, supported by data controls, stress results, treatment plans and an executive dashboard. Participants receive a certificate of completion after the 10-day programme.

The course is particularly suited to experienced risk, finance, treasury, audit, compliance, data and control professionals who contribute to risk reporting, governance or risk system implementation.

What you will be able to do

  • Design an enterprise risk taxonomy, governance structure and risk ownership model
  • Construct risk appetite statements, limits, triggers and key risk indicators
  • Build traceable risk data lineage, quality controls and aggregation hierarchies
  • Apply credit, market, liquidity and operational risk measurement techniques
  • Develop scenario analysis, reverse stress testing and Monte Carlo risk estimates
  • Configure SAS Risk Management workflow concepts, calculation rules and access roles
  • Produce executive risk dashboards, committee papers and escalation reports
  • Present a complete enterprise risk profile with treatment plans and implementation priorities

Benefits of attending

For you

  • Produce board-ready risk appetite metrics and escalation thresholds
  • Evaluate risk data quality using lineage, reconciliation and control evidence
  • Build stress scenarios that link risk drivers to management decisions
  • Challenge risk models, assumptions and aggregation methods with greater confidence
  • Lead risk reporting and implementation discussions with finance, technology and senior management

For your organisation

  • More consistent risk classification, ownership and assessment across business units
  • Earlier identification of appetite breaches, concentrations and control failures
  • Improved traceability from source data to executive risk reports
  • Better evidence for board oversight, audit review and regulatory examination
  • Clearer prioritisation of risk treatments, capital actions and contingency plans

Course modules

20 modules over 10 days

Participants can establish an enterprise risk governance model with clear ownership, escalation and assurance responsibilities.

  • COSO ERM principles translated into risk appetite, governance and reporting requirements
  • ISO 31000 risk process mapped to decision rights and controls
  • Three-lines model assigned to ownership, challenge and independent assurance
  • Board risk committee charters linked to escalation thresholds and information needs
  • Risk taxonomy design separating financial, non-financial, strategic and emerging risks
  • Materiality criteria calibrated using impact, velocity, persistence and interconnectedness

Participants can define the data structures, lineage and quality controls required for enterprise risk reporting.

  • Risk data aggregation principles aligned with BCBS 239 reporting expectations
  • SAS Risk Management data model concepts: entities, hierarchies, measures and attributes
  • Source-to-report data lineage documented from transactional systems through risk outputs
  • Data quality rules defined for completeness, accuracy, timeliness and reconciliation
  • Reference data hierarchies maintained for legal entities, products and counterparties
  • Control totals and exception logs used to evidence data reliability

Participants can identify material risks and create a usable enterprise risk taxonomy.

  • Risk identification workshops combine strategic objectives, processes and external drivers
  • Cause-event-impact statements distinguish risk sources from consequences and controls
  • Risk taxonomy levels align enterprise categories with business-unit assessments
  • Risk inventories capture existing exposures, emerging threats and control dependencies
  • Interviews and document reviews test completeness of reported risk populations
  • Connected risks mapped through common causes, dependencies and transmission channels

Participants can design risk appetite measures and monitoring thresholds linked to management action.

  • Risk appetite statements expressed through limits, targets, triggers and tolerances
  • Threshold calibration uses capacity, strategy, capital and stakeholder commitments
  • Key risk indicators connected to drivers, thresholds, owners and response actions
  • Leading and lagging indicators distinguished through causal risk-driver analysis
  • Limit breaches routed through escalation matrices and documented acceptance authorities
  • Risk appetite dashboards reconcile board metrics with operational indicator detail

Participants can assess inherent and residual risks and specify proportionate treatment plans.

  • Inherent risk assessments separate exposure before controls from residual exposure
  • Control design reviews test preventive, detective, corrective and recovery measures
  • Risk treatment plans compare avoidance, reduction, transfer, acceptance and sharing
  • Residual risk acceptance documents authority, duration, rationale and monitoring conditions
  • Issue registers track remediation milestones, dependencies, evidence and overdue actions
  • Control effectiveness ratings distinguish design weaknesses from operating failures

Participants can select and apply appropriate qualitative and quantitative risk measurement methods.

  • Inherent and residual risk scoring uses defined scales and evidence rules
  • Likelihood-impact matrices tested for ordinal-scale distortions and false precision
  • Expected loss estimates combine probability, exposure and loss-given-event assumptions
  • Monte Carlo simulation estimates distributions where deterministic scoring is insufficient
  • Bow-tie analysis links threats, preventive controls, recovery controls and consequences
  • Risk velocity and persistence measures prioritise rapidly compounding exposures

Participants can specify workflow, calculation and permission requirements for a risk management system.

  • SAS Risk Management object model relates risks, controls, issues and indicators
  • Workflow stages assign assessment, review, approval and remediation responsibilities
  • Questionnaire design captures consistent self-assessment evidence from business units
  • Calculation rules transform source measures into risk scores and alerts
  • Version control preserves approved taxonomies, thresholds and assessment histories
  • Role-based access separates preparers, reviewers, approvers and report consumers

Participants can produce risk reports that support executive oversight and timely intervention.

  • Executive dashboards present appetite status, top exposures, trends and breaches
  • Drill-down paths trace aggregate indicators to entity, product and source data
  • Heat maps use consistent scales, legends and treatment of uncertainty
  • Exception reporting highlights overdue actions, data failures and control breakdowns
  • Reporting calendars align operational monitoring with committee and board cycles
  • Management narratives distinguish observed facts, assumptions, judgements and proposed actions

Participants can assess credit risk drivers, expected loss and portfolio concentration exposures.

  • Credit risk portfolio segmentation separates obligors, facilities, sectors and grades
  • Probability of default models connect rating migration to expected loss
  • Exposure at default incorporates utilisation, collateral and contingent commitments
  • Loss given default assumptions reflect recoveries, seniority and collateral haircuts
  • Concentration analysis tests single-name, sector, geography and connected-counterparty exposures
  • Credit migration matrices project rating changes under baseline and stress conditions

Participants can interpret market risk measures, model limitations and limit breaches.

  • Value at Risk calculated using historical, parametric and Monte Carlo methods
  • Expected shortfall captures tail losses beyond a stated confidence level
  • Backtesting compares daily profit-and-loss outcomes against Value at Risk estimates
  • Sensitivity measures isolate rate, foreign-exchange, equity and commodity risk drivers
  • Stressed Value at Risk applies crisis-period observations to current portfolios
  • Limit structures connect desk exposures to market risk appetite thresholds

Participants can assess liquidity exposures and design funding risk monitoring and escalation measures.

  • Liquidity risk maps contractual cash flows by maturity bucket and currency
  • Behavioural assumptions distinguish stable deposits from rate-sensitive funding sources
  • Liquidity coverage ratio components link high-quality assets to stressed outflows
  • Net stable funding ratio assesses structural funding over one year
  • Contingency funding plans specify triggers, actions, owners and communication routes
  • Intraday liquidity indicators monitor payment obligations, buffers and concentration points

Participants can assess non-financial risk exposures using control, loss and scenario evidence.

  • Risk and control self-assessments identify process failures and control gaps
  • Loss event taxonomies classify frequency, severity, root cause and recoveries
  • Scenario analysis estimates severe operational losses beyond observed event data
  • Third-party risk assessments evaluate concentration, service criticality and exit readiness
  • Cyber risk indicators track vulnerabilities, patching, privileged access and incidents
  • Business continuity dependencies connect critical services, recovery objectives and tolerances

Participants can design stress tests that translate severe events into actionable management decisions.

  • Scenario narratives specify drivers, transmission channels, assumptions and management actions
  • Reverse stress testing identifies conditions that make the business model unviable
  • Multi-factor shocks combine macroeconomic, market, operational and liquidity variables
  • Scenario severity is calibrated against historical episodes and forward-looking judgements
  • Management overlays document rationale where models omit material emerging risks
  • Stress results translate into capital, liquidity, limits and contingency decisions

Participants can aggregate risk exposures while testing correlation, concentration and parameter assumptions.

  • Correlation matrices reveal diversification assumptions and hidden concentration effects
  • Copula methods model joint tail dependence between correlated risk factors
  • Monte Carlo engines generate portfolio loss distributions from parameterised assumptions
  • Parameter uncertainty is tested through sensitivity ranges and challenger estimates
  • Risk contribution analysis attributes aggregate exposure to business units and drivers
  • Aggregation rules prevent double counting between related scenario and loss measures

Participants can assess long-term and emerging risks without overstating uncertain evidence.

  • Emerging risk scans record weak signals, triggers, ownership and monitoring dates
  • Climate scenario analysis separates physical, transition and liability risk channels
  • Time horizons distinguish immediate exposures from long-duration strategic uncertainties
  • Risk interdependencies map contagion paths, feedback loops and common-cause failures
  • Horizon scanning outputs feed taxonomy updates, appetite reviews and scenario design
  • Qualitative uncertainty statements prevent false numerical certainty in emerging risk reports

Participants can establish model governance and challenge analytical models used in risk decisions.

  • Model inventory records purpose, owner, inputs, outputs, limitations and use
  • Model risk classification considers materiality, complexity, automation and decision impact
  • Independent validation tests conceptual soundness, data quality and outcome performance
  • Benchmark models challenge key assumptions, parameters and implementation choices
  • Backtesting exceptions trigger investigation, recalibration, approval and documented remediation
  • Change control governs model releases, emergency fixes and retirement decisions

Participants can assess whether risk data supports accurate, timely and traceable decision-making.

  • BCBS 239 principles guide accuracy, completeness, timeliness and adaptability assessments
  • Entity hierarchies support risk aggregation through legal, management and exposure views
  • Data lineage diagrams identify transformations, controls, handoffs and accountable owners
  • Reconciliation routines compare risk outputs with finance, treasury and source records
  • Data quality scorecards prioritise critical elements, defects, ageing and remediation
  • Metadata registers define business terms, calculation logic and authorised sources

Participants can convert risk analysis into decisions, treatment actions and effective executive communications.

  • Risk-adjusted performance measures connect returns, capital consumption and downside exposure
  • Capital allocation methods compare economic capital, regulatory capital and limits
  • Risk treatment options assess avoid, accept, reduce, transfer and share responses
  • Action plans define milestones, funding, residual exposure and accountable executives
  • Committee papers present decisions required, alternatives, implications and recommended actions
  • Escalation protocols distinguish limit breaches, control failures and emerging threats

Participants can plan a controlled implementation or improvement programme for enterprise risk management.

  • Target operating model defines processes, roles, data flows and governance forums
  • Risk management implementation roadmap sequences quick wins, dependencies and control gates
  • Requirements traceability links policy obligations to data, calculations and reports
  • User acceptance criteria test workflows, calculations, permissions and report outputs
  • Control testing plans sample evidence, assess design and verify operating effectiveness
  • Post-implementation reviews measure adoption, exceptions, benefits and unresolved risks

Participants can build, review and present a complete enterprise risk profile for executive decision-making.

  • Risk profile integrates taxonomy, appetite, assessment results and material exposures
  • Data lineage and quality controls substantiate reported indicators and calculations
  • Scenario and stress results quantify downside under stated assumptions
  • Treatment plans assign owners, milestones, budgets and residual risk decisions
  • Executive dashboard highlights breaches, trends, concentrations and decisions required
  • Peer review challenges evidence, assumptions, control design and reporting clarity

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Enterprise risk taxonomy template
  2. Risk appetite and key risk indicator library
  3. Risk data lineage and quality-control checklist
  4. Stress-testing scenario design model
  5. Executive risk dashboard specification
  6. Enterprise risk implementation roadmap

Who should attend

  • Enterprise Risk Managers — need to strengthen risk governance, measurement and reporting
  • Risk Analytics Managers — need to translate risk data into repeatable analytical outputs
  • Chief Risk Office Specialists — need consistent methods for appetite, aggregation and escalation
  • Treasury and Finance Managers — need to connect capital, liquidity and risk decisions
  • Internal Audit Managers — need to assess risk governance, data controls and model oversight
  • Risk Technology Leads — need to design workflows, data structures and reporting requirements

Skills and tools covered

Enterprise risk governanceRisk appetite designRisk data managementStress testingRisk aggregationExecutive risk reporting

Tools and standards

COSO Enterprise Risk Management Framework, ISO 31000:2018, BCBS 239, SAS Risk Management

How the course runs

Training methodology

The course uses short technical briefings followed by sector-based case work, group design tasks, facilitated calculations and reporting simulations. Participants analyse risk data structures, appetite breaches, stress scenarios, loss events and control evidence drawn from banking, corporate and public-sector settings. Trainers demonstrate SAS Risk Management workflow and reporting concepts without treating the programme as software administration training. Each participant develops an application plan and progressively builds components of an enterprise risk pack, receiving structured peer and instructor feedback before the capstone presentation.

Requirements and prerequisites

Participants should have practical experience in risk management, finance, treasury, internal audit, compliance, data analysis or business control. They should understand common financial statements, basic probability concepts, risk registers and management reporting. Familiarity with credit, market, liquidity or operational risk is helpful, particularly for regulated financial institutions. Prior exposure to COSO ERM, ISO 31000 or Basel requirements is useful but not assumed. Programming, advanced statistics, SAS administration and prior use of SAS Risk Management are not required. This is not a suitable starting point for participants with no prior professional exposure to risk or financial control.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should have professional exposure to risk, finance, treasury, audit, compliance, data analysis or business control. The course assumes familiarity with risk registers and management reporting, but it does not require programming, SAS administration or advanced statistical training.

Participants should bring a laptop for live online delivery and are encouraged to bring anonymised examples of their risk taxonomy, appetite metrics, reports or implementation issues. Confidential information should not be shared in class.

It is designed for experienced risk and control professionals who contribute to enterprise risk governance, analytics, reporting or system implementation. It is particularly relevant to staff in banks, insurers, public bodies, large corporates and regulated service providers.

Foundation courses focus on basic terminology, risk registers and introductory assessment methods. This course addresses risk aggregation, data controls, quantitative measures, stress testing, model risk, SAS Risk Management concepts and executive reporting.

Participants leave with reusable templates and a structured enterprise risk pack that can be adapted to their own organisation. The implementation roadmap helps them prioritise governance, data, reporting and control improvements with colleagues and sponsors.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week builds core governance, data, appetite and reporting components; the second week deepens risk analytics, stress testing, implementation planning and the capstone presentation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Risk Management