Certificate Course in Governance, Risk and Compliance

Duration 10 days 19 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Risk Managers, Compliance Officers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-RM-041

Before you join: Participants should have working experience in finance, operations, audit, compliance, governance, technology, procurement or programme delivery.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Governance, risk and compliance failures rarely begin with a single major event. They emerge when decision rights are unclear, risks are not connected to objectives, controls are poorly designed, obligations are fragmented, or management information arrives too late. For banks, government bodies, NGOs, multinationals and large corporates, these weaknesses can result in financial loss, regulatory action, service disruption, fraud exposure and loss of stakeholder confidence.

This certificate course develops the practical discipline required to design, operate and improve a governance, risk and compliance programme. Participants connect governance structures, risk appetite, risk assessment, internal controls, compliance obligations, assurance activity and board reporting into one managed system. They use ISO 31000, COSO ERM, the IIA Three Lines Model and COBIT 2019 to assess risks, assign accountability, test controls and report meaningful risk information.

Teaching combines concise instructor briefings with sector-based cases, facilitated group work, risk assessment simulations and structured application planning. Participants progressively build a governance, risk and compliance pack using a realistic organisational case or their own workplace context. The final capstone requires them to present a complete risk and control design, including a risk register, control matrix, compliance obligations register, key risk indicators and assurance plan.

The programme suits professionals who contribute to risk, control, audit, compliance, finance, governance, technology or operational management. It is particularly relevant where leaders need consistent risk decisions, clearer accountability and evidence that critical obligations and controls are being managed.

What you will be able to do

  • Design a governance, risk and compliance operating model using defined decision rights and accountability structures
  • Apply ISO 31000 and COSO ERM to identify, assess and prioritise enterprise risks
  • Develop a risk appetite statement with measurable thresholds, limits and escalation triggers
  • Build a risk register linking objectives, causes, events, consequences, owners and treatments
  • Design a risk and control matrix using preventive, detective and corrective controls
  • Map regulatory and policy obligations into a compliance obligations register
  • Create key risk indicators and board risk reports using relevant thresholds and trend analysis
  • Present a complete governance, risk and compliance improvement plan for management review

Benefits of attending

For you

  • Produce risk registers and control matrices suitable for management review
  • Explain risk appetite, tolerance and escalation thresholds with confidence
  • Assess control weaknesses using a structured design and operating effectiveness approach
  • Translate regulatory requirements into accountable compliance actions
  • Present risk information clearly to senior managers and board committees

For your organisation

  • Clearer ownership of major risks, controls, obligations and remediation actions
  • More consistent risk assessments across finance, operations, technology and third parties
  • Earlier escalation of breaches through defined indicators and threshold reporting
  • Better alignment between internal audit plans and management risk priorities
  • Stronger evidence for regulators, boards and external assurance providers

Course modules

19 modules over 10 days

Participants can explain how governance, risk and compliance disciplines support accountable organisational decision-making.

  • Governance, risk and compliance relationships within organisational accountability systems
  • Principal-agent problems, ethical conduct and stewardship responsibilities
  • Board oversight, management accountability and delegated authority boundaries
  • Risk-based decision making linked to strategic and operational objectives
  • Common failure patterns behind misconduct, losses and regulatory breaches
  • GRC operating model components, information flows and assurance routes

Participants can define governance structures, committee mandates and decision rights for material risks.

  • Board charters, committee terms of reference and meeting authorities
  • Delegations of authority matched to financial, operational and compliance decisions
  • RACI matrices for risk ownership, control operation and oversight
  • Management committees structured around risk appetite and escalation responsibilities
  • Conflict-of-interest declarations, registers and recusal decision procedures
  • Governance calendars linking board meetings, reporting cycles and assurance activities

Participants can select and apply recognised frameworks to structure enterprise risk management.

  • ISO 31000 principles, framework and risk management process
  • COSO ERM components connected to performance and strategy
  • IIA Three Lines Model responsibilities for governing bodies and management
  • COBIT 2019 governance objectives for information and technology risks
  • Framework selection based on mandate, maturity and regulatory expectations
  • Risk policy content, approval routes and annual review requirements

Participants can establish risk context and build a usable risk taxonomy.

  • Strategic objectives translated into measurable risk and control requirements
  • Internal context analysis covering capabilities, processes, systems and culture
  • External context analysis using PESTLE and stakeholder mapping
  • Risk taxonomy categories for strategic, financial, operational and compliance risks
  • Cause-event-consequence chains separating drivers from risk events
  • Materiality criteria defining which risks require formal governance attention

Participants can identify material risks using structured evidence and stakeholder input.

  • Facilitated risk workshops using objectives, process maps and scenario prompts
  • Process walkthroughs identifying handoffs, failure points and control gaps
  • Bow-tie analysis connecting threats, top events, controls and consequences
  • Root cause analysis using five whys and fishbone diagrams
  • Horizon scanning for emerging regulatory, market and technology risks
  • Loss-event data, audit findings and incidents informing risk identification

Participants can assess inherent and residual risk using documented scoring criteria.

  • Inherent risk ratings assessed before considering existing controls
  • Likelihood and impact scales calibrated with clear rating definitions
  • Financial, regulatory, operational and reputational impact criteria distinguished
  • Residual risk assessment after evaluating control design and operation
  • Risk heat maps used with caution and documented decision rules
  • Risk velocity, persistence and interconnectedness informing prioritisation decisions

Participants can formulate risk appetite statements and define measurable tolerances.

  • Risk appetite statements aligned with strategy, mandate and stakeholder expectations
  • Tolerance ranges distinguishing acceptable variation from unacceptable exposure
  • Quantitative limits for liquidity, credit, fraud and operational loss
  • Qualitative appetite boundaries for conduct, safety and legal compliance
  • Threshold escalation rules triggered by breaches and adverse trends
  • Board approval, communication and periodic review of appetite statements

Participants can build a risk register and assign proportionate risk treatments.

  • Risk register fields covering objectives, causes, events and consequences
  • Named risk owners accountable for assessment, treatment and reporting
  • Treatment options using avoid, reduce, transfer and accept decisions
  • Action plans specifying milestones, resources, dependencies and due dates
  • Residual risk acceptance documented through authorised management decisions
  • Risk register quality checks for duplication, ambiguity and missing evidence

Participants can design controls that address identified risks within business processes.

  • COSO Internal Control components applied to process-level control design
  • Preventive, detective and corrective controls matched to risk causes
  • Manual and automated controls distinguished by execution evidence
  • Segregation of duties analysis for payment, procurement and payroll processes
  • Control objectives written before selecting activities and evidence requirements
  • Control frequency, ownership and evidence retention clearly specified

Participants can create risk and control matrices that support testing and remediation.

  • Process narratives identifying activities, inputs, outputs and accountable roles
  • Risk and control matrices linking risks to control objectives
  • Control descriptions stating performer, frequency, evidence and review criteria
  • Key controls distinguished from supporting operational activities
  • Control gaps identified through risk coverage and duplication analysis
  • Remediation actions prioritised by residual risk and implementation feasibility

Participants can establish a compliance management process from obligations through monitoring.

  • Compliance universe categorising laws, licences, standards and contractual commitments
  • Obligation registers linking requirements to owners, controls and evidence
  • Regulatory change management from source monitoring to implementation actions
  • Policies, procedures and training mapped to compliance obligations
  • Compliance attestations designed around accountable ownership and supporting evidence
  • Breach registers recording incidents, notifications, investigations and corrective actions

Participants can assess conduct and financial crime risks and specify response controls.

  • Anti-bribery controls covering gifts, hospitality, donations and facilitation payments
  • Conflict-of-interest risk assessments for procurement and investment decisions
  • Fraud risk assessments using opportunity, pressure and rationalisation indicators
  • Whistleblowing arrangements protecting confidentiality, investigation independence and non-retaliation
  • Know-your-customer controls for customer onboarding and periodic review
  • Sanctions screening escalation procedures for potential matches and prohibited transactions

Participants can assess and monitor risks arising from suppliers, agents and outsourced services.

  • Third-party segmentation based on spend, criticality and inherent risk
  • Due diligence checks covering ownership, sanctions, integrity and capability
  • Contract clauses specifying control requirements, audit rights and incident notification
  • Supplier risk assessments for data, resilience, financial and conduct exposure
  • Ongoing monitoring using performance indicators, attestations and adverse media
  • Exit plans addressing data return, service continuity and access termination

Participants can connect technology and data risks to governance, controls and assurance.

  • COBIT 2019 objectives supporting technology governance and management accountability
  • Information asset inventories identifying owners, classification and criticality
  • Access control reviews using joiner, mover and leaver procedures
  • Cyber risk scenarios covering ransomware, phishing, outages and data loss
  • Data privacy controls for collection, retention, access and disposal
  • Technology change controls covering approvals, testing, release and rollback

Participants can develop key risk indicators and reports that support timely management action.

  • Key risk indicators linked directly to risk causes and events
  • Leading and lagging indicators distinguished through timing and predictive value
  • Thresholds, limits and trend triggers set from appetite statements
  • Risk dashboards presenting exposure, control status and overdue actions
  • Board reports separating decisions required from background management information
  • Data quality controls for risk reporting completeness, accuracy and timeliness

Participants can establish escalation and response arrangements for risk incidents and control failures.

  • Incident classification criteria based on impact, urgency and notification duties
  • Escalation protocols identifying decision makers, timeframes and communication channels
  • Issue registers tracking root causes, actions, owners and closure evidence
  • Crisis management roles for operational disruption, cyber events and misconduct
  • Regulatory notification assessments based on reporting triggers and deadlines
  • Post-incident reviews converting lessons into control and policy improvements

Participants can plan monitoring and assurance activities based on risk and control priorities.

  • First-line monitoring activities performed by process and control owners
  • Second-line oversight challenging risk assessments, controls and remediation progress
  • Internal audit planning based on risk universe and assurance coverage
  • Control testing procedures for design effectiveness and operating effectiveness
  • Assurance maps identifying overlaps, gaps and reliance opportunities
  • Management action validation requiring evidence before issue closure

Participants can assess GRC maturity and develop a phased improvement plan.

  • Maturity assessments across governance, risk, compliance, controls and assurance
  • Current-state diagnostics using interviews, documents, data and process evidence
  • Target operating model defining structures, roles, processes and information
  • Implementation roadmaps sequenced by risk reduction, dependencies and resources
  • Change management plans addressing sponsorship, communication and capability needs
  • Success measures tracking adoption, control performance and risk outcomes

Participants can build, review and present a complete governance, risk and compliance programme pack for a defined organisation.

  • Organisational objectives, governance structure and material risk context established
  • Risk appetite statement supported by thresholds, limits and escalation rules
  • Enterprise risk register assessed for inherent and residual exposure
  • Risk and control matrix designed for one critical business process
  • Compliance obligations register linked to owners, controls and evidence
  • Key risk indicators, assurance map and implementation roadmap presented

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Governance charter and RACI template
  2. Enterprise risk register template
  3. Risk appetite statement model
  4. Risk and control matrix template
  5. Compliance obligations register
  6. GRC implementation roadmap

Who should attend

  • Risk Managers — need consistent methods for enterprise risk assessment and reporting
  • Compliance Officers — need to translate obligations into monitored control requirements
  • Internal Auditors — need to align assurance plans with risk and control priorities
  • Finance Managers — need stronger financial control ownership and risk information
  • Governance Officers — need clear board structures, delegations and accountability records
  • Operational Managers — need practical tools for managing risks within business processes

Skills and tools covered

Enterprise risk assessmentControl design testingCompliance obligation mappingRisk appetite settingBoard risk reportingAssurance planning

Tools and standards

ISO 31000, COSO ERM, COBIT 2019, IIA Three Lines Model

How the course runs

Training methodology

The course uses short instructor briefings to establish methods, followed by cases drawn from regulated financial services, public bodies, multinational operations and donor-funded programmes. Participants analyse governance failures, score risks, map obligations, design controls and interpret risk reports in facilitated groups. Simulations address risk committee decisions, control breakdowns, regulatory breaches and incident escalation. Individual application planning helps participants adapt the models to their own responsibilities. Instructor feedback focuses on decision quality, evidence, accountability and practical implementation.

Requirements and prerequisites

Participants should have working experience in finance, operations, audit, compliance, governance, technology, procurement or programme delivery. They should be comfortable reading management reports, discussing business processes and interpreting basic financial information. Familiarity with risk registers, internal controls or regulatory requirements is useful but not essential. The course does not require prior certification in risk management, internal audit or compliance. It does not require advanced statistics, legal training, accounting qualifications, software coding or prior knowledge of ISO 31000, COSO ERM or COBIT 2019.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants need workplace experience in a business, finance, operational, audit, compliance, governance or technology role. Prior exposure to risk registers or controls is helpful, but formal risk, audit or legal qualifications are not required.

Participants should bring a laptop if possible, along with a non-confidential example of a process, risk report, policy issue or control concern from their work. Course materials and templates are provided.

The course is suited to managers and specialists who own, oversee, test or report risks, controls and compliance obligations. It is also appropriate for professionals moving into a GRC, internal audit or operational risk role.

Internal audit courses focus primarily on independent assurance, while compliance courses focus on meeting obligations. This programme connects governance, enterprise risk, controls, compliance monitoring, assurance and management reporting.

Participants build reusable materials including a risk register, appetite statement, control matrix and obligations register. These can be adapted to a department, programme, legal entity or critical process after the course.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first part builds core governance, risk and control methods; the later part addresses compliance, assurance, reporting, implementation and the capstone presentation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Risk Management