Corporate Risk and Compliance Training Course

Participants can assign risk, control, oversight and assurance responsibilities across the organisation.

• Three Lines Model clarifies management, oversight and independent assurance accountabilities
• Board and committee mandates aligned with delegated risk decision rights
• Risk committee terms of reference define challenge, escalation and reporting duties
• First-line management responsibilities documented through process and control ownership
• Second-line monitoring distinguishes advice, challenge, policy setting and oversight
• Internal audit independence protected through assurance scope and reporting channels

Participants can identify and describe material risks using consistent categories and cause-event-impact logic.

• Cause-event-impact statements convert vague concerns into assessable risk descriptions
• PESTLE analysis identifies external drivers affecting strategy, funding and regulation
• Process mapping exposes handoffs, failure points and unowned control activities
• Risk taxonomy maps common exposures to business objectives and value drivers
• Stakeholder interviews separate assumptions, evidence, incidents and emerging concerns
• Interdependency mapping identifies concentration, contagion and single-point failure risks

Participants can assess inherent and residual risk using documented criteria and defensible judgments.

• Inherent risk assessed before considering existing controls and mitigations
• Residual risk rated after evaluating control design and operating effectiveness
• Likelihood scales calibrated with frequencies, scenarios and available incident data
• Impact criteria cover financial loss, service disruption, legal exposure and reputation
• Heat maps used cautiously alongside risk velocity and interconnected exposures
• Risk prioritisation considers appetite breaches, control gaps and management capacity

Participants can draft risk appetite statements and translate them into measurable operating thresholds.

• Risk appetite statements express acceptable exposure in relation to objectives
• Tolerance ranges define management action before appetite limits are breached
• Quantitative thresholds use capital, liquidity, losses, errors and service levels
• Qualitative boundaries address conduct, ethics, legal compliance and stakeholder trust
• Cascading appetite connects board limits with divisional and process-level measures
• Breach protocols specify notification, temporary acceptance and remediation authority

Participants can design controls that address defined risks and produce reliable evidence.

• COSO internal control components connected to objectives, risks and assurance
• Preventive, detective and corrective controls selected for specific failure modes
• Control objectives state the condition required to reduce identified risk
• Segregation of duties prevents incompatible initiation, approval and recording activities
• Control frequency, performer, reviewer and evidence specified in control descriptions
• Automated controls assessed for configuration, access rights and change management

Participants can conduct a risk and control self-assessment that produces owned action plans.

• RCSA scope defines processes, objectives, participants, evidence and reporting period
• Facilitated workshops test risk statements against operational process realities
• Control design assessment checks precision, ownership, frequency and evidence quality
• Control effectiveness ratings distinguish isolated exceptions from systemic breakdowns
• Action plans specify remediation owner, milestone, resources and validation method
• Challenge records document disagreements, assumptions and accepted residual risk

Participants can structure a compliance management system around obligations, controls, monitoring and reporting.

• ISO 37301 requirements applied to compliance leadership, planning and evaluation
• Compliance obligations register captures laws, regulations, licences and contractual duties
• Obligation owners identify applicable requirements, controls and retained evidence
• Policy architecture distinguishes mandatory policies, standards, procedures and guidance
• Regulatory change processes assess impact, assign actions and confirm implementation
• Compliance monitoring plans target higher-risk obligations and recurring control failures

Participants can assess fraud and conduct risks and specify proportionate prevention and detection controls.

• Fraud risk assessment examines incentives, opportunities, rationalisation and concealment methods
• Red flags identify unusual payments, override patterns and conflicted vendor relationships
• Anti-bribery controls cover gifts, hospitality, approvals and third-party due diligence
• Whistleblowing arrangements protect confidentiality, triage allegations and preserve evidence
• Conduct risk indicators track customer outcomes, complaints, incentives and sales practices
• Investigation protocols establish case ownership, documentation, findings and disciplinary escalation

Participants can assess and monitor supplier, agent and outsourced-service risks throughout the relationship lifecycle.

• Third-party segmentation considers criticality, spend, data access and regulatory exposure
• Due diligence screens ownership, sanctions, adverse media and beneficial interests
• Procurement controls test competitive bidding, approvals, conflicts and contract authority
• Contract clauses address audit rights, service levels, data protection and termination
• Supplier risk monitoring uses performance metrics, incidents and financial health signals
• Exit plans address transition, records retention, access removal and continuity arrangements

Participants can connect operational risk assessment with continuity planning and resilience testing.

• Important business services identified through customer, regulatory and financial impact
• Impact tolerances define maximum acceptable disruption for critical service delivery
• Business impact analysis assesses dependencies, recovery priorities and resource requirements
• Scenario analysis tests cyber incidents, supplier failure, facility loss and workforce disruption
• Recovery strategies address alternate sites, manual workarounds and communication channels
• Continuity testing records lessons, corrective actions and accountable completion dates

Participants can design risk indicators that provide early warning and support timely management action.

• Key risk indicators linked directly to risk causes, events and consequences
• Leading indicators detect deteriorating conditions before losses or breaches occur
• Lagging indicators measure incidents, losses, complaints and control exceptions
• Thresholds use appetite, tolerance, trend analysis and management intervention points
• Data quality checks test completeness, timeliness, accuracy and ownership of indicators
• Dashboard design separates executive decisions from operational follow-up information

Participants can manage risk incidents from initial escalation through root-cause analysis and remediation.

• Incident classification distinguishes near misses, control failures, losses and breaches
• Escalation criteria specify severity, notification deadlines and decision authorities
• Five Whys analysis traces immediate failures to underlying process weaknesses
• Fishbone diagrams examine people, process, systems, data and external causes
• Corrective actions address root causes rather than symptoms or isolated errors
• Lessons learned reporting identifies policy changes, control improvements and ownership

Participants can plan proportionate assurance work and evaluate control evidence against defined objectives.

• Risk-based assurance plans prioritise high-impact exposures and weak control environments
• Control testing objectives define population, evidence, sample and acceptance criteria
• Walkthroughs trace transactions through processes, systems, approvals and records
• Design testing assesses whether controls can prevent or detect stated risks
• Operating effectiveness testing examines consistent performance during the review period
• Findings ratings reflect impact, likelihood, root cause and remediation urgency

Participants can prepare concise risk reports that support challenge, escalation and informed decisions.

• Board risk reports focus on material exposures, trends, breaches and decisions
• Risk narratives explain drivers, uncertainty, control status and management response
• Heat maps supported by indicator trends, scenario analysis and key assumptions
• Issue escalation distinguishes notification, decision requests and accepted risk positions
• Management information packs reconcile operational detail with executive-level messages
• Committee minutes record challenge, decisions, actions and follow-up accountability

Participants can assess risk culture factors and plan changes that strengthen accountable risk behaviour.

• Risk culture assessment examines leadership signals, incentives, challenge and speak-up behaviour
• Conduct expectations embedded in performance objectives, reward decisions and consequence management
• Training needs analysis targets roles with higher control and compliance responsibilities
• Change impact assessments identify new risks from systems, processes and restructures
• Communication plans explain control changes, ownership shifts and escalation requirements
• Culture indicators combine survey results, turnover, incidents and whistleblowing trends

Participants can build, review and present a complete corporate risk and compliance plan with governance, assessments, controls, monitoring and board reporting.

• Business objectives translated into material risks, compliance obligations and control priorities
• Risk appetite statement aligns decision thresholds with strategic and financial objectives
• Risk register documents inherent ratings, residual exposure, ownership and treatment actions
• Control matrix links priority risks to controls, evidence and testing requirements
• Monitoring plan defines indicators, reporting cadence, escalation triggers and assurance activity
• Executive presentation defends priorities, resource requests, residual risks and recommendations