Regulatory Compliance Management Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Compliance Officer, Compliance Manager and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-RM-047

Before you join: Participants should have experience in a regulated organisation, or practical exposure to risk, internal controls, legal obligations, audit, governance or operational assurance.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Regulatory compliance failures can produce enforcement action, customer harm, financial loss, licence restrictions and personal accountability for senior managers. Compliance teams must translate changing legal and regulatory requirements into clear obligations, risk assessments, controls, monitoring plans and credible reporting. The challenge is not simply knowing rules: it is showing that the organisation has identified its obligations, assigned ownership, tested controls and acted on weaknesses.

This course develops the practical discipline required to design, operate and improve a compliance management system. Participants examine ISO 37301, ISO 31000, COSO ERM and risk-based regulatory approaches. They learn to maintain regulatory inventories, assess inherent and residual compliance risk, map obligations to controls, set monitoring priorities, manage regulatory change, investigate incidents and prepare management information for boards and regulators. Financial crime, conduct, data protection, consumer protection and prudential requirements are used as applied case contexts.

Teaching combines short instructor briefings with document reviews, case analysis, group decision-making, reporting simulations and structured application planning. Participants progressively build a compliance management pack using their own organisation, or a realistic banking, public-sector, multinational or NGO case. They leave with a completed compliance risk assessment, obligation-to-control map, monitoring plan, issue register, regulatory change process and board reporting pack.

The course suits professionals who already work with risk, controls, governance, legal obligations, audit findings or regulated operations and now need stronger compliance-management capability.

What you will be able to do

  • Map regulatory obligations to accountable owners, processes, controls and evidence sources
  • Conduct a risk-based compliance risk assessment using inherent and residual risk criteria
  • Design a compliance management system aligned with ISO 37301 principles
  • Create obligation-to-control maps that identify control gaps and duplicate activity
  • Develop a regulatory change management process with triage, impact assessment and implementation tracking
  • Prepare compliance monitoring plans, testing scripts, issue logs and remediation actions
  • Produce board-level compliance reporting using risk indicators, trend analysis and clear escalation thresholds
  • Present a complete compliance management plan for review by senior stakeholders

Benefits of attending

For you

  • Build confidence translating regulations into owned operational requirements
  • Create credible compliance risk assessments for senior management review
  • Improve the quality of monitoring, testing and remediation decisions
  • Prepare clearer evidence for regulatory meetings and internal assurance reviews
  • Develop reusable documents for a compliance management role

For your organisation

  • Clearer ownership of regulatory obligations, controls and evidence
  • Earlier identification of compliance gaps and emerging regulatory risks
  • More disciplined implementation of regulatory changes
  • Better management information for boards, executives and risk committees
  • Stronger audit trails for monitoring, incidents and corrective actions

Course modules

20 modules over 10 days

Participants can explain the purpose, structure and accountability model of a compliance management system.

  • Regulatory obligations mapped to products, customers, jurisdictions and legal entities
  • Three lines model assigns management, oversight and assurance accountabilities
  • Board compliance responsibilities documented through charters, delegations and reporting calendars
  • Compliance officer independence, authority, resources and escalation routes assessed
  • Regulatory change triggers linked to accountable business owners
  • Compliance culture indicators tested through conduct, incentives and speak-up data

Participants can use recognised standards to structure compliance governance and risk management.

  • ISO 37301 requirements for compliance policy, leadership and operational controls
  • ISO 31000 principles applied to compliance risk management activities
  • COSO ERM components connected to governance, strategy and performance
  • Risk-based supervision principles used by major financial services regulators
  • FATF risk-based approach applied to financial crime control programmes
  • Evidence requirements distinguished from policy statements and management intentions

Participants can create a structured inventory of applicable regulatory obligations.

  • Legal sources classified by binding force, regulator and effective date
  • Regulatory inventory fields capture requirement, scope, owner and evidence
  • Obligations separated from guidance, internal policy and recommended practice
  • Product lifecycle obligations identified from design through customer exit
  • Cross-border requirements assessed for branches, subsidiaries and outsourced services
  • Interpretive decisions recorded with legal rationale and approval authority

Participants can design a repeatable compliance risk assessment methodology.

  • Inherent risk scored before considering preventive and detective controls
  • Residual risk determined from control design and operating effectiveness
  • Risk criteria define impact, likelihood, velocity and regulatory concern
  • Risk appetite statements translated into measurable compliance thresholds
  • Heat maps tested for false precision and inconsistent scoring
  • Risk assessment frequency aligned with change triggers and risk ratings

Participants can assess compliance risks and prioritise treatment decisions using documented evidence.

  • Risk scenarios written as cause, event and consequence statements
  • Control evidence reviewed before assigning residual risk ratings
  • Customer, product and channel factors segmented using risk criteria
  • Inherent and residual scores calibrated through facilitated challenge sessions
  • Treatment options compared using accept, reduce, transfer and avoid decisions
  • Risk acceptance records specify authority, expiry date and conditions

Participants can map regulatory requirements to controls, owners, evidence and testing activity.

  • Regulatory requirements decomposed into specific operational control statements
  • Control libraries classify preventive, detective, corrective and directive controls
  • Control objectives linked to legal duties and risk scenarios
  • RACI matrices clarify control performance, review and escalation responsibilities
  • Evidence sources identify records, systems, approvals and retained documentation
  • Control gaps distinguished from undocumented controls and weak evidence

Participants can specify controls that are testable, owned and proportionate to compliance risk.

  • Control design specifies trigger, performer, action, evidence and frequency
  • Segregation of duties assessed for approval, execution and reconciliation activities
  • Automated controls compared with manual controls for failure exposure
  • Key controls selected using risk reduction and regulatory significance
  • Policy requirements converted into procedures, workflows and decision rules
  • Control rationales document proportionality, cost and residual risk acceptance

Participants can establish a process for assessing and implementing regulatory change.

  • Regulatory horizon scanning identifies consultations, rules and enforcement trends
  • Change intake logs record source, effective date and applicability
  • Impact assessments examine products, processes, systems, people and suppliers
  • Implementation plans assign actions, milestones, dependencies and accountable owners
  • Legal interpretation issues escalated through documented decision authorities
  • Post-implementation reviews confirm changed controls operate as intended

Participants can build policy and training arrangements that support consistent compliance performance.

  • Policy hierarchies distinguish principles, policies, standards and procedures
  • Mandatory policy content includes scope, duties, breaches and exceptions
  • Procedure steps reflect actual workflow, system controls and handoffs
  • Training needs analysis targets roles, risk exposure and control responsibilities
  • Competence assessments test understanding beyond attendance and completion records
  • Policy exceptions logged with rationale, approval and expiry conditions

Participants can create a risk-based compliance monitoring plan with defined testing coverage.

  • Annual monitoring plans prioritise high-risk obligations and control weaknesses
  • Monitoring universe groups requirements by process, product and business unit
  • Sampling methods selected using population size, risk and control frequency
  • Testing schedules balance thematic reviews, routine checks and follow-ups
  • Monitoring scopes define objectives, population, sample, evidence and reporting
  • Coverage gaps tracked against regulatory commitments and assurance plans

Participants can test control design and operation using defensible compliance testing methods.

  • Walkthroughs trace transactions from trigger through evidence retention
  • Design effectiveness testing assesses whether controls address stated risks
  • Operating effectiveness testing examines performance across selected samples
  • Attribute sampling records pass criteria, exceptions and root causes
  • Data analytics identify outliers, missing approvals and unusual patterns
  • Working papers document procedures, evidence, conclusions and reviewer challenge

Participants can apply risk-based financial crime compliance controls and escalation processes.

  • Customer due diligence requirements matched to customer risk categories
  • Beneficial ownership verification documented through reliable independent sources
  • Sanctions screening controls address names, payments and ownership exposure
  • Transaction monitoring scenarios linked to typologies and customer profiles
  • Suspicious activity escalation preserves confidentiality and decision rationale
  • FATF recommendations inform programme governance, controls and effectiveness reviews

Participants can assess conduct risks affecting customers, markets and regulatory treatment.

  • Conduct risk scenarios identify incentives, behaviours, customers and harm
  • Product governance controls assess target markets and foreseeable misuse
  • Fair treatment indicators track complaints, outcomes and vulnerable customers
  • Conflicts of interest registers record interests, mitigations and approvals
  • Sales quality assurance tests disclosures, suitability and customer consent
  • Complaint root-cause analysis identifies recurring control and process failures

Participants can assess and manage compliance risk introduced by suppliers, agents and partners.

  • Third-party segmentation considers service criticality, jurisdiction and customer impact
  • Due diligence reviews ownership, sanctions exposure, conduct and capability
  • Contract clauses specify compliance duties, audit rights and notification periods
  • Supplier controls tested through attestations, reports, audits and performance data
  • Exit plans address records, customer protection and continuing regulatory duties
  • Outsourcing registers identify material arrangements and accountable executives

Participants can manage compliance incidents from detection through investigation and corrective action.

  • Incident classification distinguishes breach, near miss, allegation and control failure
  • Triage criteria assess customer harm, regulatory urgency and evidence preservation
  • Investigation plans define allegations, scope, witnesses, records and milestones
  • Root cause analysis uses five whys and fishbone techniques
  • Remediation actions address immediate containment, causes and recurrence prevention
  • Regulatory notification decisions record timing, rationale and approval authority

Participants can manage compliance findings through accountable remediation and closure validation.

  • Issue registers capture source, severity, owner, deadline and dependencies
  • Severity ratings reflect legal exposure, customer harm and control failure
  • Corrective action plans specify deliverables, evidence and validation criteria
  • Milestone tracking identifies overdue actions and constrained remediation capacity
  • Issue ageing analysis highlights persistent weaknesses requiring senior attention
  • Closure reviews confirm actions address documented root causes

Participants can design management information that supports escalation and informed compliance decisions.

  • Key risk indicators link measurable signals to defined compliance thresholds
  • Key control indicators measure control completion, quality and exception rates
  • Trend analysis separates isolated events from deteriorating compliance performance
  • Dashboard design prioritises decisions, thresholds, owners and required actions
  • Board reports distinguish assurance, monitoring results, incidents and emerging risks
  • Narrative reporting explains material movements, uncertainty and management response

Participants can prepare clear compliance communications for boards, committees and regulators.

  • Board papers state decision required, material risk and recommended action
  • Risk committee reporting links appetite breaches to management response
  • Regulatory meeting preparation anticipates evidence requests and challenge questions
  • Supervisory findings tracked from receipt through remediation and validation
  • Regulatory correspondence controlled through approvals, records and submission deadlines
  • Senior manager accountability documented for material compliance decisions

Participants can evaluate whether a compliance programme is adequately designed and operating effectively.

  • Compliance programme assessments examine governance, risk, controls and culture
  • Assurance maps coordinate compliance, risk, legal and internal audit activity
  • Maturity models assess consistency, evidence quality and management ownership
  • Independent review scopes test programme design against regulatory expectations
  • Management self-assessments produce evidence-backed ratings and improvement priorities
  • Annual compliance plans align priorities, resources, monitoring and reporting

Participants can build, review and present a complete compliance management plan for a regulated business scenario.

  • Regulatory inventory prioritised for the selected business scenario
  • Compliance risk assessment completed using inherent and residual risk ratings
  • Obligation-to-control map identifies owners, evidence, gaps and treatment actions
  • Monitoring plan specifies reviews, samples, reporting dates and escalation thresholds
  • Board reporting pack presents indicators, issues, trends and decisions required
  • Peer review challenges assumptions, evidence quality and implementation feasibility

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Regulatory obligation inventory template
  2. Compliance risk assessment model
  3. Obligation-to-control mapping workbook
  4. Regulatory change impact assessment template
  5. Risk-based compliance monitoring plan
  6. Board compliance reporting pack

Who should attend

  • Compliance Officer — needs structured methods for building and improving compliance arrangements
  • Compliance Manager — needs stronger risk assessment, monitoring and reporting disciplines
  • Risk Manager — needs to connect enterprise risk processes with regulatory obligations
  • Internal Auditor — needs to assess compliance controls and remediation evidence
  • Legal Counsel — needs to translate regulatory requirements into operational obligations
  • Operations Manager — needs to own compliance controls within regulated business processes

Skills and tools covered

Compliance risk assessmentRegulatory change managementControl mappingMonitoring and testingBoard compliance reportingIssue remediation

Tools and standards

ISO 37301, ISO 31000, COSO ERM, FATF Recommendations

How the course runs

Training methodology

The course uses short instructor briefings to establish methods, standards and regulatory expectations, followed by applied case work drawn from banking, public services, NGOs and multinational operations. Participants analyse obligations, score risks, map controls, review monitoring evidence and decide escalation actions in groups. Simulations cover regulatory change, control failure and board reporting. Individual application planning helps participants adapt each method to their own responsibilities. Trainers provide structured feedback on draft risk assessments, monitoring plans and compliance reporting packs.

Requirements and prerequisites

Participants should have experience in a regulated organisation, or practical exposure to risk, internal controls, legal obligations, audit, governance or operational assurance. They should understand basic business processes and be able to read policies, regulations and management reports. Familiarity with their organisation’s principal regulator, products or services is helpful. This is not an introductory course in financial regulation or corporate law. Prior experience as a compliance officer is not required, and no specialist legal qualification, audit certification, statistical background or technical systems expertise is assumed.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should understand basic business processes and have some exposure to risk, controls, audit, legal obligations or regulated operations. A legal qualification or previous compliance title is not required.

Bring a laptop if possible and, where permitted, non-confidential examples of policies, risk registers, audit findings or regulatory obligations. Participants may instead use the supplied business cases throughout the course.

It is suited to compliance, risk, legal, audit and operational managers with responsibility for regulated processes. It also suits professionals preparing to move into a second-line compliance role.

Financial crime and internal audit are addressed as important related areas, but this course focuses on the management system for compliance as a whole. Participants learn how obligations, risks, controls, monitoring, reporting and remediation fit together.

Participants can use the templates to assess a business area, improve a control map, refresh a monitoring plan or strengthen reporting for a committee. The capstone pack provides a practical starting point for a workplace compliance improvement initiative.

The first week establishes governance, obligation mapping, risk assessment, controls and regulatory change methods. The second week applies these methods to monitoring, financial crime, conduct, incidents, reporting, assurance and the final capstone presentation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Risk Management