Risk Assessment and Mitigation Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Finance Managers, Risk Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 7 Nov 2026 Course code SD-RM-053

Before you join: Participants should understand basic financial statements, budgeting or forecasting, internal controls, and the business processes they support.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Financial and operational risks can weaken earnings, disrupt cash flow, breach covenants, create control failures and damage stakeholder confidence. Many risk registers fail because risks are written vaguely, scoring is inconsistent, control evidence is weak, and treatment actions lack accountable owners. Finance, audit and operational leaders need a disciplined way to identify material exposures, quantify their potential effect and direct resources toward proportionate controls.

This course develops the practical methods used to assess and mitigate risk within finance and accounting functions. Participants apply ISO 31000, COSO ERM concepts, risk and control self-assessments, risk matrices, scenario analysis, sensitivity analysis, stress testing and key risk indicators. They learn to distinguish inherent from residual risk, assess financial exposures, test control design, document treatment decisions and report priority issues to management and governing bodies.

Teaching combines focused instructor briefings with realistic cases involving liquidity pressure, credit deterioration, fraud risk, revenue recognition, supplier concentration and project investment decisions. Group work and facilitated simulations require participants to make risk-rating, control and escalation decisions using evidence rather than opinion. Each participant leaves with a reusable risk assessment pack, risk-control matrix, treatment plan and reporting structure that can be adapted for their own function.

The course is suited to professionals who already work with budgets, controls, financial reporting, audit findings, business processes or operational decisions and need a more consistent approach to risk assessment and mitigation.

What you will be able to do

  • Apply ISO 31000 and COSO ERM concepts to structure a risk assessment
  • Write evidence-based risk statements using cause, event and consequence logic
  • Score inherent and residual risks using calibrated likelihood and impact criteria
  • Quantify selected financial exposures through scenario, sensitivity and stress testing
  • Assess control design and operating effectiveness using risk-control matrices
  • Develop proportionate risk treatment plans with owners, deadlines and success measures
  • Design key risk indicators, escalation thresholds and management risk reports
  • Produce a workplace risk assessment pack for a defined finance or business process

Benefits of attending

For you

  • Produce clearer risk assessments supported by evidence and scoring rationale
  • Challenge weak control claims using design and operating-effectiveness criteria
  • Explain financial risk exposures confidently to managers and control owners
  • Build treatment plans that convert risk findings into accountable actions
  • Strengthen credibility in finance, audit, compliance and governance roles

For your organisation

  • More consistent risk ratings across finance, operational and control functions
  • Earlier identification of cash, credit, fraud and reporting exposures
  • Better allocation of control investment toward material residual risks
  • Clearer accountability for treatment actions, acceptance decisions and escalation
  • Management reporting that highlights threshold breaches and decision-required issues

Course modules

10 modules over 5 days

Participants can structure a risk management process with clear governance, terminology and accountability.

  • ISO 31000 and COSO ERM principles compared for risk governance
  • Risk appetite, tolerance and capacity distinguished through finance examples
  • Three Lines Model roles for owners, oversight and assurance
  • Risk governance charters defining committee mandates, escalation and reporting
  • Financial risk taxonomy spanning market, credit, liquidity and operational exposures
  • Control objectives linked to business objectives and materiality thresholds

Participants can identify material risks using structured evidence gathering and well-formed risk statements.

  • Process mapping identifies handoffs, failure points, data dependencies and exposures
  • Risk and Control Self-Assessment scope, evidence and stakeholder interviews
  • PESTLE scanning identifies external drivers affecting financial assumptions and controls
  • Risk statements written as cause, event and consequence
  • Incident, loss and audit data converted into risk indicators
  • Assumption analysis tests uncertainty within budgets, forecasts and valuation models

Participants can evaluate risks using calibrated scoring criteria and documented rating rationale.

  • Inherent and residual risk ratings calculated using defined scoring criteria
  • Five-by-five matrices calibrated to prevent false precision and score inflation
  • Likelihood scales anchored to frequencies, scenarios and available evidence
  • Impact criteria quantify earnings, cash, capital, compliance and reputation effects
  • Velocity, persistence and interconnectedness assessed alongside likelihood and impact
  • Heat maps interpreted with limitations, aggregation rules and escalation thresholds

Participants can select and apply quantitative methods appropriate to the risk decision.

  • Probability distributions selected for discrete losses and continuous financial variables
  • Expected loss estimates combine probability of default, exposure and loss-given-default
  • Scenario analysis tests defined shocks against earnings, liquidity and covenant headroom
  • Sensitivity analysis isolates key assumptions within forecast and valuation models
  • Monte Carlo simulation estimates ranges using correlated input variables
  • Stress tests distinguish plausible severe events from reverse stress testing

Participants can assess major financial risk categories and select suitable mitigation options.

  • Interest-rate risk measured through repricing gaps, duration and basis exposure
  • Foreign-exchange exposures mapped across transactions, translation and forecast commitments
  • Credit assessment reviews counterparty limits, concentrations, collateral and payment terms
  • Liquidity risk indicators track cash buffers, maturities and funding concentrations
  • Commodity price exposure quantified using purchase volumes, contracts and market indices
  • Risk transfer choices compare insurance, guarantees, hedging and contractual terms

Participants can assess controls, identify weaknesses and determine residual risk exposure.

  • Preventive, detective and corrective controls matched to specific risk causes
  • Control design assesses frequency, precision, ownership and evidence retention
  • Segregation-of-duties conflicts identified within procure-to-pay and record-to-report processes
  • Key controls documented using risk-control matrices and control narratives
  • Control testing separates design effectiveness from operating effectiveness conclusions
  • Residual exposure reassessed after controls, treatment actions and accepted exceptions

Participants can develop proportionate mitigation plans and document risk acceptance decisions.

  • Risk treatment options evaluated: avoid, reduce, transfer or accept
  • Cost-benefit analysis compares control investment with expected loss reduction
  • Treatment plans assign actions, owners, deadlines, resources and success measures
  • ALARP reasoning supports proportionate treatment where risk cannot be eliminated
  • Contingency plans specify triggers, decision rights, communications and recovery actions
  • Risk acceptance documented against delegated authority limits and escalation criteria

Participants can monitor risk exposure and report decision-relevant information to stakeholders.

  • Key risk indicators designed with thresholds, owners, frequency and data sources
  • Leading and lagging indicators differentiated for early warning and loss confirmation
  • Risk registers maintained with current ratings, actions, controls and review dates
  • Dashboard design highlights trend, concentration, exceptions and decision-required items
  • Board reporting distinguishes strategic exposures from management-level operational detail
  • Escalation protocols connect threshold breaches to timely decisions and accountability

Participants can apply assessment and mitigation methods to common finance and business risk situations.

  • Procure-to-pay fraud risks assessed through scenarios, controls and data signals
  • Revenue recognition risk analysed against contract terms, estimates and cut-off controls
  • Third-party risk reviews address due diligence, sanctions and supplier concentration
  • Project investment risks modelled through assumptions, contingencies and stage gates
  • Business continuity exposures linked to liquidity, data, facilities and suppliers
  • Risk interdependencies mapped using bow-tie analysis and causal pathways

Participants can prepare a practical plan for applying course methods within their own area.

  • Risk assessment pack assembled from scope, taxonomy, evidence and scoring rationale
  • Priority risks converted into treatment plans with measurable control improvements
  • Risk reporting calendar aligns committee meetings, review cycles and escalation points
  • First-90-day implementation plan sequences sponsorship, data, training and governance actions
  • Stakeholder communication maps audiences, decisions, messages and reporting formats
  • Personal application commitments identify immediate workplace assessments and review dates

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. ISO 31000-aligned risk assessment template
  2. Risk and control self-assessment worksheet
  3. Calibrated likelihood and impact scoring matrix
  4. Risk-control matrix and control testing checklist
  5. Risk treatment and action tracking plan
  6. Key risk indicator and management reporting pack

Who should attend

  • Finance Managers — need to assess exposures affecting earnings, cash and reporting
  • Risk Managers — need consistent assessment, treatment and reporting methods
  • Internal Auditors — need to evaluate risk-based controls and residual exposure
  • Financial Controllers — need stronger risk evidence behind close and reporting processes
  • Compliance Managers — need defensible escalation and treatment records
  • Operational Managers — need to manage process risks with finance consequences

Skills and tools covered

Risk assessment designFinancial risk analysisControl evaluationScenario modellingRisk treatment planningRisk reporting

Tools and standards

ISO 31000, COSO ERM Framework, IIA Three Lines Model, Bow-tie analysis

How the course runs

Training methodology

The course uses short instructor briefings to introduce methods, standards and decision criteria, followed by case work based on financial and operational risk events. Participants analyse risk statements, score exposures, review control evidence, test scenarios and prepare treatment actions in small groups. Facilitated simulations examine escalation choices, risk acceptance and reporting to senior stakeholders. Individual application planning helps participants adapt the methods, templates and reporting routines to a current workplace process or risk area.

Requirements and prerequisites

Participants should understand basic financial statements, budgeting or forecasting, internal controls, and the business processes they support. Experience working in finance, accounting, audit, compliance, procurement, operations or project management is useful. Participants should be comfortable reading simple tables, discussing business assumptions and making reasoned judgments from available evidence. Prior risk management training is not required, and advanced statistics, coding, derivatives pricing or specialist audit qualifications are not assumed. The course explains quantitative methods at a practical decision-making level.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should understand basic financial statements, business processes and internal controls. No previous formal risk management qualification or advanced quantitative background is required.

Bring a laptop if possible, plus examples of a process, risk register, audit finding or control issue from your work. Sensitive documents should be anonymised before use in class.

It is designed for finance, accounting, audit, risk, compliance and operational professionals with responsibility for identifying or managing business exposures. It is especially useful for people who contribute to risk registers, control reviews or management reporting.

This course focuses on identifying, analysing, treating and monitoring risk across finance and business processes. It includes control assessment and quantitative techniques, but does not train participants to conduct a full audit engagement or build complex valuation models.

Participants can use the supplied templates to assess a process, document risks and controls, assign treatment actions and establish reporting thresholds. The final module creates a first-90-day plan for applying these materials to a workplace priority.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. Time is divided between instructor input, applied cases, group analysis, simulations and preparation of workplace-ready materials.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Risk Management