Risk, Control and Compliance Training Course

Participants can establish risk context and assessment criteria for a business area.

• Business objectives converted into measurable risk assessment scope statements
• Stakeholder analysis identifying regulators, customers, donors and service users
• PESTLE analysis identifying external drivers of risk and compliance
• Risk taxonomy structured by strategic, financial, operational and conduct categories
• Likelihood and impact scales calibrated with defined rating criteria
• Risk criteria distinguishing tolerable exposure from unacceptable exposure

Participants can identify material risks and write clear cause-event-impact statements.

• Cause-event-impact risk statements written without vague control language
• Process mapping used to locate handoffs, decisions and failure points
• Facilitated risk workshops structured around objectives, threats and opportunities
• Incident, loss and complaint data analysed for recurring exposures
• Scenario analysis applied to plausible high-impact operational disruptions
• Emerging risk identification using horizon scanning and stakeholder intelligence

Participants can analyse inherent and residual risk using consistent qualitative methods.

• Inherent risk assessed before considering existing controls and treatments
• Residual risk rated after evaluating control design and operation
• Risk matrices calibrated to avoid misleading score precision
• Velocity, persistence and interconnectedness assessed alongside impact and likelihood
• Bow-tie analysis linking causes, preventive controls and recovery controls
• Risk prioritisation aligned with appetite, resources and decision authority

Participants can define appetite statements, tolerance limits and escalation rules.

• Risk appetite statements linked directly to strategic and operational objectives
• Tolerance thresholds set for financial loss, service failure and breaches
• Quantitative limits defined using ratios, volumes, values and timeframes
• Qualitative appetite boundaries established for conduct and reputational matters
• Escalation triggers assigned to threshold breaches and emerging indicators
• Authority matrices clarify acceptance, treatment and exception approval rights

Participants can build a usable risk register with accountable treatment actions.

• Risk register fields structured for ownership, ratings, controls and actions
• Risk owners assigned according to authority over causes and responses
• Treatment options compared through avoid, reduce, transfer and accept decisions
• Action plans specify milestones, resources, dependencies and closure evidence
• Target residual risk documented following planned treatment implementation
• Review cycles matched to risk volatility, materiality and control change

Participants can define control objectives and classify controls within key processes.

• Control objectives derived from process risks, obligations and performance requirements
• Preventive, detective and corrective controls distinguished by intended timing
• Manual, automated and information technology dependent controls classified accurately
• Entity-level controls linked to governance, culture and accountability
• Segregation of duties assessed across initiation, approval, recording and custody
• Control rationalisation identifies duplicate, obsolete and poorly targeted activities

Participants can design proportionate controls and document them in a risk control matrix.

• Risk and control matrices link objectives, risks, controls and evidence
• Control descriptions specify performer, action, frequency and retained evidence
• Precision criteria define thresholds, reviews, investigations and required follow-up
• Approval controls tested against delegated authority and conflict requirements
• Reconciliations designed with independent review and timely exception resolution
• Automated controls assessed for configuration, access and change management

Participants can establish a structured compliance management system using ISO 37301.

• ISO 37301 compliance management system requirements applied to business functions
• Compliance obligations identified from laws, licences, contracts and policies
• Obligation registers assign owners, control responses and evidence sources
• Regulatory change processes assess impact, actions and implementation deadlines
• Policy hierarchies distinguish mandatory requirements from guidance and procedures
• Compliance attestations designed with scope, frequency and accountable sign-off

Participants can design indicators and reports that support timely risk decisions.

• Key risk indicators linked to appetite thresholds and escalation actions
• Leading indicators distinguish emerging exposure from realised loss events
• Indicator specifications define source data, ownership, calculation and frequency
• Traffic-light reporting avoids masking material exceptions through averaging
• Risk dashboards combine exposure, control status, incidents and actions
• Board reports present decisions required, not only descriptive risk information

Participants can plan and conduct a risk and control self-assessment process.

• Risk and control self-assessment scope aligned with process objectives
• Workshop questions probe risks, controls, failures and management actions
• Control owners provide evidence supporting design and operating claims
• Challenge sessions test optimistic ratings, unsupported assurances and blind spots
• Assessment results reconciled with incidents, audit findings and indicator trends
• Management sign-off records accepted risks, actions and review commitments

Participants can test control design and operating effectiveness using documented evidence.

• Walkthroughs trace transactions from initiation through recording and reporting
• Design effectiveness assessed against identified risks and control objectives
• Operating effectiveness tested through sampling, inspection and reperformance
• Sample selection considers population size, frequency and risk materiality
• Evidence quality assessed for reliability, completeness, timeliness and independence
• Exceptions evaluated for root cause, impact and compensating controls

Participants can assess financial control weaknesses and fraud risks in core processes.

• Fraud risk assessment considers incentives, opportunities and rationalisation factors
• Payment controls address vendor changes, approvals and duplicate transactions
• Financial close controls cover journals, reconciliations and management review
• Revenue and receivables controls address billing accuracy and collection risks
• Procurement controls test tender integrity, conflicts and supplier due diligence
• Fraud response protocols preserve evidence, confidentiality and investigation independence

Participants can manage risk and compliance obligations across third-party relationships.

• Third-party segmentation ranks suppliers by criticality, access and regulatory impact
• Due diligence reviews ownership, sanctions, integrity and financial viability
• Contract clauses specify controls, audit rights, reporting and notification duties
• Service-level indicators monitor performance, incidents and control failures
• Outsourcing exit plans address data return, continuity and transition risks
• Vendor assurance evidence evaluated through reports, certifications and audit findings

Participants can assess technology-related risks and specify relevant control responses.

• Information asset inventories classify sensitive, confidential and regulated data
• Access controls apply least privilege, approval workflows and periodic recertification
• Privileged access monitoring identifies elevated rights and unusual activity
• Change management controls require testing, approval and implementation evidence
• Cyber incident escalation connects technical response with management accountability
• Data retention schedules align legal, regulatory and operational requirements

Participants can investigate incidents and convert findings into sustainable corrective actions.

• Incident classification distinguishes control failure, breach, loss and near miss
• Immediate containment actions protect customers, assets, records and evidence
• Five Whys analysis separates symptoms from underlying process causes
• Fishbone diagrams organise people, process, technology and governance contributors
• Impact assessments quantify financial, regulatory, customer and reputational consequences
• Lessons-learned reviews assign preventive actions and validate implementation

Participants can connect critical-service risks with continuity and resilience controls.

• Business impact analysis identifies critical activities, dependencies and recovery priorities
• Recovery time objectives set acceptable outage periods for critical services
• Recovery point objectives define acceptable data loss for systems
• Continuity plans assign crisis roles, communications and alternative arrangements
• Scenario testing examines supplier failure, cyber disruption and site loss
• Operational resilience metrics track service tolerances and recovery performance

Participants can communicate control findings and manage remediation to verified closure.

• Findings written with condition, criteria, cause, consequence and recommendation
• Risk ratings calibrated using impact, likelihood and control effectiveness evidence
• Management actions specify owners, dates, milestones and acceptance criteria
• Corrective action plans distinguish quick fixes from sustainable solutions
• Issue ageing reports highlight overdue actions and repeated control failures
• Closure validation confirms evidence, effectiveness and residual risk acceptance

Participants can strengthen governance arrangements that support ethical risk decisions.

• Risk committee terms define mandate, quorum, decisions and reporting
• Conflicts of interest controls require disclosure, review and documented mitigation
• Speak-up arrangements protect reporters and route allegations for investigation
• Conduct risk indicators identify pressure, overrides, complaints and misconduct
• Management information challenges unsupported assurance and delayed escalation
• Ethical decision frameworks test legality, fairness, transparency and accountability

Participants can build, review and present a complete risk, control and compliance management pack for a defined business case.

• Business case objectives translated into material risks and compliance obligations
• Risk register prepared with ratings, owners, appetite and treatment actions
• Risk control matrix documents objectives, controls, evidence and test methods
• Compliance obligation register links requirements, owners, controls and review dates
• Key risk indicator dashboard presents thresholds, trends and escalation triggers
• Management report summarises findings, remediation priorities and decisions required