Risk Management and Internal Controls Training Course

Participants can establish the context and assessment criteria for a risk management assignment.

• Strategic, financial, operational and compliance objectives translated into risk sources
• Internal context assessed through structure, processes, systems and resources
• External context analysed through regulation, markets, suppliers and stakeholders
• Risk criteria defined using impact categories and likelihood scales
• Financial loss, service disruption and reputation impacts calibrated consistently
• Assessment boundaries documented for entities, processes, projects and third parties

Participants can define risk appetite statements and escalation thresholds aligned with objectives.

• Risk appetite statements linked to strategic objectives and stakeholder commitments
• Tolerance limits established for financial, operational and compliance exposures
• Risk capacity distinguished from appetite and management tolerance
• Quantitative thresholds set for losses, liquidity, service levels and incidents
• Qualitative boundaries defined for conduct, safety and regulatory breaches
• Escalation triggers assigned to management, committees and board reporting

Participants can identify material risks and construct a clear, decision-useful risk register.

• Risk statements written as cause, event and consequence relationships
• Process maps used to identify failure points and control dependencies
• PESTLE analysis applied to external sources of strategic uncertainty
• Stakeholder interviews structured around objectives, threats and opportunities
• Risk categories organised through a tailored risk taxonomy
• Risk register fields defined for owners, causes, controls and actions

Participants can assess inherent and residual risk using consistent qualitative and quantitative methods.

• Inherent risk assessed before considering existing control activities
• Likelihood scales anchored with frequency, probability and historical evidence
• Impact ratings assessed across financial, operational, legal and reputational dimensions
• Residual risk calculated after evaluating control design and operation
• Risk matrices calibrated to avoid misleading concentration and ranking
• Heat maps supplemented with narrative, assumptions and data limitations

Participants can select proportionate risk treatments and document accountable action plans.

• Avoid, accept, reduce, share and exploit treatments compared
• Treatment decisions tested against appetite, cost, feasibility and timing
• Control improvements distinguished from contingency and recovery measures
• Action plans specify owners, milestones, resources and expected residual risk
• Risk transfer assessed through insurance, contracts and indemnity provisions
• Accepted risks documented with approval authority and review dates

Participants can assess the control environment and relate it to the COSO framework.

• COSO Internal Control Framework principles applied to organisational controls
• Control environment assessed through ethics, authority and accountability
• Segregation of duties analysed across authorisation, custody and recording
• Delegations of authority aligned with approval limits and escalation
• Policies and procedures evaluated for clarity, currency and accessibility
• Management override risks addressed through independent review and monitoring

Participants can design controls that address specific risks within a business process.

• Control objectives derived from process risks and required outcomes
• Preventive, detective and corrective controls compared by timing and purpose
• Manual, automated and hybrid controls matched to process conditions
• Control descriptions specify performer, frequency, evidence and escalation
• Key controls identified through materiality, fraud exposure and dependency
• Control matrices link risks, objectives, activities and evidence

Participants can identify and strengthen key controls over financial reporting and treasury activities.

• Record-to-report risks mapped across journals, reconciliations and consolidation
• Journal entry controls address authorisation, supporting evidence and review
• Account reconciliations designed with ageing, investigation and sign-off requirements
• Cash disbursement controls separate initiation, approval and payment release
• Bank reconciliation exceptions tracked through accountable resolution procedures
• Financial close calendars establish deadlines, dependencies and review controls

Participants can design risk-based controls for procurement, payments and supplier management.

• Purchase-to-pay process risks identified from requisition through settlement
• Supplier onboarding controls verify identity, ownership and banking details
• Three-way matching addresses quantity, price and receiving discrepancies
• Competitive tender controls document evaluation criteria and conflict declarations
• Duplicate payment analytics identify repeated invoices, vendors and bank accounts
• Contract management controls monitor milestones, variations and performance obligations

Participants can assess fraud risks and specify controls for prevention, detection and response.

• Fraud Triangle factors assessed across pressure, opportunity and rationalisation
• Fraud risk assessments target schemes, perpetrators and control weaknesses
• Red flags identified in payments, payroll, expenses and procurement
• Whistleblowing arrangements protect confidentiality, triage allegations and preserve evidence
• Data analytics tests identify anomalies requiring investigation and follow-up
• Response protocols define investigation authority, reporting and corrective actions

Participants can evaluate technology controls that support reliable information and secure operations.

• IT general controls support application reliability and information integrity
• User access reviews assess appropriateness, conflicts and dormant accounts
• Privileged access controls require approval, logging and periodic recertification
• Change management controls document testing, approval and release decisions
• Backup and recovery controls establish recovery objectives and test evidence
• Interface controls reconcile complete, accurate and timely data transfers

Participants can assess third-party risk and establish proportionate supplier control requirements.

• Third-party risk segmentation considers criticality, data access and substitutability
• Due diligence assesses ownership, sanctions, financial standing and capability
• Contract clauses specify service levels, audit rights and incident notification
• Supplier performance indicators monitor delivery, quality and control failures
• Outsourcing exit plans address data return, continuity and replacement arrangements
• Service organisation reports evaluated for scope, exceptions and complementary controls

Participants can manage risks and controls associated with projects, change and disruption.

• Project risk registers link scope, schedule, cost and dependency exposures
• Stage-gate controls require documented decisions before funding or progression
• Change impact assessments identify affected controls, roles and systems
• Business continuity plans prioritise critical services and recovery activities
• Scenario analysis tests disruption assumptions, response capacity and communications
• Lessons learned processes convert incidents into control and process improvements

Participants can document processes and perform walkthroughs to validate control understanding.

• Narratives document process steps, systems, roles and control points
• Swimlane flowcharts show handoffs, approvals and segregation of duties
• Walkthroughs trace transactions from initiation to recording and reporting
• Inquiry, observation, inspection and reperformance distinguished as evidence techniques
• Control evidence evaluated for completeness, reliability and retention
• Process exceptions documented with root causes and responsible owners

Participants can plan control tests and evaluate deficiencies using evidence and risk judgement.

• Design effectiveness testing assesses whether controls address stated risks
• Operating effectiveness testing examines performance over the review period
• Sampling approaches selected using population, frequency and risk considerations
• Test procedures define criteria, evidence, exceptions and conclusion requirements
• Control deficiencies rated by likelihood, impact and compensating controls
• Root cause analysis distinguishes people, process, technology and governance failures

Participants can establish risk monitoring arrangements and prepare management-level risk reports.

• Key risk indicators linked to appetite thresholds and escalation actions
• Key control indicators measure control performance, exceptions and timeliness
• Risk dashboards distinguish current exposure, trend and management response
• Management information tested for accuracy, completeness, relevance and timeliness
• Risk committee papers present decisions, exceptions and required approvals
• Emerging risks monitored through external signals, incidents and scenario reviews

Participants can coordinate assurance activities and govern remediation of risk and control issues.

• Assurance maps identify coverage across management, compliance and internal audit
• Risk-based audit plans prioritise material exposures and control dependencies
• Issue registers track findings, actions, due dates and validation status
• Remediation plans address root causes rather than isolated exceptions
• Overdue actions escalated using agreed accountability and risk thresholds
• Closure validation confirms actions operate effectively before issue retirement

Participants can build, review and present a complete risk and internal control improvement pack for a defined business process or function.

• Business objectives translated into scope, risk criteria and assessment boundaries
• Risk register completed with causes, consequences, owners and ratings
• Control matrix developed for priority risks and critical process activities
• Residual risk analysis supports treatment priorities and resource decisions
• Monitoring plan specifies indicators, reporting cycles and escalation thresholds
• Management presentation communicates findings, actions, assurance and residual exposure