Risk Management for Projects and Operations Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Project Managers, Programme Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-RM-089

Before you join: Participants should have experience working on projects, programmes, operational processes, budgets, controls or performance reporting.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Projects, programmes and operational activities routinely face uncertain costs, schedules, suppliers, safety events, technology failures, regulatory changes and control breakdowns. Many teams maintain risk registers but struggle to define credible risk appetite, quantify exposure, assign accountable owners, escalate early warnings or connect risk decisions to budgets and delivery plans. This course addresses that gap by treating risk management as a managed business process rather than a reporting requirement.

Participants learn to establish risk governance, identify threats and opportunities, assess likelihood and impact, analyse root causes, prioritise treatments and monitor residual exposure. The course applies ISO 31000, COSO ERM, RACI, bow-tie analysis, FMEA, risk-adjusted estimating, decision trees and Monte Carlo simulation. It covers project and programme risks alongside recurring operational risks such as supplier interruption, process failure, fraud, cyber incidents, health and safety events, and regulatory non-compliance.

Teaching combines concise instructor briefings with facilitated case analysis, risk-register reviews, group decision exercises, quantitative modelling and escalation simulations. Participants work with realistic cases drawn from capital projects, banking operations, public services, manufacturing and technology-enabled change. They leave with a reusable project and operations risk management pack containing a risk register, scoring matrix, treatment plan, key risk indicator dashboard and governance calendar.

The course is designed for professionals who already contribute to project delivery, operational management, finance, assurance or governance and need a practical method for making risk-informed decisions. It is particularly useful where delivery commitments, financial controls, service continuity and regulatory duties must be managed together.

What you will be able to do

  • Apply ISO 31000 principles to establish project and operational risk management processes
  • Define risk appetite, tolerance and escalation thresholds for delivery and operational objectives
  • Build risk registers using clear cause-event-effect statements and accountable risk ownership
  • Assess inherent and residual risk using calibrated likelihood and impact criteria
  • Prioritise risk treatments using bow-tie analysis, FMEA and cost-benefit evaluation
  • Quantify schedule and cost uncertainty using three-point estimates and Monte Carlo simulation
  • Design key risk indicators, reporting dashboards and escalation routes for timely decisions
  • Produce an integrated risk management plan for a project, programme or operational area

Benefits of attending

For you

  • Make defensible risk decisions using stated appetite, criteria and evidence
  • Create risk registers that distinguish causes, events, impacts and controls
  • Estimate cost and schedule exposure before committing contingency budgets
  • Present concise risk reports that prompt timely management action
  • Contribute more effectively to governance boards, assurance reviews and project controls

For your organisation

  • Earlier identification of delivery, financial, supplier and control exposures
  • More consistent risk scoring across projects, programmes and operational teams
  • Clearer accountability for risk ownership, treatment actions and escalation
  • Better contingency decisions through quantified cost and schedule uncertainty
  • Stronger evidence for management review, internal audit and regulatory scrutiny

Course modules

10 modules over 5 days

Participants can establish a risk management structure aligned with organisational objectives and decision rights.

  • ISO 31000 principles, framework and process applied to delivery work
  • COSO ERM components linked to project and operational objectives
  • Risk appetite, tolerance and capacity distinguished through measurable threshold examples
  • Three Lines Model clarifies ownership, oversight and assurance responsibilities
  • Governance roles defined through RACI matrices and escalation authorities
  • Risk criteria set using impact scales, likelihood bands and time horizons

Participants can define the context needed for relevant and decision-useful risk assessment.

  • Objectives translated into measurable cost, schedule, quality and service targets
  • PESTLE analysis identifies external conditions affecting planned outcomes
  • Stakeholder mapping reveals expectations, dependencies, influence and risk perceptions
  • Assumptions, constraints and dependencies recorded within the risk context statement
  • Interfaces between projects, programmes, operations and suppliers mapped systematically
  • Risk breakdown structures organise sources of uncertainty by category

Participants can identify and document risks in statements that support ownership and action.

  • Cause-event-effect statements separate sources, uncertainties and business consequences
  • Prompt lists identify strategic, financial, operational, compliance and technology risks
  • SWIFT analysis structures identification around strengths, weaknesses, opportunities, failures and threats
  • Process mapping exposes handoff failures, bottlenecks and control gaps
  • Lessons learned records reveal recurring risks from completed initiatives
  • Risk workshops distinguish known risks, assumptions, issues and decisions
  • Opportunity risks documented alongside downside threats and response options

Participants can assess inherent and residual risk consistently using agreed evaluation criteria.

  • Likelihood scales calibrated using frequency ranges and available evidence
  • Impact dimensions assess financial, schedule, safety, regulatory and reputational consequences
  • Inherent risk scored before considering existing preventive and detective controls
  • Residual risk assessed after evaluating control design and operating effectiveness
  • Risk matrices prioritise attention without masking high-consequence low-frequency events
  • Heat maps communicate risk profile, movement and concentration clearly
  • Confidence ratings record uncertainty in data quality and expert judgement

Participants can analyse risk drivers and determine whether existing controls reduce exposure adequately.

  • Five Whys identifies underlying causes beyond immediate incident symptoms
  • Fishbone diagrams organise people, process, technology and supplier causes
  • Bow-tie analysis connects threats, preventive barriers, consequences and recovery controls
  • Control objectives specify what each control must prevent or detect
  • Preventive, detective and corrective controls compared against identified risk causes
  • Control testing considers design adequacy, operating evidence and ownership
  • Control gaps documented with consequences, action owners and target dates

Participants can select proportionate risk treatments and prepare actionable contingency responses.

  • Avoid, reduce, transfer, accept and exploit responses matched to risk type
  • Cost-benefit analysis compares treatment expenditure against expected loss reduction
  • Risk transfer assessed through contracts, insurance, warranties and indemnities
  • Treatment plans assign actions, owners, milestones, resources and verification measures
  • Contingency plans define triggers, authority levels and recovery actions
  • Business continuity arrangements address disruption to critical operational services
  • Residual risk acceptance documented against delegated authority and appetite thresholds

Participants can quantify selected project risks to support contingency and commitment decisions.

  • Three-point estimates establish optimistic, most likely and pessimistic assumptions
  • PERT estimates calculate expected durations from structured uncertainty inputs
  • Expected monetary value quantifies probability-weighted financial risk exposure
  • Decision trees compare alternatives under uncertain outcomes and response costs
  • Monte Carlo simulation models cumulative cost and schedule uncertainty
  • Sensitivity analysis identifies assumptions driving forecast variance most strongly
  • Contingency reserves distinguished from management reserves and operating budgets

Participants can manage recurring operational risks and respond systematically when incidents occur.

  • Operational risk events classified by people, process, systems and external causes
  • Loss event data supports trend analysis and recurring control failure detection
  • Key risk indicators provide early warning against stated threshold levels
  • Incident response plans assign containment, communication, recovery and reporting actions
  • Scenario analysis tests severe but plausible service disruption events
  • Supplier risk assessments address concentration, financial health and continuity dependencies
  • Post-incident reviews convert findings into controls, actions and risk updates

Participants can produce risk information that supports prompt oversight and accountable decisions.

  • Risk dashboards present exposure, trend, treatment status and threshold breaches
  • Key risk indicators linked to risk appetite and escalation triggers
  • Board reports distinguish strategic decisions from routine management actions
  • Escalation protocols specify timing, recipients, evidence and decision authority
  • Risk register quality reviews test completeness, clarity and action currency
  • Assurance plans coordinate management checks, compliance reviews and internal audit
  • Risk reporting cycles aligned with project gates, budgets and operational reviews

Participants can assemble a practical risk management plan for their own area of responsibility.

  • Risk management plans define scope, methods, roles and reporting cadence
  • Project and operational registers reconciled where dependencies create shared exposure
  • Risk ownership assignments tested against decision rights and resource control
  • Action prioritisation balances urgency, materiality, feasibility and treatment cost
  • Implementation milestones establish review dates, evidence requirements and accountability
  • Personal application plans identify immediate improvements for workplace risk processes

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. ISO 31000-aligned risk management plan template
  2. Cause-event-effect risk register template
  3. Calibrated likelihood and impact scoring matrix
  4. Bow-tie control assessment model
  5. Risk treatment and contingency action plan
  6. Key risk indicator dashboard template

Who should attend

  • Project Managers — need disciplined methods for controlling delivery uncertainty
  • Programme Managers — need aggregated views of interdependent project risks
  • Operations Managers — need to manage recurring service, process and supplier risks
  • Risk and Compliance Officers — need consistent assessment and reporting methods
  • Finance Managers — need to assess cost exposure, contingencies and financial controls
  • Internal Auditors — need evidence-based approaches for evaluating risk and control design

Skills and tools covered

Risk governance designRisk register developmentQuantitative risk analysisControl effectiveness assessmentRisk treatment planningRisk reporting

Tools and standards

ISO 31000, COSO ERM, FMEA, Monte Carlo simulation

How the course runs

Training methodology

The course uses short instructor briefings to introduce methods, standards and decision criteria, followed by case work based on project delivery and operational incidents. Participants analyse risk statements, calibrate scoring scales, assess controls, select treatments and interpret quantitative outputs. Group exercises test governance decisions, escalation routes and risk reporting under changing conditions. Facilitated discussion connects each method to participants' own responsibilities. The final sessions focus on application planning and adapting the course templates for immediate workplace use.

Requirements and prerequisites

Participants should have experience working on projects, programmes, operational processes, budgets, controls or performance reporting. They should be comfortable reading simple tables, discussing business objectives and making basic judgements about likelihood, impact and priorities. Familiarity with a risk register is useful but not essential. No prior certification in risk management, statistics, project management or internal audit is required. The quantitative sections use practical examples and spreadsheet-based outputs rather than advanced mathematics or specialist software.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants need practical exposure to projects, operations, finance, controls or governance discussions. Prior risk management certification, statistical training and advanced spreadsheet skills are not required.

Participants may bring a non-confidential example of a current project, process, risk register or reporting challenge. Course templates and case materials are provided, so bringing workplace documents is optional.

The course suits project managers, programme managers, operations managers, risk specialists, finance managers, compliance staff and internal auditors. It is intended for professionals who must identify, assess, treat or report business risks.

Project management courses address wider delivery disciplines such as scope, scheduling and stakeholder management. Internal audit courses focus on assurance methods; this course concentrates on managing project, programme and operational risk before losses or failures occur.

Participants can use the templates to improve an existing risk register, revise scoring criteria, assess control gaps and set escalation triggers. The application plan helps them identify actions that can be started with their manager or risk owner.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. Time is divided among instructor briefings, case analysis, group exercises, quantitative modelling, reporting simulations and application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Risk Management

Risk Management Reputational Risk Management Training Course 5 days · from USD 1,100 · next 16 Nov Risk Management Risk Assessment and Mitigation Training Course 5 days · from USD 1,100 · next 16 Nov Risk Management Risk Champion Masterclass Training Course 5 days · from USD 1,100 · next 16 Nov Risk Management Risk Management Training Course 10 days · from USD 2,200 · next 16 Nov Risk Management Risk Management and Internal Controls Training Course 10 days · from USD 2,200 · next 16 Nov Risk Management Risk, Control and Compliance Training Course 10 days · from USD 2,200 · next 16 Nov Risk Management Risk-Based Operational Decision Making Training Course 5 days · from USD 1,100 · next 16 Nov Risk Management SAP Treasury and Risk Management Training Course 5 days · from USD 1,100 · next 16 Nov