What you will be able to do
- Identify risks from objectives and processes, not from a generic list
- Assess risks with scales that people apply consistently
- Assign owners and treatment plans that are followed
- Report on risks in a way that helps management decide
Who it is for
- Risk and compliance officers
- Managers who own processes or programs
- Internal auditors and controllers
Prerequisites
- None
Program
Identifying risks
- Starting from objectives and processes
- Workshops that surface real risks
- Writing a risk: cause, event, consequence
Assessing and prioritising
- Likelihood and impact scales that fit the institution
- Inherent and residual risk
- Risk appetite in plain language
Treating risks
- Accept, reduce, transfer or avoid
- Action plans with owners and dates
- Linking risks to controls
Keeping the map alive
- Review cycles and triggers
- Reporting to management and the board
- Integrating risk into planning and budgeting
How we work
- A risk identification workshop run on participants’ own processes
- Calibration exercises on assessment scales
- Drafting a risk report for management