Enterprise Risk Management Training

Welcome and Programme Overview

Introduction to the session, objectives, and housekeeping.

What ERM Is, and Why Most Implementations Stall

Enterprise risk management against siloed risk management, and what enterprise-wide actually requires. The common failure patterns: risk management run as a compliance exercise, a register maintained by one person, assessment scales nobody agrees on, and risk reporting that arrives too late to affect a decision. What good looks like.

Break

Frameworks: ISO 31000:2018 and COSO ERM

The ISO 31000 structure of principles, framework and process, and how the 2018 revision shifted emphasis towards integration and leadership. The COSO ERM components and their focus on strategy and performance. Where the two agree, where they differ in emphasis, and how to choose or combine them without importing two vocabularies.

Risk Governance and the Three Lines Model

Board and audit or risk committee responsibilities, the risk function's mandate, and the three lines model: management ownership, risk and compliance oversight, and internal audit assurance. Why the second line loses authority when it also owns controls, and how to keep the lines distinct in a small organisation where people wear several hats.

Lunch

Risk Appetite and Tolerance

The difference between appetite, tolerance and capacity, and why an appetite statement that cannot refuse a proposal is decoration. Writing appetite statements that are specific by risk category, setting quantitative tolerances where the data supports it and qualitative ones where it does not, and cascading appetite into decision limits people actually use.

Break

Risk Identification

Techniques beyond the workshop brainstorm: process mapping, scenario analysis, loss event data, near miss review, external horizon scanning and structured interviews. Writing a risk statement that names cause, event and consequence rather than a one-word topic. Emerging risk: cyber, third party and supply chain, climate and transition risk, regulatory change and AI adoption.

Risk Assessment

Likelihood and consequence scales and the discipline of defining each band before scoring anything. Inherent against residual risk, control effectiveness assessment, and where heat maps mislead: compressed scales, averaged scores and the tail risk that lands in the same box as the routine one. An introduction to quantification where it is warranted. Day 1 wrap-up.

Recap and Day 2 Objectives

Review of Day 1 and the plan for the application day.

Risk Treatment and Controls

The treatment options and how to choose between them, designing controls proportionate to residual risk, preventive against detective controls, and testing whether a control that exists on paper actually operates. Cost of control against cost of risk, and documenting an accepted risk so the acceptance is a decision rather than an oversight.

Break

Workshop: Risk Register and Appetite Statement

Groups draft an appetite statement for two risk categories, then build a register: risk statements, owners, assessment, controls, treatment actions with dates, and residual position. Facilitated challenge of the output.

Key Risk Indicators and Early Warning

Selecting indicators that lead rather than lag, setting thresholds and escalation triggers, and avoiding the indicator set that only measures what is easy to count. Linking KRIs to appetite so a breach forces a conversation.

Lunch

Aggregation, Reporting and the Board Conversation

Rolling operational risk up to enterprise level without losing meaning, connecting risks that share a cause, and reporting formats that support a decision. What the board and audit committee should be asking, and the Statement on Risk Management and Internal Control expected of Bursa-listed issuers. Workshop: groups produce a board risk report from their register.

Break

Embedding ERM and Risk Culture

Integrating risk into strategy, budgeting, project approval and procurement so the register stops being a separate artefact. Risk culture and how to read it, incentives that quietly work against the framework, assurance mapping, and maturity assessment. How ERM connects to business continuity, compliance and internal audit.

Implementation Roadmap and Wrap-Up

Groups present a twelve-month ERM improvement plan for their organisation. Key takeaways, next steps, and close.