ISO 31000 Risk Management Training

Welcome and Programme Overview

Introduction to the session, objectives, and housekeeping.

What ISO 31000 Actually Is

The difference between a management system standard and a guidance standard, and why ISO 31000 is the second kind: there is nothing to certify an organisation against, which is precisely why the standard is so widely adopted. Where ISO 31000 sits relative to COSO ERM and sector-specific frameworks like BNM's RMiT. What changed between the 2009 and 2018 editions.

Break

The Eight Principles

Integrated, structured, customised, inclusive, dynamic, best available information, human and cultural factors, and continual improvement. Working through each principle against real organisational failures where ignoring it was the actual root cause, not the risk that was eventually blamed.

The Framework: Leadership and Integration

Leadership and commitment as the framework's foundation, and what that looks like when it is genuine versus decorative. Integrating risk management into governance, strategy, planning and operations rather than running it as a parallel compliance exercise. Designing a framework proportionate to the organisation's size, not copying a template built for a bank.

Lunch

The Framework: Implementation, Evaluation and Improvement

Rolling out a framework in practice: resourcing, communication, and the sequencing that determines whether it survives contact with a busy operation. Evaluating whether the framework is actually working, using evidence rather than the existence of a policy document. Improving the framework on a cycle instead of leaving it untouched until the next audit finding.

Break

Risk Assessment: Identification and Analysis

Structured techniques for identifying risk rather than relying on whoever shouts loudest in the workshop: checklists, bow-tie analysis, and structured interviews. Analysing likelihood and consequence without false precision, and the specific ways a heat map misleads the people using it. Distinguishing inherent risk from residual risk, and why conflating the two is the most common error in a first risk register.

Day 1 Close

Recap and what to review before day two.

Day 1 Review

Recap of day one and the questions it left open.

Risk Evaluation and Treatment

Comparing analysed risk against the organisation's risk criteria to decide what needs treatment now, what is monitored, and what is accepted deliberately rather than by default. The treatment options: avoid, take, remove the source, change likelihood, change consequence, share, or retain. Building a treatment plan with an owner, a deadline and a way to tell later whether it worked.

Break

Monitoring, Review and Reporting

Why a risk register that is never revisited is worse than no register, because it creates false confidence. Building a monitoring rhythm that fits the organisation's actual meeting cadence instead of an ideal one nobody keeps. Recording and reporting risk information so a board or client audience can use it, not just a risk team.

Building the Risk Register

Participants build a complete risk register against a supplied case organisation, working through identification, analysis, evaluation and treatment as one continuous exercise rather than four separate ones.

Lunch

Applying It to Your Own Organisation

The same register rebuilt against the participant's own function or organisation, with group critique on where the case-study version was easier than the real one and what that implies about rollout.

Break

Certification Roadmap and Close

For participants who want a personal credential to show for this: what PECB's Certified ISO 31000 Risk Manager exam covers, how it differs from this workshop, and a realistic study plan for anyone who wants to sit it. What this course does and does not certify, stated plainly.

Wrap-Up and Q&A

Key takeaways, next steps, and close.