About This Course
In today's volatile, uncertain, complex, and ambiguous (VUCA) business environment, organisations that fail to manage risk strategically are exposed to financial loss, reputational damage, regulatory penalties, and operational disruption. Enterprise Risk Management (ERM) has evolved from a compliance checkbox into a strategic discipline that enables boards, executives, and risk professionals to make informed decisions, allocate resources effectively, and protect long-term value.
This five-day programme offered by TrainingComplex provides a comprehensive grounding in ERM principles, frameworks, and practical application. Drawing on globally recognised standards — including ISO 31000, COSO ERM 2017, and the IRM Risk Management Standard — participants will develop the competencies to design and implement an organisation-wide risk management programme that is both robust and proportionate.
The course moves beyond theoretical concepts to address the real-world challenges practitioners face: securing buy-in from leadership, embedding risk management into strategic planning cycles, quantifying risk exposures, and reporting meaningfully to boards and audit committees. Participants will leave with practical tools — risk registers, heat maps, bow-tie diagrams, risk appetite statements, and key risk indicators — that they can apply immediately in their organisations.
Whether you are building an ERM function from scratch, maturing an existing programme, or seeking to align your organisation's risk practices with international best standards, this training provides the strategic insight and technical capability to drive meaningful change.
Who Should Attend
- Chief Risk Officers and Risk Managers responsible for enterprise-wide risk frameworks
- Internal Auditors and Compliance Officers seeking to integrate risk-based approaches
- Finance Directors and CFOs involved in strategic planning and financial risk oversight
- Board Members, Trustees, and Non-Executive Directors with governance responsibilities
- Strategy and Planning Officers who embed risk considerations into corporate strategy
- Operations and Project Managers responsible for managing risk at programme and project level
- Government and Public Sector Officials managing risks in public institutions
- Senior Managers and Heads of Department accountable for departmental risk registers
- Consultants and Advisors supporting organisations with governance and risk assignments
Learning Objectives
- Explain the principles, purpose, and evolution of Enterprise Risk Management and its strategic value
- Apply the ISO 31000 and COSO ERM 2017 frameworks to design an organisational risk management programme
- Conduct structured risk identification workshops using proven tools such as PESTLE, SWOT, and risk brainstorming techniques
- Assess and prioritise risks using both qualitative and quantitative risk analysis methods
- Develop a comprehensive risk register, risk heat map, and bow-tie diagrams for real organisational contexts
- Formulate risk appetite and risk tolerance statements that are aligned to organisational strategy
- Design and evaluate risk treatment plans, including risk mitigation, transfer, avoidance, and acceptance strategies
- Establish Key Risk Indicators (KRIs) and risk monitoring mechanisms that provide timely early-warning signals
- Prepare board-ready risk reports and communicate risk information effectively to senior stakeholders
- Build and sustain a risk-aware organisational culture through leadership engagement and training strategies
Course Modules
Module 1: Foundations of Enterprise Risk Management
- Definition and evolution of risk management from silo-based to enterprise-wide approaches
- Distinction between ERM and traditional risk management
- The strategic value of ERM: protecting and creating organisational value
- Key ERM concepts: risk appetite, risk tolerance, risk universe, and risk culture
- Overview of major ERM frameworks: ISO 31000, COSO ERM 2017, and the IRM Standard
- The role of the board, senior management, and risk function in ERM governance
Module 2: ERM Frameworks and Standards in Depth
- ISO 31000:2018 principles, framework, and process — a structured walkthrough
- COSO ERM 2017: five components and twenty principles explained
- Comparison of ISO 31000 and COSO ERM — similarities, differences, and applicability
- Adapting international frameworks to African and emerging-market organisational contexts
- Integrating ERM with corporate governance codes and regulatory requirements
- Selecting the right framework for your organisation's size, sector, and maturity
Module 3: Risk Governance and Organisational Structure
- Designing the ERM governance structure: board risk committee, CRO, and risk champions
- Three lines of defence model and its application in ERM
- Roles and responsibilities across the organisation in a mature ERM programme
- Developing an ERM policy, charter, and terms of reference for risk committees
- Embedding ERM accountability into job descriptions and performance agreements
- Managing conflicts of interest and independence in risk oversight functions
Module 4: Risk Identification Techniques
- The risk identification process: sources, triggers, and common organisational blind spots
- PESTLE analysis for identifying macro-environmental risks
- SWOT analysis as a risk identification tool linked to strategic planning
- Risk brainstorming workshops: facilitation techniques and common pitfalls
- Scenario analysis and horizon scanning for emerging and unknown risks
- Building a comprehensive risk universe and categorising risks by type and business unit
Module 5: Risk Assessment: Qualitative and Quantitative Methods
- Qualitative risk assessment: likelihood-impact rating scales and scoring conventions
- Constructing and calibrating a probability-impact matrix for your organisation
- Quantitative risk assessment techniques: Expected Monetary Value (EMV) and sensitivity analysis
- Monte Carlo simulation: principles and practical application in risk quantification
- Inherent risk versus residual risk: understanding the role of controls in assessment
- Common biases in risk assessment and how to mitigate them
Module 6: Risk Appetite, Tolerance, and Risk Capacity
- Defining risk appetite: conceptual foundations and strategic linkage
- Distinguishing risk appetite, risk tolerance, and risk capacity in practice
- Developing a risk appetite statement aligned to organisational strategy and values
- Setting risk thresholds and escalation triggers at departmental and enterprise level
- Communicating risk appetite to management, staff, and the board
- Reviewing and updating risk appetite in response to strategic or environmental changes
Module 7: Risk Treatment and Control Design
- The four risk treatment strategies: avoid, reduce, transfer, and accept
- Designing proportionate risk treatment plans with owners, timelines, and resources
- Control effectiveness assessment: preventive, detective, and corrective controls
- Bow-tie diagram methodology: mapping threats, controls, and consequences
- Risk transfer mechanisms: insurance, contracts, hedging, and outsourcing
- Monitoring treatment plan implementation and tracking residual risk levels
Module 8: Risk Registers, Heat Maps, and ERM Tools
- Structure and content of a best-practice organisational risk register
- Populating, maintaining, and quality-assuring the enterprise risk register
- Developing dynamic risk heat maps for visual risk communication and prioritisation
- Digital ERM tools and software platforms: an overview of market options
- Integrating risk registers with strategic planning, budgeting, and project management
- Common risk register weaknesses and how to diagnose and correct them
Module 9: Key Risk Indicators and Risk Monitoring
- Purpose and design of Key Risk Indicators (KRIs) as early-warning signals
- Distinguishing KRIs from Key Performance Indicators (KPIs) and audit findings
- Developing a KRI library linked to the organisation's top risks
- Setting KRI thresholds, traffic-light ratings, and escalation protocols
- Building a risk monitoring and reporting cycle integrated into management rhythms
- Using risk data analytics to detect trends, correlations, and emerging exposures
Module 10: Risk Reporting, Communication, and Culture
- Principles of effective risk communication: clarity, relevance, and timeliness
- Designing board-level and executive-level risk reports that drive decision-making
- Tailoring risk communication for different audiences: board, management, staff, and external stakeholders
- Building a risk-aware organisational culture: leadership tone, values, and behaviours
- Risk training and awareness programmes for embedding culture across the organisation
- Developing and implementing an ERM maturity assessment and continuous improvement roadmap
Requirements & Prerequisites
Participants should have at least two years of professional experience in management, finance, audit, compliance, strategy, or a related field. A basic understanding of organisational governance structures and business operations is recommended. No prior formal training in risk management is required, though familiarity with internal controls or audit concepts will be an advantage.
Training Methodology
- Facilitated case study analysis using real-world ERM failures and successes drawn from African and global organisations across public and private sectors
- Hands-on risk register development workshops where participants build and populate a live risk register for a simulated organisation
- Risk heat map construction exercises using probability-impact matrices to prioritise and visualise risk exposures
- Bow-tie diagram sessions that require participants to trace threat pathways, controls, and consequence chains for complex organisational risks
- Small group risk identification workshops applying PESTLE and SWOT techniques to sector-specific scenarios
- Peer-reviewed risk appetite statement drafting, with structured feedback from the facilitator and fellow participants
- Board reporting simulation in which participants prepare and present a risk report to a mock board panel, practising stakeholder communication skills
- Reflective journalling and individual action planning to help participants identify three priority ERM improvements they will implement upon return to their organisations
Organisational Benefits
- Strengthened organisational resilience through a proactive, structured approach to identifying and managing threats and opportunities
- Reduced financial losses and regulatory penalties resulting from unmanaged or poorly controlled risks
- Improved strategic decision-making supported by timely, accurate risk intelligence at board and management levels
- Enhanced stakeholder confidence — from investors, donors, and regulators — through demonstrated risk governance maturity
- Greater alignment between risk management activities and the achievement of corporate strategy and objectives
- A consistent, enterprise-wide risk language and methodology that eliminates siloed risk management practices
- Strengthened internal audit and compliance functions through closer integration with the ERM framework
- Capacity to attract institutional funding, partnerships, and contracts that require evidence of sound risk governance
- A pipeline of internal risk champions capable of sustaining and evolving the ERM programme over time
Where Is Enterprise Risk Management (ERM) Training Offered?
This course runs in-person across: Kampala, Accra, Addis Ababa, Arusha, Johannesburg, Dar es Salaam, Naivasha, Kisumu, Pretoria, Abuja, Nairobi, Dubai, Zanzibar, Nakuru, Cape Town, Mombasa, Lagos, Riyadh, Kigali, plus Live Virtual (online) cohorts. Browse live dates for your city below.
Upcoming Schedules
| Location | Format | Dates | Price |
|---|
| Live Virtual |
Online |
12 Oct 2026 – 16 Oct 2026 |
KES 80,000 |
| Kampala, Uganda |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 1,900 |
| Accra, Ghana |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,800 |
| Addis Ababa, Ethiopia |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,400 |
| Arusha, Tanzania |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,100 |
| Johannesburg, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,500 |
| Dar es Salaam, Tanzania |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,300 |
| Naivasha, Kenya |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
KES 120,000 |
| Kisumu, Kenya |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
KES 120,000 |
| Pretoria, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,300 |
| Addis Ababa, Ethiopia |
In-Person |
2 Nov 2026 – 6 Nov 2026 |
USD 2,400 |
| Live Virtual |
Online |
2 Nov 2026 – 6 Nov 2026 |
KES 80,000 |
| Abuja, Nigeria |
In-Person |
2 Nov 2026 – 6 Nov 2026 |
USD 2,800 |
| Arusha, Tanzania |
In-Person |
2 Nov 2026 – 6 Nov 2026 |
USD 2,100 |
| Nairobi, Kenya |
In-Person |
2 Nov 2026 – 6 Nov 2026 |
KES 105,000 |
+226 more dates — view live schedule →
Frequently Asked Questions
Do I need a formal background in risk management to attend this course?
No prior formal training in risk management is required. The programme is designed for experienced professionals who work in management, finance, audit, compliance, or strategy and are looking to build or formalise their ERM competencies. A basic understanding of organisational governance is helpful.
Will I receive a certificate upon completing the course?
Yes. Participants who attend and complete all five days of the programme will receive a TrainingComplex Certificate of Completion in Enterprise Risk Management. This certificate is recognised as evidence of continuing professional development (CPD) and can be submitted to professional bodies such as ACCA, IIA, ICPAK, and IRMSA.
Which ERM frameworks does the course cover?
The course covers ISO 31000:2018, the COSO ERM 2017 Framework, and the IRM Risk Management Standard in depth. Participants will compare these frameworks and learn how to select and adapt the most appropriate one for their organisational context.
Is this course available online for participants who cannot travel?
Yes. The programme is available as a Live Virtual cohort delivered over five consecutive days via a secure video-conferencing platform. Virtual participants receive the same materials, exercises, and facilitator interaction as in-person attendees and are eligible for the same certificate.
What practical tools will I take away from this training?
Participants will leave with a fully worked risk register template, a probability-impact heat map, bow-tie diagram worksheets, a risk appetite statement template, a KRI development guide, and a board risk report template — all customisable for immediate use in their organisations.
