🏦 Part of our Banking & Financial Services Industry Training Series — browse all related courses →
About This Course
In an increasingly complex and regulated business environment, operational risk has emerged as one of the most significant threats to organisational resilience and financial integrity. From process failures and fraud to technology disruptions and human error, the sources of operational risk are diverse and constantly evolving. Without a structured approach to identifying, assessing, and controlling these risks, organisations remain exposed to costly incidents, regulatory penalties, and reputational damage.
The Operational Risk and Internal Control Frameworks Training course offered by TrainingComplex is designed to address this challenge head-on. Grounded in globally recognised frameworks such as COSO's Internal Control — Integrated Framework, ISO 31000 Risk Management Guidelines, and Basel III operational risk principles, the programme provides participants with a comprehensive and practical understanding of how to build and sustain effective risk and control environments.
Over five intensive days, delegates will move through the full operational risk management lifecycle — from risk identification and appetite-setting to control design, testing, incident management, and reporting to senior leadership. Particular attention is given to the practical application of risk and control self-assessments (RCSAs), key risk indicators (KRIs), and control testing methodologies that can be immediately deployed within participants' organisations.
This course is equally valuable for those new to formalised risk frameworks and for seasoned practitioners seeking to refresh their knowledge, benchmark current practices against international standards, and enhance their ability to communicate risk insights to boards and executive committees. By the end of the programme, participants will possess not only the conceptual foundations but also the hands-on confidence to lead operational risk and internal control initiatives within their organisations.
Who Should Attend
- Risk managers and operational risk officers seeking to strengthen their technical framework knowledge
- Internal auditors and internal control specialists responsible for evaluating control effectiveness
- Finance managers and financial controllers who oversee process integrity and financial risk
- Compliance officers and regulatory affairs professionals working within risk-sensitive industries
- Senior managers and department heads accountable for risk ownership within their functions
- Treasury and financial operations professionals with oversight of transactional risk
- Governance and board secretariat staff supporting audit and risk committee functions
- Consultants and advisers supporting organisations on risk management engagements
Learning Objectives
- Explain the fundamental concepts, terminology, and categories of operational risk and their relevance to organisational performance
- Describe and apply major internal control frameworks, including COSO, ISO 31000, and Basel III operational risk standards
- Conduct a structured risk and control self-assessment (RCSA) using industry-standard tools and facilitation techniques
- Design and implement key risk indicators (KRIs) and key control indicators (KCIs) appropriate to specific business functions
- Evaluate the adequacy and effectiveness of internal controls using control testing and gap analysis methodologies
- Develop an operational risk appetite statement aligned with organisational strategy and stakeholder expectations
- Manage and document operational risk events, near-misses, and loss data in a systematic and compliant manner
- Prepare clear and actionable risk reports for senior management, audit committees, and regulatory bodies
- Identify emerging and technology-related operational risks, including cyber risk and third-party risk
- Embed a risk-aware culture within teams and departments through practical communication and change management approaches
Course Modules
Module 1: Foundations of Operational Risk Management
- Defining operational risk: scope, categories, and distinction from other risk types
- The business case for operational risk management: cost of failures and regulatory expectations
- Key terminology: risk events, risk causes, risk consequences, and near-misses
- Overview of the operational risk management lifecycle
- Operational risk in the context of enterprise risk management (ERM)
- Industry sectors and the unique operational risk profiles they present
Module 2: International Frameworks and Standards
- The COSO Internal Control — Integrated Framework: five components and seventeen principles
- ISO 31000:2018 Risk Management Guidelines: principles, framework, and process
- Basel III operational risk capital requirements and the standardised measurement approach
- The Three Lines of Defence model: roles, responsibilities, and interdependencies
- Comparative analysis of frameworks: selecting the right fit for your organisation
- Regulatory expectations in African and Middle Eastern jurisdictions and how global standards apply locally
Module 3: Risk Identification and Risk Register Development
- Techniques for identifying operational risks: workshops, interviews, process mapping, and historical data review
- Categorising risks using standard taxonomies: people, process, systems, and external events
- Building and maintaining a structured operational risk register
- Involving process owners and subject matter experts in risk identification exercises
- Documenting risk descriptions with precision: event, cause, and impact statements
- Prioritising identified risks for further assessment and treatment
Module 4: Risk Assessment and the RCSA Process
- Qualitative versus quantitative risk assessment approaches
- Inherent risk, residual risk, and the role of controls in reducing risk exposure
- Designing and facilitating a Risk and Control Self-Assessment (RCSA)
- Scoring methodologies: likelihood, impact, and velocity matrices
- Aggregating and heat-mapping risk assessment outputs
- Common pitfalls in RCSA facilitation and how to avoid assessment bias
Module 5: Internal Control Design and Typology
- The nature and purpose of internal controls: preventive, detective, and corrective controls
- Control attributes: automated versus manual, entity-level versus process-level
- Designing controls proportionate to the risk level and operational context
- Control ownership: assigning accountability and ensuring management commitment
- Documenting controls: narratives, flowcharts, and control matrices
- Linking controls to specific risk events within the risk register
Module 6: Control Testing and Effectiveness Evaluation
- Planning a control testing programme: scope, frequency, and sampling approach
- Walkthrough testing, design effectiveness testing, and operating effectiveness testing
- Common control deficiencies: definition, classification, and reporting thresholds
- Root cause analysis of control failures and near-miss events
- Gap analysis techniques for identifying control environment weaknesses
- Developing management action plans and tracking remediation progress
Module 7: Key Risk Indicators and Key Control Indicators
- Defining KRIs and their role as early warning signals in operational risk management
- Criteria for selecting high-quality KRIs: measurability, timeliness, and relevance
- Setting thresholds and escalation triggers for KRI breaches
- Key Control Indicators (KCIs): monitoring control performance over time
- Building a KRI/KCI dashboard for senior management reporting
- Reviewing and recalibrating indicators as the risk environment evolves
Module 8: Operational Risk Appetite and Tolerance
- Understanding risk appetite, risk tolerance, and risk capacity as distinct concepts
- Linking risk appetite to organisational strategy and stakeholder expectations
- Quantitative and qualitative approaches to expressing risk appetite
- Drafting a risk appetite statement: structure, language, and board approval process
- Cascading risk appetite from enterprise level to business unit and process level
- Monitoring and reporting against risk appetite thresholds on a periodic basis
Module 9: Incident Management and Loss Data Collection
- Establishing an operational risk event reporting culture: overcoming barriers to disclosure
- Classifying and recording risk events, near-misses, and operational losses
- Building and maintaining an internal loss database aligned with Basel categories
- Root cause analysis frameworks: the 5-Whys, Fishbone, and Bow-Tie methods
- Using loss data and external benchmarking data to refine risk assessments
- Regulatory requirements for incident reporting and escalation timelines
Module 10: Risk Reporting, Emerging Risks, and Building a Risk-Aware Culture
- Designing effective operational risk reports for management, boards, and audit committees
- Storytelling with risk data: translating technical findings into actionable insights
- Identifying and monitoring emerging operational risks: cyber risk, AI-related risk, and third-party risk
- Conducting a horizon-scanning exercise to anticipate future risk exposures
- Embedding risk awareness through training, communication, and behavioural incentives
- Measuring risk culture maturity and developing a roadmap for continuous improvement
Requirements & Prerequisites
Participants should have a foundational understanding of business operations, finance, or organisational management. Prior exposure to risk management, internal audit, or compliance functions is beneficial but not mandatory. No advanced technical qualifications are required, and the course is structured to accommodate both practitioners entering the field and experienced professionals seeking to formalise or update their knowledge.
Training Methodology
- Facilitated case study analysis using documented operational risk failures from banking, public sector, and corporate environments to ground concepts in real-world consequences
- Hands-on RCSA workshop where participants map risks and controls for a simulated business unit, applying scoring methodologies and populating a risk register
- Control design and testing exercises in which delegates evaluate sample control documentation, identify weaknesses, and propose remediation actions
- KRI and KCI development lab where small groups construct and calibrate indicators for realistic business scenarios, then present and defend their choices
- Structured role-play simulations of risk committee and audit committee reporting sessions, giving delegates practice in translating technical findings into executive-level communication
- Group-based risk appetite drafting exercise requiring participants to align quantitative thresholds with organisational strategy and risk tolerance narratives
- Peer review and critique sessions in which delegates assess each other's control frameworks and risk reports, building evaluative and analytical skills
- Facilitator-led reflection at the close of each day to consolidate learning, surface questions, and connect module content to participants' specific professional contexts
Organisational Benefits
- Reduced financial losses from operational failures, fraud, and process breakdowns through proactive risk identification and control strengthening
- Improved regulatory compliance posture, reducing the likelihood of penalties, sanctions, or enforcement actions
- Enhanced internal audit effectiveness through better-designed control environments and clearer risk documentation
- Stronger governance structures supported by well-defined risk ownership, escalation protocols, and reporting lines
- Greater operational resilience and business continuity capability in the face of disruptions
- Increased confidence among boards, audit committees, and external regulators in the organisation's risk management maturity
- More informed strategic decision-making enabled by timely and accurate operational risk intelligence
- A measurable improvement in risk culture, with staff at all levels understanding their role in identifying and managing operational risk
Where Is Operational Risk and Internal Control Frameworks Training Offered?
This course runs in-person across: Accra, Kisumu, Arusha, Naivasha, Addis Ababa, Pretoria, Dar es Salaam, Kampala, Johannesburg, Abuja, Nairobi, Cape Town, Dubai, Kigali, Nakuru, Zanzibar, Riyadh, Mombasa, Lagos, plus Live Virtual (online) cohorts. Browse live dates for your city below.
Upcoming Schedules
| Location | Format | Dates | Price |
|---|
| Live Virtual |
Online |
19 Oct 2026 – 23 Oct 2026 |
KES 80,000 |
| Accra, Ghana |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,800 |
| Kisumu, Kenya |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
KES 120,000 |
| Arusha, Tanzania |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,100 |
| Naivasha, Kenya |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
KES 120,000 |
| Addis Ababa, Ethiopia |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,400 |
| Pretoria, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,300 |
| Dar es Salaam, Tanzania |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,300 |
| Kampala, Uganda |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 1,900 |
| Johannesburg, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,500 |
| Pretoria, South Africa |
In-Person |
2 Nov 2026 – 6 Nov 2026 |
USD 3,300 |
| Live Virtual |
Online |
2 Nov 2026 – 6 Nov 2026 |
KES 80,000 |
| Abuja, Nigeria |
In-Person |
2 Nov 2026 – 6 Nov 2026 |
USD 2,800 |
| Arusha, Tanzania |
In-Person |
2 Nov 2026 – 6 Nov 2026 |
USD 2,100 |
| Addis Ababa, Ethiopia |
In-Person |
2 Nov 2026 – 6 Nov 2026 |
USD 2,400 |
+226 more dates — view live schedule →
Frequently Asked Questions
Do I need a formal risk management qualification to attend this course?
No formal qualification is required. The course is designed for professionals with practical experience in finance, operations, compliance, or audit who want to deepen their understanding of operational risk and internal control frameworks. A basic familiarity with organisational processes is sufficient preparation.
Will I receive a certificate upon completing the course?
Yes. All participants who attend the full five-day programme will receive a TrainingComplex Certificate of Completion in Operational Risk and Internal Control Frameworks. The certificate is a recognised mark of professional development and can be included in CPD portfolios.
How practical is the course content — is it mostly theory or hands-on?
The course is strongly practice-oriented. While key frameworks and concepts are introduced through structured instruction, the majority of learning time is devoted to workshops, case studies, simulations, and group exercises using realistic organisational scenarios. Delegates leave with tools and templates they can apply immediately.
Is this course relevant for organisations outside the banking and financial services sector?
Absolutely. While operational risk concepts originated in financial services, the frameworks covered — including COSO and ISO 31000 — are universally applicable. The course draws examples from banking, public sector, manufacturing, NGOs, and services industries, making it highly relevant across sectors.
Can this training be delivered in-house for our entire risk or finance team?
Yes. TrainingComplex offers customised in-house delivery of this programme for teams of six or more participants. In-house sessions can be tailored to your organisation's specific industry, risk register, and internal control environment, maximising relevance and immediate applicability.
