Risk management training is aimed at organizations that want to turn risk from a documentation requirement into part of the decision-making mechanism.
Risk-based thinking is the common backbone of the current management system standards. In the field, however, a familiar picture keeps recurring: a risk table filled in once a year, scores that never get updated, and a list that influences no budget decision whatsoever.
This training focuses on building a structure that genuinely manages risk: defining the risk appetite, choosing the appropriate assessment technique, assigning ownership of the action, and monitoring its effectiveness.
Why are risk tables dead on arrival?
Risks are written without a context analysis. A risk list produced without defining the organization’s internal and external issues and stakeholder expectations stays a collection of generic statements.
A risk is written as a topic, not an event. “Supply risk” is not a risk statement. A statement that doesn’t contain the cause–event–effect triad cannot be assessed.
Scoring is done without discussion. When probability and severity scales are not defined, everyone uses a different scale and the results cannot be compared.
Actions are not owned. Measures with no assigned owner and date don’t get followed up.
The opportunity side is neglected. The standards expect opportunity to be addressed alongside risk; in practice this section is often left blank.
Review is not triggered. Risk needs to be reassessed not only at the annual meeting but also on changes, incidents and new projects.
Who should attend?
- Management system and quality officers
- Process owners and department managers
- Internal auditors
- Business continuity, information security and OHS officers
- Project managers
- Risk committee members and top management representatives
There are no prerequisites.
Training Content
Conceptual framework
- The concepts of risk, uncertainty, threat and opportunity
- The place of risk-based thinking within management system standards
- ISO 31000 principles, framework and process
- The relationship between risk management and corporate governance
Context and appetite
- Identifying internal and external issues
- Mapping stakeholders and their expectations
- Defining the risk appetite and the risk acceptance criteria
- Determining the scope of risk management
Risk identification
- Systematically scanning risk sources
- Writing risk statements using the cause–event–effect structure
- Process-level, project-level and enterprise-level risk
- Building the risk inventory
Risk analysis and assessment techniques
- Comparing qualitative and quantitative approaches
- Defining probability and impact scales
- Risk matrix design and common mistakes
- SWOT, scenario analysis and cause-and-effect approaches
- The relationship between FMEA logic and risk management
- Assessing control effectiveness and residual risk
Risk treatment
- Avoidance, mitigation, transfer and acceptance options
- Cost-benefit assessment in choosing measures
- Assigning ownership of the action plan
- Approving the residual risk
Monitoring and integration
- Defining risk indicators
- Review triggers
- The link with the management review and the audit programme
- Connecting risk to budget and investment decisions
Practical exercises
Participants build a risk inventory for a selected process, define scales, carry out the assessment and prepare a treatment plan.
Learning Outcomes
- Embedding risk-based thinking into processes and decision mechanisms
- Moving from context analysis to a risk inventory
- Writing assessable risk statements
- Selecting the appropriate analysis technique and defining scales
- Preparing and monitoring a risk treatment plan
- Linking risk to the audit programme and management review
Duration and Participation Options
Duration: 1 day in open-enrolment programmes. In in-house programmes, planned as 1–2 days.
Level: Practitioner.
Participation type: Open enrolment or in-house.
Training method: In person, live online, on-demand recording.
Certificate of Attendance
Participants who complete the training receive a certificate of attendance.
- FMEA Training
- ISO 9001 Quality Management System Training
- ISO 27001 Information Security Management System Training
- ISO 19011 Audit Training
- Process Management and KPI Design Training
- Root Cause Analysis Training
Beyond Training: Implementation Support
- Context analysis and stakeholder mapping workshop
- Building the enterprise risk inventory
- Adapting the risk scales and matrix to your organization
- Preparing risk treatment plans and setting up the monitoring routine
You can find out more about our consulting services.
Frequently Asked Questions
Are risk-based thinking and risk management the same thing? Risk-based thinking is an approach, and the standards expect it to be spread across all processes. Risk management is the structured, documented system built on that approach.
Can ISO 31000 be certified? No. ISO 31000 is a guidance standard; it is not used for certification purposes. It does, however, offer a solid framework for meeting the risk requirements of management system standards.
Isn’t FMEA enough? FMEA is a strong technique focused on product and process failures, but it doesn’t cover enterprise, financial or supply chain risks. The two complement each other.
Does the risk matrix have to be 5×5? The scale size depends on the organization’s decision-making needs. What matters is not the size but that the levels are defined concretely and repeatably.
How often should we review risks? Alongside planned reviews, changes, incidents, new projects and significant customer requests should also act as triggers.