Risk Management in Practice: ISO 31000 for Your Area
Inquiry This course is not yet bookable.
Identify risks in your area and prepare management decisions on whether to treat or accept them. Your risk register sets out causes and consequences; your treatment plan records responsibilities, resources and decisions still needed.
Build a risk register and treatment plan for your area using ISO 31000 as a reference. Describe causes and consequences, set assessment criteria and assign tasks, resources and review dates. Work with authorised organisational information or a substitute case.
In the course case, failure of a sole supplier and misdirected confidential customer data receive the same risk rating. Compare their different causes and consequences and choose suitable treatments, such as a qualified alternative supplier and an approval check. Keep the register for ongoing action tracking.
What you will work on
You define the scope, decision rights and data gaps of a risk register in a traceable way.
You prioritise risks using stated criteria and justify dependencies and assumptions.
You compare causes and consequences of equally rated risks and choose suitable treatments.
Who it is for
Risk owners in business units
Heads of department and business units
Risk management officers
Topics
Scope, mandate and interfaces of risk management
Risk criteria, assessment scales and handling data uncertainty
Risk register: cause, event, impact and link to objectives
Prioritisation, risk aggregation and dependencies
Treatment options, ownership, resources and effectiveness review
Management reporting, decision papers and escalation
Your result
Your risk register records causes, consequences and ratings for your area. The treatment plan identifies who owns each action and when it will be reviewed.
Prerequisites
A basic understanding of objectives, processes and responsibilities in your own area; access to objectives, process data and existing risk information, or willingness to use a course case. A mandate to prepare the work, not to approve budget or risk appetite, should be clear.
Format and approach
Planned: 8–10 hours of digital self-study. Criteria, annotated examples and self-checks support your draft; live discussion or coaching are outside the core format.
Plan the annual information security programme for your area: which objectives and risks come first, and what actions and resources are needed? A management review template helps you present the decisions and supporting evidence to leadership.
Plan the start of an information security management system (ISMS) for a defined area. Establish its scope, protection objectives and roles, and record initial risks and actions. You can take the resulting concept forward with the people responsible in your organisation.
AI governance needs clear decision rights for business owners, security, operations and other control functions. You jointly design approval and ongoing controls for an AI use case. Using a case, you practise reviewing results, handling deviations and repeating checks after changes.