Governance, Risk, Quality & Resilience
Enterprise Risk, Governance and Internal Control
A five-day programme that treats risk as a decision discipline rather than a reporting exercise. It covers identification and assessment, appetite expressed in terms that change decisions, control design and rationalisation, escalation that produces action, and the evidence standard that makes control effectiveness assessable.
The business challenge
Why organisations commission this programme
Many organisations maintain a complete risk framework and are still surprised. Registers are updated for governance rather than used for management, appetite is described rather than applied, controls accumulate without rationalisation, and escalation produces discussion rather than decisions. The framework is compliant and the organisation is not protected.
A risk framework exists on paper, registers are maintained, and the organisation is still surprised — because risk is treated as a reporting exercise rather than as a decision discipline.
Who it is for
Participants
- Audience
- Risk, audit, compliance and quality professionals, and line managers who own risks and controls
- Recommended cohort
- 12 to 18 participants
- Prerequisites
- Risk, audit, compliance or quality role, or line accountability for risks and controls. No prior qualification assumed.
Outcomes
What participants will be able to do
- Apply a risk framework end to end: identification, assessment, treatment, ownership, escalation and reporting.
- Articulate risk appetite in terms that change decisions rather than describe attitudes.
- Design and rationalise controls, with named owners and defined evidence expectations.
- Connect risk reporting to governance so that escalation produces decisions.
- Evaluate control effectiveness and drive corrective action to closure.
Learning objectives
- Build working capability in the full risk cycle rather than in register maintenance.
- Express risk appetite in operational terms that visibly change decisions.
- Improve control design, ownership and the evidence expected of control operation.
- Connect risk reporting to governance so that escalation produces a decision.
Indicative content
Programme structure
Content is confirmed during design and adapted to your context.
Day 1
Risk concepts, the client framework, roles and three lines; baseline assessment.
- Risk concepts and the client framework
- Roles and three lines
- Risk culture and behaviour
- Baseline assessment
Day 2
Identification and assessment: methods, scoring, bias, aggregation and emerging risk.
- Identification techniques
- Assessment and scoring
- Bias and aggregation
- Emerging and interconnected risk
Day 3
Treatment, control design and rationalisation, ownership and evidence standards.
- Treatment options
- Control design and rationalisation
- Ownership and accountability
- Evidence expectations
Day 4
Governance, escalation, appetite in practice, and risk reporting that drives decisions.
- Appetite in practice
- Escalation thresholds
- Risk reporting that drives decisions
- Governance interface
Day 5
Control effectiveness, assurance, corrective action and an applied risk and control workshop with assessment.
- Control effectiveness testing
- Assurance and corrective action
- Applied risk and control workshop
- Assessment
Delivery and customisation
Configured around your organisation
- Typical duration
- Five days
- Formats
- Classroom or blended
- Language
- English by default. Other languages subject to facilitator availability and materials translation, agreed during design.
How it can be tailored
- Client risk framework, appetite statements, scoring scales and live registers.
- A real process selected with the sponsor as the running case.
- The control catalogue and existing assurance arrangements.
- Sector regulatory obligations and any applicable external framework.
- Emphasis adjusted between first-line owners and second-line professionals.
Methods
- Work on the client's own framework, appetite statements and live registers throughout.
- A real organisational process used as the running case for risk and control assessment.
- Challenge sessions in which participants test one another's risk statements for precision and ownership.
- Scenario work on escalation decisions, including risks that cross functional boundaries.
Materials, assessment and completion
Materials
- Participant workbook containing session content, frameworks, exercises and space for applied work.
- Client-contextualised case material and scenario packs used during the programme.
- Job aids, checklists and templates designed for use in the role after the programme.
- Assessment instruments and the marking criteria applied to them.
- Individual action plan template and a manager briefing note.
- Risk statement standard, control design template and an effectiveness testing guide.
Reinforcement
- Individual action plans agreed during the programme and shared with line managers where the client permits.
- Manager briefing material setting out what was taught and what should be reinforced in the role.
- Toolkits and templates issued in editable form for continued use.
- Follow-up session at 30, 60 or 90 days where commissioned, reviewing action-plan progress and obstacles.
- Review of rewritten registers and rationalised controls at 90 days, where commissioned.
Completion
- Attendance at no less than 80 per cent of scheduled contact time, recorded daily and reconciled against the registered cohort.
- Participation in the assessed practical components of the programme.
- Submission of the assessed work product and the individual action plan.
- Achievement of the assessment threshold where the client sets one; where no threshold is set, results are reported without a pass or fail determination.
Participants who meet the completion criteria receive a Knull certificate of completion recording the programme, dates, duration, content covered and, where assessed, the assessment outcome. Knull does not award accredited or regulated qualifications and does not hold third-party training accreditation. Attendance and assessment records are retained under the engagement terms and provided to the client with the completion report.
| Component | Weighting | Basis |
|---|---|---|
| Baseline and post assessment | 30% | Knowledge instrument administered before and after, reported as learning gain. |
| Risk and control assessment | 45% | Precision of risk statements, control logic, ownership, evidence standard and proposed actions, marked against a rubric. |
| Appetite application exercise | 15% | Quality of reasoning in applying appetite to a real decision and in identifying gaps in the statements. |
| Individual action plan | 10% | Specificity and realism of committed changes to the participant's own risk and control practice. |
Next step
Make it fit your organisation
Dates, cohort, format and fees are agreed in a proposal once scope is defined. To register interest in a closed cohort, use a corporate booking request — Knull reviews every request; it is not a confirmed reservation.
Related
You may also consider
Business Continuity and Organisational Resilience
A three-day programme built around a live scenario exercise. It covers impact analysis that identifies genuine dependencies, continuity arrangements with realistic recovery objectives, and decision-making under disruption — tested rather than described.
Strategic Leadership for Senior Managers
A five-day intensive for senior managers accountable for delivering a strategy they did not author, in conditions they do not fully control. The programme works on three things: converting strategy into a small number of executable priorities, deciding well with incomplete information, and holding people through the period in which a change is correct but not yet popular.
Management Essentials for New and Developing Managers
A five-day foundation for people who have recently become managers, commonly delivered as two blocks so that participants can apply the first block before returning. It covers the transition from doing to managing, operational control, performance conversations and the routines that make a team function.
Discuss this programme for your organisation
Tell us about your priorities, capability gaps or business challenges. We'll help identify an appropriate next step.