Certificate in Enterprise Risk Management
Risk Assessment Techniques
A comprehensive 10-module program based on ISO 31000:2018 — from foundational risk concepts through qualitative and quantitative analysis to building a risk-aware culture. Full lesson content for study and reference.
Overview
This Certificate in Enterprise Risk Management provides a comprehensive, practitioner-focused education in risk assessment techniques based on ISO 31000:2018 — the international standard for risk management. The program covers the full risk management lifecycle: from establishing context and identifying risks through qualitative and quantitative analysis, risk evaluation, treatment planning, and building a risk-aware organisational culture.
ISO 31000 defines risk as the effect of uncertainty on objectives — effects can be positive (opportunities) or negative (threats). The standard provides principles, a framework, and a process that organisations can adopt and adapt across any industry or sector. This course delivers the knowledge needed to apply these concepts in practice.
📚 Course Modules
Foundations of ERM
The nature of risk, ISO 31000 framework overview, three pillars (principles, framework, process), eight principles, types of risk (strategic, operational, financial, compliance, reputational, project, ESG, emerging), and the risk management lifecycle.
The ISO 31000 Process
Communication and consultation, scope/context/criteria, risk assessment overview, risk treatment, monitoring and review, recording and reporting. Establishing external and internal context, defining risk criteria and appetite.
Risk Identification Techniques
Brainstorming, structured interviews, SWOT and PESTLE analysis, bow-tie analysis, checklists and prompt lists, process mapping, cause-and-effect (Ishikawa) diagrams, and Failure Mode and Effects Analysis (FMEA).
Qualitative Risk Analysis
Likelihood and consequence scales (5-point), risk rating matrices (5×5), heat maps, inherent vs residual risk assessment, control effectiveness evaluation, and worked examples with real-world construction scenarios.
Semi-Quantitative & Quantitative
Weighted scoring systems, Risk Priority Numbers (RPN), expected value calculations, probability distributions (normal, triangular, lognormal, PERT), Monte Carlo simulation, and Value at Risk (VaR).
Risk Evaluation
Setting risk criteria and appetite (appetite, tolerance, threshold, capacity), comparing risk levels against criteria, the ALARP principle (As Low As Reasonably Practicable), prioritisation factors, and communicating evaluation results.
Risk Treatment
The five treatment options (avoid, reduce, share/transfer, accept, exploit), developing treatment plans, cost-benefit analysis of controls, residual risk assessment, and treatment effectiveness monitoring.
Sector Applications
Enterprise/organisational risk (ERM frameworks: ISO 31000, COSO, AS/NZS 4360), project risk management (RAID logs, schedule risk), supply chain and third-party risk, IT/cybersecurity risk (ISO 27001, NIST CSF), and HSE risk (safety cases, environmental).
Risk Registers & Reporting
Designing risk registers (19 fields), Key Risk Indicators (KRIs) with RAG thresholds, escalation pathways, risk reporting hierarchy (frontline to board), board-level reporting, and GRC integration.
Building a Risk-Aware Culture
Leadership and accountability, risk ownership, embedding risk in decision-making (7 decision types), training and communication strategies, continuous improvement, learning from incidents, and ISO 31000 audit considerations.
📘 The ISO 31000:2018 Framework
ISO 31000 is the international standard for risk management — principles-based, non-prescriptive, and applicable to any organisation, industry, or sector.
The Eight Principles
Embedded in all organisational activities
Consistent, comparable, reliable results
Tailored to context and objectives
Involving stakeholders at all levels
Responsive to changing context
Data, judgement, and observation
Behaviour shapes risk management
Learning and improving over time
The Risk Management Lifecycle
🔧 Risk Assessment Techniques Covered
📊 Risk Rating Matrix
5×5 likelihood-by-consequence grid producing risk scores from 1–25. Four risk bands (Low 1–4, Medium 5–9, High 10–14, Extreme 15–25). Includes matrix design variations and documented limitations.
🎯 Monte Carlo Simulation
Thousands of iterations sampling from probability distributions. Applied to project schedule and cost risk, financial modelling, insurance, and supply chain quantification. Produces full outcome distributions.
🔀 Bow-Tie Analysis
Visual technique mapping causes (threat tree) and consequences around a central risk event. Preventive barriers on the left, mitigative barriers on the right. Highly intuitive for non-technical stakeholders.
⚙️ FMEA
Failure Mode and Effects Analysis — systematic bottom-up technique. Rates Severity × Occurrence × Detectability (1–10 each) producing Risk Priority Numbers (RPN) from 1–1,000 for failure prioritisation.
🐟 Ishikawa / Fishbone
Cause-and-effect diagrams identifying root causes using the 6M categories: Methods, Machines, Materials, Measurement, Man, and Mother Nature. Structured approach to root cause analysis.
🌐 SWOT & PESTLE
SWOT for strategic-level risk identification (weaknesses and threats). PESTLE (Political, Economic, Social, Technological, Legal, Environmental) for systematic external environment scanning.
🛡️ The Five Risk Treatment Options
1. Avoid the Risk
Decide not to start or continue the activity. Used when risk exceeds capacity to manage or benefits don't justify the exposure.
2. Reduce / Modify
Take action to reduce likelihood, consequence, or both. The most common treatment option. Requires cost-benefit justification.
3. Share / Transfer
Transfer financial consequences to a third party — insurance, subcontracting, hedging. The risk event itself is not transferred, only the impact.
4. Accept / Retain
Consciously retain the risk. Can be active (with contingency plan) or passive. Must be a documented decision, not a failure to act.
5. Exploit (Opportunity)
For positive risks, actively pursue and enhance the upside. Invest more heavily to capture competitive opportunity, accepting associated downside exposure.
📝 Assessment Structure
Assessment 1
40%Risk Assessment Practical Exercise
Establish context, conduct structured risk identification (2+ techniques), complete qualitative analysis, evaluate and prioritise, develop treatment plan for top 3 risks. Deliverable: completed risk register + 500-word methodology narrative.
Assessment 2
35%Case Study Analysis
Analyse a published case study of a significant risk event. Identify risks, evaluate treatment options, assess management failures, recommend improvements. Deliverable: 1,500–2,000 word written analysis with ISO 31000 references.
Assessment 3
25%Theory Examination
90-minute closed-book exam. Section A: 20 multiple-choice (20 marks). Section B: 4 short-answer questions, 150–200 words each (40 marks). Section C: 1 extended scenario response (40 marks).
Course Specifications
Standards
- ✓ ISO 31000:2018
- ✓ COSO ERM 2017
- ✓ ISO 27001 (Cyber)
- ✓ NIST CSF
Techniques
- ✓ Risk Rating Matrix (5×5)
- ✓ Monte Carlo Simulation
- ✓ Bow-Tie Analysis
- ✓ FMEA / RPN Scoring
Sectors
- ✓ Enterprise / Corporate
- ✓ Projects & Construction
- ✓ Supply Chain & Third-Party
- ✓ IT / Cybersecurity / HSE
Assessment
- ✓ Practical Exercise (40%)
- ✓ Case Study Analysis (35%)
- ✓ Theory Examination (25%)
- ✓ 10 Modules · Full Content
Build Your Risk Management Capability
Equip your team with internationally recognised risk assessment skills based on ISO 31000:2018. Contact Enterprise Systems Australia to discuss delivery for your organisation.
Certificate in Enterprise Risk Management — Based on ISO 31000:2018 Risk Management Guidelines
© 2026 Enterprise Systems Australia |