Day 1: Preparing the Assessment and Identifying Risks

Assessment Purpose and Scope

• Define unit, process, review period
• Connect scope with objectives and outputs
• Identify knowledgeable stakeholders requiring participation
• Prepare risk-assessment session and evidence sources

Sources of Risk Identification

• Use incident, complaint, audit, change data
• Ask questions exposing threats to objectives
• Distinguish emerging risk from existing issue
• Generate list from multiple evidence sources

Risk Statement and Classification

• Write cause event and consequence clearly
• Avoid confusing risks with controls
• Apply classifications supporting aggregation and reporting
• Review risk descriptions of uneven quality

Day 2: Measurement, Controls, and Residual Risk

Calibrating Likelihood and Impact

• Define descriptive anchors per rating level
• Consider several impact dimensions where required
• Avoid changing scales by personal preference
• Calibrate a set of risks collectively

Conducting Control Assessment

• Identify pre-event and post-event controls
• Evaluate control design ownership and evidence
• Avoid assuming policy proves control effectiveness
• Assess controls for one selected risk

Inherent and Residual Exposure

• Estimate exposure before and after controls
• Explain differences without artificial calculations
• Compare residual risk against approved tolerance
• Complete one full assessment card

Day 3: Prioritization and Assessment Outputs

Applied Management Priority

• Combine rating, velocity, interdependence, management concern
• Highlight low-likelihood risks with severe consequences
• Identify matters requiring decision or monitoring
• Rank risk register by management priority

Register Quality and Data Ownership

• Assign risk owners and update sources
• Record assessment date and key assumptions
• Remove duplicates across similar risk statements
• Clean a register before management presentation

Presenting Assessment Results

• Summarize highest exposures and common drivers
• Use heat maps carefully; explain limitations
• Identify treatments and decisions requiring approval
• Deliver concise assessment briefing to management

• Risk self-assessment sessions using real objectives and processes
• Group calibration of likelihood impact and control effectiveness
• Register-cleaning exercises removing duplication and weak wording
• A final management briefing covering key risks and priorities