Agile Risk Management

Day 1: The Case for Change & Foundations of Agile Risk Management

Session 1: Welcome & Course Overview

• Introduction & Icebreaker:

  • Overview of course objectives, agenda, and participant expectations.

  • Brief discussion on participants’ current risk management practices.

• Setting the Context:

  • Who is at risk? An introduction to the changing risk landscape (cyber, compliance, strategic uncertainty).

Session 2: The Case for Change in Risk Management

• Traditional vs. Dynamic ERM:

  • Analyse the limitations of legacy approaches: annual RCSAs, spreadsheet-driven registers, and siloed systems.

  • Case examples (e.g., the “Rearview Mirror” analogy and the “Black Hole of Risk Management”).

• Interactive Discussion:

  • How static risk models lead to delayed decisions and missed signals.

  • Sharing real-world challenges participants have faced.

Session 3: Introducing “Agile Risk Management”

• Concept Overview:

  • Defining “Agile Risk Management” and the importance of continuous, connected data.

  • The role of risk appetite as a dynamic guardrail.

• Group Exercise:

  • Participants brainstorm how evolving threats (cyber attacks, regulatory changes) require dynamic risk insights.

• Wrap-Up Q&A:

  • Recap key lessons from Day 1 and preview Day 2’s focus on the “engine” of dynamic risk management.

Day 2: The Engine & Processes of Agile Risk Management

Session 4: Inside the Engine – Understanding the Six Core Processes

• Detailed Breakdown of the Six Processes:

  1. RCSAs (Risk & Control Self-Assessments): Transitioning from annual reviews to continuous, contextual assessments.

  2. Risk Metrics and KRIs: Leveraging real-time indicators to capture early signals and validate risk assessments.

  3. Incident and Near-Miss Management: Capturing and categorising events to pre-empt escalation.

  4. Controls Assurance: Ongoing testing and validation of controls through automation and structured attestations.

  5. Issues and Actions: Linking failures and gaps to clear, accountable remedial actions.

  6. Compliance Management & Attestations: Embedding regulatory requirements into everyday processes.

• Interactive Group Activity:

• • Break into small teams to map the six processes onto a sample risk scenario.

• Discussion:

• • How integrated processes enhance visibility, reduce duplication, and improve response times.

Session 5: Operationalising “Agile Risk Management”

• Mapping and Integration:

  • How to assess your current risk landscape and identify gaps.

  • Practical steps to “map the model” to your environment—leveraging existing data sources (registers, assessments, incident logs).

• Aligning People & Processes:

  • Clarifying roles and responsibilities.

  • How to empower frontline teams through real-time data capture and engagement.

• Case Study Analysis:

  • Real-world examples of organisations that have shifted from siloed approaches to a unified, dynamic risk management system.

• Interactive Exercise:

  • Participants outline an operationalisation plan for their own organisation, identifying immediate and long-term actions.

Day 3: Harnessing Real-Time Insights & Making Agile Risk Management Your Reality

Session 6: Seeing Risk in Advance – Dashboards & Reporting Tools

• Dashboard Deep Dive:

  • Walkthrough of an agile risk dashboard: understanding risk health scores, key metrics, and linked items reports.

  • How dashboards convert data into actionable insights (e.g., spotting overdue actions, qualified KRIs, or declining control effectiveness).

• Hands-On Demonstration:

  • Interactive demo (or simulation exercise) where participants interpret dashboard data to make risk-informed decisions.

• Group Discussion:

  • Evaluating the impact of real-time reporting on strategic decision-making and board-level reporting.

Session 7: Making Agile Risk Management a Reality

• Action Planning:

  • Conducting a maturity scan: Where does your organisation stand today?

  • Identifying quick wins and critical areas for change.

• Developing a Roadmap:

  • Prioritising initiatives for incremental implementation.

  • Strategies for sustaining a continuous risk culture and overcoming resistance.

• Interactive Workshop:

  • Teams create a draft action plan incorporating trained concepts, tools, and dashboards into their existing frameworks.

Session 8: Final Q&A, Wrap-Up & Next Steps

• Course Recap:

  • Summarise key takeaways from each day.

  • Revisit the journey from understanding to implementation.

• Open Q&A:

  • Address outstanding participant questions and challenges.

• Next Steps:

  • How to access further resources (e.g.GRC systems demo sessions, additional training material).

  • Feedback session and closing remarks.