Enterprise Risk Management (ERM)

Most enterprise risk management produces a register with a heat map attached and no evidence that anything was decided differently because of it. The usual causes are a register built in a workshop and never revisited, risks described so generally that no control could address them, appetite expressed as a sentence rather than a limit, and reporting sent to a committee with no authority to act. This week is about the parts that bite: writing a risk so it is actionable, setting appetite with numbers, and connecting risk to the decisions the organisation actually takes.

It runs 7 times over the published calendar, in 6 cities and live online. Every date is the same programme with the same content and the same certificate.

• Write a risk so that a specific control could address it.
• Assess likelihood and impact without producing a false quantification.
• Express appetite and tolerance as limits somebody can breach.
• Connect a risk to the decision, project or budget it should influence.
• Report so that a decision follows rather than an acknowledgement.

Risk managers and officers, executives accountable for a risk area, internal auditors who assess the framework, and board and committee members who receive the reporting.

Short input, then work. Across 5 days of roughly 6 teaching hours each, the balance sits deliberately with the second: a programme where the trainer talks for six hours produces notes rather than capability.

• Your own material

  Exercises run on situations delegates bring, not on a case study written for a different organisation in a different decade.

• A capped cohort

  Small enough that everybody is asked something. Executive programmes are capped tighter still.

• Practice under scrutiny

  The difficult conversation, the challenged assumption, the decision defended out loud. Judgement is not built by watching.

• Something to take back

  Each day ends with a thing you can use on Monday rather than a slide deck you will not reopen.

• A rewritten extract of the delegate's own register, in actionable terms.
• An appetite statement with quantified tolerances for two or three risks.
• A reporting format aimed at the decisions the recipient can actually take.

A GATI certificate recording what you attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended.

Every certificate carries a code that anybody can check against GATI's own record, which is what makes it worth holding. It records participation. This site will not imply one it does not have.