Day 1: Foundations of Operational Risk Management
Session 1: Operational Risk Management Overview
- Defining operational risk and its components.
- Differentiating between operational and strategic risks, focussing on the alignment between strategic objectives, strategic risks, control processes and operational risk.
- Exploring the 11 elements of effective operational risk management.
- Case study: Examples of operational risk failures and successes.
Session 2: COSO ERM Framework for Operational Risk
- Overview of COSO ERM principles.
- Applying the framework to operational risk scenarios and exploring the 20 principles.
- Interactive exercise: Identifying risks using COSO principles. Populate the templates provided to identify, measure, mitigate risk and assess the effectiveness of controls.
Session 3: Risk Appetite and Tolerance
- Defining and setting operational risk appetite.
- Align key risk indicators with key performance indicators.
- Aligning risk tolerance with organizational objectives.
Session 4: Inherent vs. Residual Risk
- Defining and differentiating inherent and residual risks. Criteria for likelihood and impact. Root cause analysis and the Pareto principle.
- Assessing the effectiveness of controls in reducing risk. Explore different risk management strategies.
- Workshop: Assessing inherent and residual risks based on the effectiveness of internal controls.
________________________________________________________________________________________
Day 2: Advanced Practices and Regional Insights
Session 5: Aligning Risk and Performance
- Linking operational risk management with performance metrics.
- Using key risk indicators (KRIs) and key performance indicators (KPIs).
- Understanding the relationship between KPI’s and variation in performance.
- Understanding how risk appetite can be used to inform Board decisions.
- Case study: Balancing risk and performance in operational decision-making.
Session 6: IIA INC Best Practices in Operational Risk
- Internal audit’s role in operational risk management. Independent assurance
- Combined assurance for effective oversight. The roles of the three lines in combined assurance.
- Practical examples: Auditing operational risk processes, flowcharting, identification of key controls, automated versus manual controls, prevention versus detection controls.
Session 7: Regional Insights and the 2024 IRMSA Risk Report
- Key findings and trends from the 2024 IRMSA Risk Report. Alignment with emerging risks.
- Addressing operational risks specific to the SADC region. Alignment with new and emerging risks.
- Group exercise: Identifying and prioritizing regional operational risks.
Session 8: Building an Operational Risk Management Plan
- Participants design an operational risk management framework tailored to their organizations.
- Operational risk reporting – development of operational risk dashboards and reporting.

