Skip to content
Quest Training

Enterprise Risk Management (ERM) Auditing Training Course

Enables auditors to assess ERM governance, controls and the processes for identifying, assessing, monitoring and reporting risks across an organisation.

RCA · Internal Audit & Internal ControlsAll Levels#2634ClassroomEnglish , Arabic
Duration
5 Days
Download BrochureView Upcoming Dates

Free substitution at any time · 30+ days' notice: full refund minus 10%. Cancellation policy

Sectors:Risk, Compliance & GovernanceCategories:Internal Audit & Internal Controls

Course Overview

This advanced training course provides a practical framework for auditing Enterprise Risk Management (ERM) systems, focusing on the effectiveness of governance, internal controls, risk identification, assessment, monitoring, and reporting processes. It develops the capabilities required to evaluate how effectively an organisation manages risks that may affect its strategic, operational, financial, and regulatory objectives. The programme examines the relationship between risk management, corporate governance, internal control, and strategic planning. It also explores the responsibilities of the board, executive management, risk management function, and internal audit in establishing effective oversight. Participants review enterprise risk frameworks, risk registers, risk appetite, tolerance thresholds, and key risk indicators. Particular emphasis is placed on planning and conducting risk-based audits, testing the quality of risk assessments, evaluating control effectiveness, analysing residual risks, and reviewing mitigation plans. The course also addresses third-party risks, business continuity, regulatory changes, emerging risks, and the reliability of information used in risk-related decisions. Through practical case studies and applied exercises, participants develop skills in audit planning, evidence collection, control evaluation, root cause analysis, and reporting to senior management and audit and risk committees. The programme supports stronger accountability, continuous improvement, and more effective enterprise risk management.

Learning Objectives

  • Develop an integrated auditing methodology for enterprise risk management frameworks.
  • Evaluate the alignment of risk management with organisational strategic objectives.
  • Review governance responsibilities and oversight arrangements for enterprise risks.
  • Assess risk identification, classification, analysis, and prioritisation methodologies.
  • Examine risk registers, risk appetite, tolerance thresholds, and key risk indicators.
  • Test the design and operating effectiveness of internal controls.
  • Evaluate residual risks and the adequacy of mitigation plans.
  • Apply risk-based auditing techniques to plan and execute audit engagements.
  • Analyse emerging risks, third-party exposures, and business continuity risks.
  • Evaluate the quality and relevance of risk reporting for management decisions.
  • Identify control weaknesses, root causes, and practical corrective actions.
  • Establish follow-up mechanisms to monitor remediation and improvements in risk management effectiveness.

Who Should Attend

Internal and External Audit Managers Internal Auditors and Risk Auditors Enterprise Risk Managers Governance and Compliance Officers Internal Control Managers Financial and Operational Risk Professionals Quality and Corporate Control Managers Business Continuity Professionals Audit and Risk Committee Members Finance and Operations Managers Risk and Governance Consultants Senior Executives responsible for risk management and internal controls

Learning Outcomes

  • Develop a risk-based audit plan for enterprise risk management.
  • Evaluate the design and implementation of the organisation's ERM framework.
  • Assess the allocation of governance, risk management, and oversight responsibilities.
  • Review risk registers and verify the completeness and consistency of risk assessments.
  • Evaluate the alignment of risk appetite and tolerance thresholds with organisational objectives.
  • Test the design and effectiveness of preventive, detective, and corrective controls.
  • Assess residual risks and determine whether mitigation plans are adequate.
  • Collect, analyse, and document audit evidence in a traceable manner.
  • Identify weaknesses in risk reporting, escalation, and management oversight.
  • Evaluate the integration of risk management with strategic planning and internal control.
  • Prepare audit reports covering findings, root causes, risk implications, and recommendations.
  • Develop follow-up plans to verify corrective action implementation and effectiveness.

Course Outline

Day 1

Enterprise Risk Management Framework & Governance

  • ERM principles, concepts, and objectives
  • The role of enterprise risk management in strategy execution
  • Relationships between risk management, governance, and internal control
  • Responsibilities of the board, executive management, and risk committees
  • Roles of the risk management function, internal audit, and control functions
  • Review of established enterprise risk management frameworks and methodologies
  • Assessment of the organisation's internal and external context
  • Classification of strategic, operational, financial, and regulatory risks
  • Risk appetite, tolerance thresholds, and escalation requirements
  • Integrating risk management into organisational decision-making
  • Assessing the maturity of the ERM framework
  • Practical Application: Conduct an initial assessment of an organisation's ERM framework and identify governance weaknesses and gaps in accountability.
Day 2

Risk-Based Audit Planning & Control Evaluation

  • Principles of risk-based auditing
  • Defining audit scope, objectives, and evaluation criteria
  • Developing risk and control matrices
  • Reviewing risk identification and likelihood-impact assessment methodologies
  • Examining risk registers and validating data completeness
  • Evaluating control design and its relationship to identified risks
  • Testing control effectiveness using sampling and supporting evidence
  • Assessing segregation of duties and delegated authorities
  • Analysing residual risks after controls are applied
  • Reviewing mitigation plans, responsibilities, and implementation deadlines
  • Prioritising areas requiring further audit attention
  • Practical Application: Develop a risk and control audit matrix and define the tests required to evaluate control effectiveness.
Day 3

Auditing Risk Identification, Assessment & Monitoring

  • Reviewing risk identification and update processes
  • Evaluating qualitative and quantitative risk assessment methods
  • Verifying consistency in risk ratings and classifications
  • Reviewing risk appetite and key risk indicators
  • Assessing early warning indicators and escalation mechanisms
  • Analysing residual and cumulative risks
  • Reviewing third-party and supply chain risks
  • Assessing business continuity and recovery arrangements
  • Examining emerging risk monitoring and regulatory change processes
  • Reviewing scenario analysis and stress testing where appropriate
  • Evaluating the quality of data used in risk reporting
  • Practical Application: Review an enterprise risk register and identify weaknesses in assessment methods, indicators, monitoring, and escalation.
Day 4

Audit Testing, Evidence Evaluation & Findings Analysis

  • Collecting audit evidence and assessing its reliability
  • Conducting interviews and reviewing documents and records
  • Testing compliance with risk management policies and procedures
  • Verifying that controls operate as designed
  • Evaluating evidence supporting risk assessments
  • Identifying gaps between documented policies and actual practices
  • Analysing the root causes of control failures and unresolved risks
  • Assessing the financial, operational, and regulatory implications of findings
  • Classifying findings according to significance and risk exposure
  • Developing findings based on criteria, evidence, impact, and root cause
  • Formulating practical recommendations proportionate to risk
  • Practical Application: Analyse the results of a simulated ERM audit, identify control weaknesses and root causes, and prioritise corrective actions.
Day 5

ERM Audit Reporting, Follow-Up & Continuous Improvement

  • Preparing enterprise risk management audit reports
  • Prioritising findings according to significance and impact
  • Presenting findings to executive management and relevant stakeholders
  • Preparing reports for audit and risk committees
  • Defining recommendations, accountable owners, and implementation deadlines
  • Developing indicators to measure ERM effectiveness
  • Monitoring corrective actions and verifying their effectiveness
  • Addressing recurring findings and unacceptable residual risks
  • Assessing improvements in enterprise risk management maturity
  • Strengthening coordination between internal audit, risk management, and compliance
  • Capturing lessons learned and updating future audit programmes
  • Final Workshop: Develop a complete ERM audit file covering the audit plan, risk and control matrix, test results, root cause analysis, final report, and corrective action follow-up plan.

Upcoming Dates

Selected date

Kigali · 11 – 15 Oct 2027 · Classroom

Need more details?Chat with us on WhatsApp

CityDatesPrice per ParticipantEarly Bird
Sharm El-SheikhScheduled
2 – 6 Nov 2026€4,300—
SelectDownload Brochure
ParisScheduled
2 – 6 Nov 2026€5,700—
SelectDownload Brochure
SingaporeScheduled
9 – 13 Nov 2026€6,700—
SelectDownload Brochure
ViennaScheduled
16 – 20 Nov 2026€5,700—
SelectDownload Brochure
AmmanScheduled
22 – 26 Nov 2026€3,100€2,790until 2 Nov
SelectDownload Brochure
RiyadhScheduled
23 – 27 Nov 2026€4,200€3,780until 2 Nov
SelectDownload Brochure
AmsterdamScheduled
30 Nov – 4 Dec 2026€5,400€4,860until 9 Nov
SelectDownload Brochure
BarcelonaScheduled
30 Nov – 4 Dec 2026€5,400€4,860until 9 Nov
SelectDownload Brochure
CairoScheduled
7 – 11 Dec 2026€3,300€2,970until 16 Nov
SelectDownload Brochure
CasablancaScheduled
14 – 18 Dec 2026€4,300€3,870until 23 Nov
SelectDownload Brochure
SalalahScheduled
14 – 18 Dec 2026€5,300€4,770until 23 Nov
SelectDownload Brochure
DammamScheduled
21 – 25 Dec 2026€4,200€3,780until 30 Nov
SelectDownload Brochure
DohaScheduled
28 Dec 2026 – 1 Jan 2027€4,400€3,960until 7 Dec
SelectDownload Brochure
DubaiScheduled
3 – 7 Jan 2027€4,400€3,960until 14 Dec
SelectDownload Brochure
AbujaScheduled
4 – 8 Jan 2027€5,100€4,590until 14 Dec
SelectDownload Brochure
FrankfurtScheduled
11 – 15 Jan 2027€5,800€5,220until 21 Dec
SelectDownload Brochure
GenevaScheduled
11 – 15 Jan 2027€6,300€5,670until 21 Dec
SelectDownload Brochure
IstanbulScheduled
18 – 22 Jan 2027€4,700€4,230until 28 Dec
SelectDownload Brochure
AccraScheduled
18 – 22 Jan 2027€5,100€4,590until 28 Dec
SelectDownload Brochure
JeddahScheduled
24 – 28 Jan 2027€4,200€3,780until 4 Jan
SelectDownload Brochure
Kuala LumpurScheduled
1 – 5 Feb 2027€4,400€3,960until 11 Jan
SelectDownload Brochure
LisbonScheduled
8 – 12 Feb 2027€5,400€4,860until 18 Jan
SelectDownload Brochure
BakuScheduled
8 – 12 Feb 2027€4,800€4,320until 18 Jan
SelectDownload Brochure
LondonScheduled
15 – 19 Feb 2027€5,600€5,040until 25 Jan
SelectDownload Brochure
MadinahScheduled
22 – 26 Feb 2027€4,200€3,780until 1 Feb
SelectDownload Brochure
MadridScheduled
1 – 5 Mar 2027€5,400€4,860until 8 Feb
SelectDownload Brochure
MakkahScheduled
1 – 5 Mar 2027€4,200€3,780until 8 Feb
SelectDownload Brochure
BangkokScheduled
1 – 5 Mar 2027€6,100€5,490until 8 Feb
SelectDownload Brochure
ManamaScheduled
8 – 12 Mar 2027€4,700€4,230until 15 Feb
SelectDownload Brochure
MarbellaScheduled
15 – 19 Mar 2027€5,400€4,860until 22 Feb
SelectDownload Brochure
KigaliScheduled
11 – 15 Oct 2027€5,100€4,590until 20 Sept
✓ SelectedDownload Brochure

Available in: Istanbul · Dubai · London · Riyadh · Doha · Amsterdam

Related Courses

Ready to Elevate Your Team's Capabilities?

Speak with our advisors about upcoming programmes or a bespoke corporate training plan.

Download BrochureContact Our Team