How this hub helps your teams
Turn risk awareness into action with training that's relevant to each role across your organsiation.
-
Compliance, Risk and Governance professionals:
Strengthen risk management programmes with expert training that helps teams understand their responsibilities and apply effective controls. -
Managers and Team Leaders:
Build the confidence to identify and respond to risks within teams with relevant training that reflects the decisions and situations they face. -
Employees at all levels:
Recognise risks earlier and make informed decisions with practical training that helps with understanding the risks relevant to different roles.
Conduct Risk
The FCA judges firms on customer outcomes, and outcomes are produced by thousands of small decisions taken by people who are not thinking about regulation at the time. That is what makes conduct risk hard to control through policy alone. This course gives staff the vocabulary to recognise a conduct issue while it is still a choice rather than a complaint.
Operational Risk
Operational risk frameworks usually fail at the reporting layer, not the design layer, because staff never learned what counts as a risk event worth escalating. A shared way of describing cause and consequence fixes more of that than another policy revision will. This course gives every function the same language, which is what makes aggregated risk data mean something to a board.
Conduct Risk
Conduct risk is easy to state and hard to operationalise. Teams that never handle a customer directly still shape the outcome, through pricing, process design, service levels and the way exceptions get handled. Extending this training beyond customer-facing roles is what stops conduct risk being treated as a front-office concern, and it strengthens the outcomes evidence your firm reports upward.
Risk Management
Risk registers age badly when they belong to one team. Organisations that manage risk well are the ones where operational staff escalate early because they know what the framework does with the information. Spreading that understanding wide enough is the difference between a risk framework that informs decisions and one that merely documents them after the fact.
Risk Assessment
Assessment output shapes risk appetite, and risk appetite shapes almost every governance decision that follows. When assessments are inconsistent, the aggregated picture the board sees is wrong in ways nobody can see. Training staff on a common method is the least glamorous and most effective improvement available to a risk programme, and it makes comparison across business units meaningful.
Cyber Risk
Technical controls fail at the point where a person makes a decision, which is why attackers spend their effort there. Regulators now treat cyber resilience as a governance matter rather than an IT matter, and expect board-level oversight. Training all staff rather than the technology function alone is the control that scales, and it is the one supervisors ask to see evidenced.
Risk Identification
Poorly worded risks are worse than missing ones because they create false confidence. A register full of vague statements cannot be assessed, prioritised or assigned. Teaching staff to separate cause from event from consequence is a small discipline with a large effect on the quality of everything downstream, including your board reporting and your control testing.
Business Travel Risk
Duty of care does not pause at the airport. Employers remain responsible for staff safety abroad, and that responsibility is tested when something goes wrong in a location where support is thin. Briefing travellers properly before departure is far cheaper than managing an incident remotely, and it gives your organisation a documented position on how it discharges that duty.
Developing Secure Applications
Vulnerabilities introduced in development are the cheapest to fix and the most expensive to ignore. Security testing at the end of a pipeline finds what is already built. For firms subject to DORA, NIS2 or supplier security assessments, evidence that development teams are trained in secure practice is increasingly requested directly, not inferred from your policy set.
ESG Risk
ESG risk has moved from a reporting exercise to a financial one, affecting cost of capital, insurance terms, supply chain access and litigation exposure. Treating it as a disclosure problem leaves the underlying risk unmanaged. This course puts ESG into the same risk language your organisation already uses elsewhere, which makes it possible to prioritise rather than simply report.
Business Continuity Management
Continuity plans are written by a small group and executed by everyone, usually at short notice and under stress. If staff first encounter the plan during an incident, it will not work as designed. Training the wider workforce is what converts documentation into capability, and it supports the resilience expectations that now apply across financial services and beyond.
Risk Appetite
A risk appetite statement approved by the board and unknown to the business achieves nothing. Appetite only functions when the people making operational decisions can tell whether a proposal sits inside it. This course pushes that understanding down to where the decisions happen, which is the difference between appetite as governance language and appetite as a working constraint.
Risk Treatment
Treatment decisions are where risk management either earns its place or becomes an overhead. Controls added without weighing cost against benefit slow the business and rarely get followed. Teaching staff to think in terms of proportionate response produces a control environment people actually use, and gives internal audit something more useful to test than whether a control exists.
Risk Reporting
Boards make decisions on what reaches them, and what reaches them depends on people at the operational level judging what is worth reporting. Poor input cannot be corrected further up the chain. Training staff on what good risk reporting looks like improves the raw material, which does more for governance quality than another layer of review ever will.
Risk Monitoring
Risk registers describe the world as it was on the day someone last reviewed them. Between reviews, exposures move and controls degrade quietly. Building monitoring awareness across the business means changes get noticed by the people closest to them rather than at the next quarterly cycle, which is usually the difference between managing a risk and reporting an incident.
Credit Risk for Financial Firms
Credit risk concentrates quietly. Exposures built individually look reasonable until they are aggregated against a common driver, and by then the position is hard to unwind. Giving staff beyond the credit function a working understanding of how exposure accumulates improves the quality of what gets escalated, and supports the risk culture prudential supervisors expect to see.
Credit Risk for Non-Financial Firms
In non-financial businesses credit risk usually sits with finance and is invisible to the commercial teams creating it. A large order from a weak counterparty looks like good news until it is not paid. Giving sales, procurement and operations a working grasp of the exposure they generate improves the quality of the decisions taken before a contract is signed.
Continual Improvement of Risk Management
Frameworks decay in predictable ways: the register stops matching the business, controls persist after the risk has moved, and incidents produce reports rather than changes. Building improvement into the cycle rather than into an annual review is what keeps the framework worth maintaining. It is also what supervisors look for when assessing whether risk management is genuinely embedded.
Introduction to Risk
Risk frameworks fail early when people cannot separate a cause from an event or an issue from a risk. Everything built on top of that confusion, including the register, the appetite statement and the board report, inherits the problem. Establishing shared definitions across the business is the cheapest improvement available to a risk function, and it makes every later stage of the framework work better.
Third-Party Risk
Concentration is the part firms underestimate. Several suppliers can depend on the same underlying provider, so a single failure removes what looked like a diversified arrangement. Regulators now ask about that directly. Training staff who select, onboard and manage suppliers gives your organisation the visibility a contract review alone will never produce.
Physical and Personal Security Risk
Physical security is often assumed to be someone else's responsibility, which is precisely what tailgating and social engineering rely on. The person holding the door open is the control that failed. Building awareness across the workforce protects staff directly and closes the entry route that defeats access control systems, which matters more as physical and cyber intrusion increasingly overlap.