ISO 31000 Risk Management Lead Auditor

Module 1: Introduction to Risk Management Auditing

• Risk management auditing
• Purpose of assurance
• Audit objectives
• Organisational risk oversight
• Auditor responsibilities
• Value of effective auditing

Module 2: Understanding ISO 31000

• Purpose of ISO 31000
• Scope and application
• Key terminology
• Risk management guidance
• Organisational application
• Risk-based decision-making

Module 3: ISO 31000 Risk Management Principles

• Integrated approach
• Structured and comprehensive approach
• Customisation
• Inclusive approach
• Dynamic risk management
• Continual improvement

Module 4: Risk Management Framework

• Leadership and commitment
• Integration
• Framework design
• Implementation
• Evaluation
• Framework improvement

Module 5: Risk Management Process

• Communication and consultation
• Scope and context
• Risk criteria
• Risk assessment
• Risk treatment
• Monitoring and review

Module 6: Risk Governance and Leadership

• Governance structures
• Leadership responsibilities
• Risk ownership
• Accountability
• Decision authority
• Organisational risk culture

Module 7: Organisational Context and Risk Criteria

• Internal context
• External context
• Stakeholder expectations
• Organisational objectives
• Risk criteria
• Risk appetite and tolerance

Module 8: Lead Auditor Principles

• Auditor integrity
• Independence
• Objectivity
• Confidentiality
• Evidence-based approach
• Professional judgement

Module 9: Lead Auditor Roles and Responsibilities

• Audit leadership
• Managing audit activities
• Auditor competence
• Team responsibilities
• Communication
• Audit accountability

Module 10: Establishing an Audit Programme

• Programme objectives
• Audit priorities
• Risk-based scheduling
• Audit frequency
• Resources
• Programme monitoring

Module 11: Risk-Based Audit Planning

• Identifying high-risk areas
• Audit priorities
• Previous audit results
• Organisational changes
• Resource requirements
• Risk-based focus

Module 12: Defining Audit Objectives, Scope and Criteria

• Audit objectives
• Audit boundaries
• Audit scope
• Audit criteria
• Relevant processes
• Audit feasibility

Module 13: Preparing the Audit

• Reviewing documentation
• Understanding processes
• Audit plans
• Audit checklists
• Sampling strategies
• Working documents

Module 14: Managing the Audit Team

• Selecting team members
• Assigning responsibilities
• Coordinating auditors
• Monitoring progress
• Resolving team issues
• Maintaining audit consistency

Module 15: Conducting Opening Meetings

• Introductions
• Confirming audit objectives
• Confirming scope
• Audit methodology
• Communication arrangements
• Audit schedule

Module 16: Audit Interviewing Techniques

• Interview preparation
• Open questions
• Probing questions
• Active listening
• Verifying responses
• Professional communication

Module 17: Gathering and Verifying Audit Evidence

• Document review
• Records
• Observation
• Interviews
• Sampling
• Evidence verification

Module 18: Auditing Risk Identification

• Risk sources
• Events
• Causes
• Consequences
• Emerging risks
• Completeness of identification

Module 19: Auditing Risk Analysis

• Likelihood assessment
• Consequence assessment
• Existing controls
• Risk levels
• Analysis methodologies
• Assessment consistency

Module 20: Auditing Risk Evaluation

• Risk criteria
• Risk prioritisation
• Risk acceptance
• Escalation
• Decision processes
• Evaluation consistency

Module 21: Auditing Risk Treatment

• Treatment strategies
• Treatment plans
• Risk ownership
• Responsibilities
• Resources and timelines
• Residual risk

Module 22: Auditing Control Effectiveness

• Control design
• Control implementation
• Preventive controls
• Detective controls
• Corrective controls
• Control effectiveness

Module 23: Auditing Risk Registers

• Risk descriptions
• Risk ratings
• Risk ownership
• Existing controls
• Treatment actions
• Register maintenance

Module 24: Auditing Risk Monitoring and Reporting

• Risk monitoring
• Key risk indicators
• Control monitoring
• Risk reviews
• Management reporting
• Escalation arrangements

Module 25: Evaluating Risk Management Effectiveness

• Framework effectiveness
• Process effectiveness
• Risk culture
• Decision-making integration
• Risk maturity
• Improvement opportunities

Module 26: Developing Audit Findings

• Evaluating evidence
• Identifying weaknesses
• Audit observations
• Evidence-based findings
• Finding statements
• Supporting documentation

Module 27: Conducting Closing Meetings

• Presenting findings
• Communicating conclusions
• Discussing evidence
• Managing disagreements
• Confirming actions
• Closing the audit

Module 28: Lead Audit Reporting

• Audit report structure
• Executive summaries
• Findings
• Audit conclusions
• Recommendations
• Report communication

Module 29: Corrective Actions and Follow-Up

• Management responses
• Root cause considerations
• Corrective actions
• Follow-up activities
• Effectiveness verification
• Closing findings

Module 30: Continual Improvement of Risk Management

• Audit insights
• Recurring weaknesses
• Lessons learned
• Framework improvements
• Risk maturity development
• Continual enhancement