Start a conversation ↗

Description

Risk Mapping: Identifying, Rating and Building the Audit Plan

Build a risk map that genuinely drives internal audit and internal control work

  • 1 day — 7 h
  • In-person or virtual
  • Intermediate
  • Up to 6 participants

Many risk maps end up as a colourful matrix presented once a year and then filed away: risks worded far too generically, ratings negotiated in meetings without any method, and no link to the audit plan or to the control measures already in place.

This one-day programme is built around practice. Participants produce a risk map from end to end: identification by process, wording of risks, selection and application of a rating scale, assessment of existing controls, and translation of the results into an audit plan and an action plan.

Learning objectives

  • Word a risk in a usable way by distinguishing cause event and consequence
  • Identify risks by process from interviews and documentary sources
  • Build a consistent rating scale and apply it without drift
  • Assess existing controls and measure residual risk
  • Translate the risk map into an audit plan and an action plan tracked over time

What makes this programme different

A complete risk map is built during the session on a process chosen by the group
Ratings produced by the sub-groups are compared to reveal assessment bias
The audit plan derived from the risk map is built and defended before a simulated committee

Programme

1Identifying and Wording Risks

Naming the risk so it can be addressed

  • Breakdown by process activities and objectives
  • Distinguishing cause feared event and consequence
  • Identification sources interviews incidents and audit findings
  • Wording risks and choosing a useful level of granularity
  • Building and maintaining the risk register

2Rating and Control Measures

Assessing without negotiating

  • Choosing assessment axes and building the scales
  • Running rating workshops and handling disagreement
  • Listing and testing existing control measures
  • Moving from inherent risk to residual risk
  • Common biases and ways to limit them

3Reporting the Audit Plan and Follow-Up

Keeping the risk map alive

  • Graphic representations and how executives read them
  • Prioritisation and building the multi-year audit plan
  • Action plans owners and deadlines
  • Periodic updates and triggers for revision
  • Alignment with the other risk maps used across the organisation

Who is it for

Internal auditors · internal control officers · risk managers · compliance officers and management controllers.

Prerequisites

Familiarity with internal control principles and previous involvement in audit or risk management work.

Dates & locations

36 scheduled dates between November 2026 and December 2027. Seats are confirmed in the order enquiries are received.

November 2026

December 2026

January 2027

February 2027

March 2027

April 2027

May 2027

June 2027

September 2027

October 2027

November 2027

December 2027

None of these dates suit you? We open additional sessions on request, and any programme can be run privately for your team.

Practical details

Before the programme
Online positioning questionnaire. Your development objectives are shared with the trainer, who tailors the practical case studies to your context.
Teaching methods
Theoretical input, workshops and practical case studies. Digital course materials and method sheets provided.
Assessment
Multiple-choice tests and role-play exercises. Assessment of learning at the start and end of the programme, with immediate and 60-day follow-up evaluations.
After the programme
One year of access to the e-learning platform. Self-assessment of the skills acquired and a 30-day follow-up session with your trainer.
How to register
Registration online or on the basis of a quotation.
Lead time
11 working days after confirmation of registration.
Accessibility
Accessible to people of determination. Contact our accessibility coordinator to design a suitable solution: contact@mpf-academy.ae
Start dates
Rolling intake: in addition to the scheduled sessions, this programme can start on request.