CIMA P3 Risk Management study plan

Define enterprise risk management (ERM) and distinguish it from silo-based risk management, using the COSO ERM framework as the reference model

Map the components of a risk management framework (governance, risk appetite, risk identification, assessment, response, monitoring, communication) to a named organisation

Explain the difference between risk appetite, risk tolerance and risk capacity, with one practical example of each

Construct a simple risk register containing at least eight risks for a chosen organisation, recording likelihood, impact and owner

Apply risk identification techniques (brainstorming, SWOT, PESTLE, scenario analysis, process mapping) and select the most appropriate technique for three different decision contexts

Evaluate quantitative and qualitative risk assessment methods, including probability-impact matrices, expected value, and sensitivity analysis

Analyse the concept of risk correlation and aggregation, and explain why a portfolio view differs from a silo view

Compare the main ERM frameworks (COSO, ISO 31000) at a conceptual level and identify where they diverge on risk appetite and governance

Classify strategic risks into categories (competitive, political, economic, technological, social, environmental) and give a real example of each

Apply PESTLE and Porter's Five Forces to identify strategic risks facing a named industry

Evaluate scenario planning and stress testing as tools for strategic risk analysis, including their limitations

Assess how strategic risk links to an organisation's objectives and business model, using a value chain or business model canvas

Evaluate the risk response options (avoid, reduce, transfer, accept, exploit) and justify a selected response for each strategic risk identified in week 3

Analyse the role of risk appetite in selecting responses and explain the consequences of responses that exceed appetite

Distinguish between risk mitigation and risk control, and identify the limitations of controls, including human error and control override

Apply the concept of residual risk and calculate it for at least five risks using a simple scoring model

Design internal controls using the COSO internal control framework, distinguishing preventive, detective and corrective controls

Evaluate the costs and benefits of controls and explain the concept of proportionate control

Analyse control testing and monitoring approaches, including key risk indicators (KRIs) and their design principles

Explain the role of internal audit in the control environment and distinguish it from the risk management function

Explain the principles of corporate governance as they apply to risk oversight, including board responsibilities and the three lines model

Evaluate the role of the risk committee, audit committee and chief risk officer in the governance structure

Analyse how risk culture develops and assess the behavioural and organisational factors that weaken it

Distinguish between risk governance failures and control failures, using a conceptual example

Classify cyber risk as a strategic and operational risk and explain its distinctive characteristics (speed, anonymity, systemic reach)

Evaluate cyber risk frameworks and controls at a conceptual level, including defence in depth, access control and incident response planning

Assess the role of cyber insurance and third-party risk management within the risk response toolkit

Analyse the link between cyber risk and business continuity, and the governance implications of a cyber incident

Synthesise the four domains into an integrated risk management narrative for a single organisation

Practise constructing structured answers to exam-style scenario questions under timed conditions

Identify and close remaining knowledge gaps by reviewing weak areas flagged across weeks 1 to 7

Apply a consistent answer structure (identify, analyse, evaluate, recommend) to at least three scenario questions