IRM International Certificate study plan
IRM International Certificate · Give each week a clear focus.
8 weeks · About 7 hours per week
Principles of Risk and Risk Management
Define risk, uncertainty, hazard and opportunity in your own words and write one worked example of each drawn from your own organisation
Distinguish risk management from internal control, insurance buying and compliance, and record the boundary in a one-page note
Explain the difference between inherent and residual risk and apply both labels to five real risks you can name
Map the main categories of risk (strategic, operational, financial, compliance, reputational) onto a simple grid with one example per cell
Your checkpoint
A one-page risk vocabulary sheet with definitions, one organisational example each, and a five-row inherent/residual risk table
Principles of Risk and Risk Management
Describe the steps of a risk management process (identify, analyse, evaluate, treat, monitor, communicate) and explain what each step produces
Compare at least three risk identification techniques (workshops, interviews, checklists, process mapping) and state when each is most useful
Explain the concepts of risk appetite, risk tolerance and risk capacity and show how they differ using a worked example
State the main principles of ISO 31000 and the COSO ERM framework at a level you could explain to a colleague
Your checkpoint
A process diagram of the risk management cycle annotated with the inputs and outputs of each step, plus a 200-word comparison of ISO 31000 and COSO ERM
Principles of Risk and Risk Management
Explain likelihood, impact and the construction of a risk matrix, including why scales and definitions matter
Rate ten identified risks on a 5x5 matrix and justify each placement in one sentence
Explain the difference between qualitative, semi-quantitative and quantitative assessment and when each is proportionate
Describe the four treatment options (avoid, reduce, transfer, accept) and match each to two of your rated risks
Identify the controls that sit behind a chosen treatment and classify them as preventive, detective or corrective
Your checkpoint
A completed 5x5 risk register with ten risks, each with owner, rating, treatment option, control type and review date
Principles of Risk and Risk Management & Practice of Risk Management
Explain the three lines model and the roles of the board, executive, risk function and internal audit
Describe how a risk culture is assessed and name the behaviours that weaken it
Explain how risk information flows upward and what makes a risk report useful to a board
Draft the governance section of a risk policy covering roles, escalation thresholds and reporting frequency
Your checkpoint
A two-page draft risk governance and reporting policy with a roles table and an escalation threshold table
Practice of Risk Management
Explain the purpose and structure of a risk register and the fields that make it usable rather than decorative
Write risk statements in cause-event-consequence form and rewrite five vague statements into that form
Assign risk owners and explain the difference between ownership, accountability and control operation
Set review cycles and trigger conditions for re-assessment of each risk in your register
Your checkpoint
A rewritten risk register of ten risks in cause-event-consequence format, each with a named owner, review cycle and re-assessment trigger
Practice of Risk Management
Explain how key risk indicators are designed, including thresholds and leading versus lagging measures
Propose two indicators for each of your five highest-rated risks and state the data source for each
Describe how loss data, incident records and near-miss reports feed back into risk assessment
Explain how scenario analysis and stress testing are used and when they add value over a standard matrix
Your checkpoint
An indicator sheet with ten key risk indicators, each with owner, data source, green/amber/red thresholds and reporting frequency
Practice of Risk Management
Explain how risk management applies to projects, suppliers and change initiatives, and what differs from business-as-usual risk
Describe business continuity and crisis management basics and how they relate to risk treatment
Explain how insurance fits into risk transfer and what it does not cover
Identify the main emerging and external risks (cyber, climate, supply chain, regulatory) and explain how they are assessed
Your checkpoint
A one-page risk treatment plan for a realistic scenario (for example a new supplier or a system change) covering controls, continuity arrangements and transfer options
Principles of Risk and Risk Management & Practice of Risk Management
Consolidate both domains into a single summary sheet of definitions, frameworks and process steps
Answer practice questions under timed conditions and log every wrong answer with the reason
Re-teach the three weakest topics aloud or in writing without notes
Review your risk register, indicators and policy drafts and correct inconsistencies between them
Your checkpoint
A timed mock exam score log with a correction note for every missed question and a final one-page consolidated summary sheet
Milestones
Week 2: You can explain the full risk management process and the difference between risk appetite, tolerance and capacity without notes
Week 4: Your risk register contains ten rated risks with owners and treatments, and your governance policy draft covers roles and escalation
Week 6: You can design a key risk indicator with thresholds and data source for any risk you are given
Week 8: You score consistently above your target on timed practice questions and can re-teach every weak topic from memory