ICSAN Admin Risk study plan

Map the three lines model onto an administrative function, writing out what first, second and third line each own for a sample organisation

Draft a one-page risk appetite statement covering tolerance thresholds for administrative process failures

Distinguish inherent, residual and target risk and apply all three labels to five administrative risk scenarios

Compare a principles-based framework with a rules-based framework and state which suits a mid-sized administrator and why

Build a risk register template with columns for cause, event, consequence, likelihood, impact, owner and control reference

Populate the register with 15 administrative risks drawn from procurement, records, payroll and facilities

Apply a 5x5 likelihood-impact matrix and justify each score in one sentence

Identify which risks are correlated so that a single trigger could activate several at once

Run a structured risk workshop simulation using brainstorming plus a checklist prompt set, and record the outputs

Perform a bow-tie analysis on one high-scoring risk, listing threats, preventive controls, consequences and mitigating controls

Rank the register by residual score and select the top five for treatment

Write treatment plans naming the four standard options and the reason for choosing each

Classify ten controls as preventive, detective or corrective and as manual or automated

Evaluate segregation of duties in a payments and supplier-onboarding process and document every conflict found

Assess the control environment using tone at the top, integrity, commitment to competence and accountability as headings

Design a control self-assessment questionnaire of 12 items for administrative staff

Map an end-to-end administrative process and mark the failure points that carry operational risk

Quantify the operational risk of one process using an incident-frequency estimate and a simple loss-severity range

List the regulatory and legal obligations touching administrative work, including data protection, record retention, health and safety and anti-bribery duties

Identify the compliance obligations that changed most recently and note what action each requires

Draft a compliance obligations register linking each duty to an owner, a control and a review frequency

Build a fraud risk register covering asset misappropriation, procurement collusion, payroll ghosting, expense abuse and data theft

Identify red flags for each fraud scheme and state which control would detect it

Design anti-fraud controls including mandatory leave, dual authorisation thresholds, vendor master file review and whistleblowing channels

Analyse a written fraud scenario and state the immediate containment, investigation and reporting steps in order

Conduct a business impact analysis for three administrative functions, assigning recovery time objectives and recovery point objectives

Draft a continuity plan outline covering activation triggers, alternate sites, key supplier fallback and communication cascade

Design a set of key risk indicators with thresholds, data source and reporting frequency for the top five risks

Build a one-page risk dashboard layout for a management committee, separating appetite breach from trend movement

Distinguish assurance from monitoring and state what internal audit, management and external parties each provide

Apply an ethical decision framework to two dilemmas involving confidentiality and conflict of interest, and record the reasoning

Outline the board's governance responsibilities for risk oversight, including delegation limits and reporting lines

Consolidate the eight weeks of deliverables into a single revision pack with a one-page summary per domain

Complete a timed 60-question mixed mock and review every wrong answer back to its source domain

Identify the three weakest domains from the mock and schedule two focused revision sessions for each