Resources

Practical guides, framework summaries, and templates for risk management work.

Free risk management guides, frameworks and templates: COSO ERM, ISO 31000, RCSA, KRIs, bowtie analysis and practical how-tos for GRC and audit teams.

Audit

• Audit Committee Reporting — Best practices for internal audit reporting to the audit committee including content, frequency, and presentation.
• Co-Sourcing and Outsourcing Audit Functions — Guide to using external resources for internal audit including models, vendor selection, and quality oversight.
• Data Analytics in Internal Audit — Guide to using data analytics and technology to enhance audit coverage, efficiency, and insight generation.
• IIA Standards and Professional Practice — Overview of the Institute of Internal Auditors Standards and Professional Practice Framework.
• Integrated Audit Approach — How to coordinate and integrate internal audit with other assurance providers for efficient coverage.
• Internal Audit Planning and Execution — Comprehensive guide covering audit universe development, risk-based audit planning, fieldwork execution, and reporting best practices.

Compliance

• Anti-Money Laundering (AML) Program Guide — Building and maintaining an effective AML compliance program including customer due diligence, transaction monitoring, and SAR filing.
• Regulatory Compliance Program Essentials — Key components of an effective compliance program, including compliance risk assessment, monitoring, training, and regulatory change management.
• Regulatory Examination Preparation — How to prepare for and manage regulatory examinations, including document preparation, interview readiness, and findings response.
• Sanctions and Export Controls Compliance — Guide to managing sanctions screening, export controls, and restricted party compliance.
• SOC 2 Compliance Guide — Understanding Service Organization Control 2 requirements, trust service criteria, and audit preparation.
• Whistleblower Program Development — Guide to establishing an effective whistleblower program including hotline setup, investigation procedures, and anti-retaliation policies.

Control Testing

• Automated Control Testing Techniques — Guide to testing automated controls, including IT general controls, application controls, and continuous monitoring.
• Control Remediation and Issue Management — Best practices for managing control deficiencies, tracking remediation, and validating fixes.
• Control Testing Methodology Guide — Comprehensive guide to designing and executing control tests, including sampling methods, documentation requirements, and deficiency evaluation.
• SOX Control Testing Requirements — Understanding Sarbanes-Oxley Section 404 requirements for internal control over financial reporting testing.

Cyber Risk

• Cloud Security Best Practices — Security considerations and controls for cloud environments including shared responsibility and configuration management.
• Cyber Risk Quantification Guide — Methods and approaches for quantifying cyber risk in financial terms using FAIR and other methodologies.
• Incident Response Planning — Complete guide to developing and testing cyber incident response plans, including roles, procedures, and communication strategies.
• NIST Cybersecurity Framework (CSF) — The NIST CSF provides a policy framework for managing cybersecurity risk based on existing standards, guidelines, and practices.
• Ransomware Prevention and Response — Comprehensive guide to preventing ransomware attacks and responding effectively when they occur.
• Zero Trust Architecture Guide — Implementing Zero Trust security principles including identity verification, micro-segmentation, and least privilege access.

Methodologies

• Bowtie Risk Analysis Method — Visual risk analysis methodology that displays the links between causes, controls, and consequences. Excellent for communicating complex risks.
• Delphi Method for Expert Risk Assessment — Structured technique for gathering and refining expert judgment on risks and uncertainties.
• Failure Mode and Effects Analysis (FMEA) — Systematic method for identifying potential failure modes, their causes, and effects to prioritize risk mitigation efforts.
• FAIR Methodology for Cyber Risk Quantification — Factor Analysis of Information Risk - the standard for measuring and analyzing cyber risk in financial terms.
• Monte Carlo Simulation for Risk Analysis — How to use Monte Carlo simulation for risk quantification, portfolio analysis, and decision-making.
• Root Cause Analysis Techniques — Comprehensive guide to root cause analysis methods including 5 Whys, Fishbone Diagrams, and Fault Tree Analysis.

Operational Resilience

• Business Continuity Management (BCM) Guide — Step-by-step guide to developing and maintaining a business continuity management program aligned with ISO 22301.
• Crisis Management and Communication — Guide to establishing crisis management capabilities including team structure, decision-making, and stakeholder communication.
• IT Disaster Recovery Planning — Technical guide to developing and testing IT disaster recovery plans including RTO/RPO requirements and failover strategies.
• Operational Resilience Framework — Comprehensive guide to building operational resilience capabilities, including impact tolerances, scenario testing, and recovery planning.

Policy Writing

• Enterprise Risk Management Policy Template — Ready-to-use template for an organization-wide ERM policy with customization guidance.
• How to Write Effective Risk Policies — Template and guidance for creating clear, actionable risk management policies that meet regulatory requirements and drive consistent behavior.
• Policy Governance and Lifecycle Management — Framework for managing the complete policy lifecycle from development through retirement.

Reading List

• Against the Gods: The Remarkable Story of Risk — Peter L. Bernstein's masterpiece tracing the history of risk from ancient times to modern portfolio theory. Essential reading for understanding how humanity learned to measure and manage uncertainty.
• Antifragile: Things That Gain from Disorder — Taleb's follow-up exploring systems that benefit from volatility and stress. Practical framework for building resilient organizations.
• Cybersecurity and Cyberwar: What Everyone Needs to Know — Accessible introduction to cybersecurity concepts for non-technical risk professionals.
• Enterprise Risk Management: From Incentives to Controls — James Lam's practical guide to implementing ERM. Bridges theory and practice with actionable frameworks.
• How to Measure Anything — Douglas Hubbard's practical guide to quantifying seemingly unmeasurable risks and values.
• Normal Accidents — Charles Perrow's seminal work on system failures and organizational risk.
• Options, Futures, and Other Derivatives — John Hull's definitive textbook on derivatives. The industry standard for understanding financial instruments.
• Risk Savvy: How to Make Good Decisions — Gerd Gigerenzer's accessible guide to understanding risk and making better decisions.
• Sawyer's Internal Auditing — The definitive textbook on internal auditing. Used worldwide for CIA exam preparation.
• Superforecasting: The Art and Science of Prediction — Philip Tetlock's research on what makes some people exceptionally good at predicting the future.
• The Black Swan: The Impact of the Highly Improbable — Nassim Nicholas Taleb's influential work on rare, unpredictable events that have massive impact. Challenges conventional risk thinking and VaR models.
• The Checklist Manifesto — Atul Gawande's practical guide to using simple checklists to prevent errors.
• The CISO's Next Move — Practical guide for security leaders on building influence and demonstrating business value.
• The Culture Map — Erin Meyer's framework for navigating cultural differences in risk and business communications.
• The Essentials of Risk Management — Comprehensive textbook covering all major risk types. Industry standard reference for risk practitioners.
• The Failure of Risk Management — Douglas Hubbard's critique of common risk management practices and evidence-based alternatives.
• Thinking, Fast and Slow — Daniel Kahneman's Nobel Prize-winning research on cognitive biases and decision-making. Foundational for understanding behavioral risk.
• Value at Risk — Philippe Jorion's comprehensive guide to VaR methodology and implementation.

Regulatory Frameworks

• AML/CFT Regulatory Framework — Anti-Money Laundering and Counter Terrorist Financing requirements globally.
• Bank of England Regulatory Framework — Overview of the Bank of England's role in financial stability and monetary policy regulation.
• Basel Committee Standards — Basel Committee on Banking Supervision and the Basel Framework for bank regulation.
• Consumer Duty Implementation — FCA Consumer Duty requirements and implementation guidance.
• DORA - Digital Operational Resilience — Digital Operational Resilience Act requirements for financial entities.
• EBA Regulatory Framework — European Banking Authority guidelines, technical standards and supervisory convergence.
• ECB Banking Supervision (SSM) — Single Supervisory Mechanism and ECB's role in eurozone banking supervision.
• EIOPA Insurance Regulation — European Insurance and Occupational Pensions Authority regulatory framework.
• ESMA Securities Regulation — European Securities and Markets Authority role in securities markets regulation.
• FCA Handbook Overview — Complete guide to the Financial Conduct Authority regulatory handbook and its key sourcebooks.
• Federal Reserve Regulatory Framework — US Federal Reserve banking supervision and monetary policy regulation.
• FSB Financial Stability Standards — Financial Stability Board frameworks for global financial stability.
• GDPR Data Protection Framework — General Data Protection Regulation compliance for financial services.
• IOSCO Securities Standards — International Organization of Securities Commissions principles and standards.
• MiCA Crypto Regulation — Markets in Crypto-Assets Regulation framework for the EU.
• MiFID II Complete Guide — Markets in Financial Instruments Directive II - comprehensive implementation guide.
• OCC Banking Regulation — Office of the Comptroller of the Currency supervision of national banks.
• PRA Rulebook Guide — Understanding the Prudential Regulation Authority rulebook for banks, insurers and major investment firms.
• SEC Regulatory Framework — Securities and Exchange Commission regulations for US capital markets.
• SOX Compliance Guide — Sarbanes-Oxley Act requirements for public companies and their auditors.

Risk Assessment

• Emerging Risk Identification and Assessment — Framework for identifying, assessing, and monitoring emerging risks that could impact the organization over a longer time horizon.
• How to Conduct a Risk Control Self-Assessment (RCSA) — Step-by-step guide to planning and executing RCSAs, including workshop facilitation, risk identification, control mapping, and action planning.
• Key Risk Indicators (KRI) Development — How to develop, implement, and monitor effective Key Risk Indicators for proactive risk management.
• Quantitative Risk Assessment Methods — Advanced guide to quantitative risk analysis including Monte Carlo simulation, Value at Risk, and scenario modeling.
• Risk Appetite Framework Development — Guide to establishing and operationalizing a risk appetite framework including statements, metrics, and cascading limits.
• Risk Heat Maps and Scoring Methodologies — Complete guide to creating effective risk heat maps, scoring scales, and visualization techniques for risk reporting.
• Risk Taxonomy Development Guide — How to develop and maintain a comprehensive risk taxonomy that enables consistent risk identification and reporting.
• Scenario Planning for Risk Assessment — Guide to developing and using scenarios for strategic risk assessment and planning.

Risk Frameworks

• AS/NZS 4360 Risk Management Standard (Withdrawn) — The Australian/New Zealand standard that shaped ISO 31000. Withdrawn in 2009 and superseded by AS/NZS ISO 31000; covered here for its historical influence.
• Basel III/IV Capital and Liquidity Framework — Comprehensive overview of the Basel III/IV regulatory framework for bank capital adequacy, liquidity, and leverage requirements.
• COBIT Framework for IT Governance — Control Objectives for Information and Related Technologies - comprehensive framework for IT governance and management.
• COSO Enterprise Risk Management Framework — The comprehensive COSO ERM framework covering governance, strategy, objectives, performance, and review & revision. Essential for establishing enterprise-wide risk management.
• FERMA Risk Management Standard — The Federation of European Risk Management Associations' standard for implementing risk management in European organizations.
• Internal Control — Integrated Framework (COSO) — The foundational framework for internal controls used globally.
• IRM Enterprise Risk Management Principles — The Institute of Risk Management's approach to enterprise risk management focusing on strategic value creation.
• ISO 31000 Risk Management Standard — International standard providing principles, framework, and process for managing risk. Applicable to any organization regardless of size or sector.
• Three Lines Model — The IIA's Three Lines Model clarifies roles and responsibilities for risk management and internal control across the organization.

Stress Testing

• Climate Stress Testing and Scenario Analysis — Framework for assessing climate-related financial risks including physical and transition risk scenarios.
• Liquidity Stress Testing — Framework for assessing liquidity adequacy under stressed conditions including LCR, NSFR, and survival period analysis.
• Reverse Stress Testing — Methodology for identifying scenarios that could cause business failure and developing appropriate risk mitigants.
• Stress Testing Framework for Financial Institutions — Guidelines for developing and implementing stress testing programs, including scenario design, impact assessment, and capital adequacy analysis.

Templates & Tools

• Audit Checklist Templates — Collection of audit checklist templates for common audit areas including IT, financial controls, and compliance.
• Business Impact Analysis (BIA) Template — Template for conducting business impact analysis to support business continuity planning.
• Control Design Document Template — Template for documenting control design including objectives, attributes, and testing approach.
• Incident Report Template — Template for documenting and reporting security and operational incidents.
• Risk Assessment Questionnaire — Standardized questionnaire for conducting risk assessments across business units.
• Risk Register Template and Guide — Comprehensive risk register template with guidance on structure, content, and maintenance.

Third-Party Risk

• Cloud Service Provider Risk Assessment — Guide to assessing and managing risks associated with cloud service providers including shared responsibility and exit planning.
• Fourth-Party Risk Management — Understanding and managing risks from your vendors' vendors - the extended supply chain.
• Third-Party Risk Management (TPRM) Framework — Comprehensive framework for managing risks from vendors, suppliers, and other third parties throughout the relationship lifecycle.
• Vendor Due Diligence Best Practices — Detailed guide to conducting effective vendor due diligence including questionnaires, document review, and on-site assessments.