Description

A focused course, tailored for you

Non-Financial Risk from Assessment to Assurance

Build the structured NFR programme that turns scattered control logs into board-ready assurance.

Non-financial risk teams spend their days gathering evidence from six different control frameworks, translating it into four different reporting templates, and defending the methodology to an audit committee that wants one clean answer. The problem is not the data - it is the absence of a coherent taxonomy that maps conduct risk, operational risk, model risk, third-party risk, and data risk into a single assurance narrative.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

The RCSA refresh was due last quarter. The KRI dashboard still shows amber across nine categories with no threshold logic explaining why. The scenario analysis from the previous cycle was not updated after the regulator published its revised operational resilience guidance. Meanwhile, the board pack NFR section keeps getting sent back for clarification because no two pages use the same risk category labels.

This is not a resourcing problem. It is an architecture problem. NFR functions that solve it build a shared taxonomy first, wire every control log to a taxonomy node, then generate assurance maps automatically from control coverage. The ones that do not keep re-explaining the same four amber indicators at every risk committee meeting.

What you walk away with

Design a defensible NFR taxonomy that covers conduct, operational, model, third-party, and data risk in a single consistent structure.
Rebuild your RCSA so every control log maps to a taxonomy node and gaps are visible without manual reconciliation.
Build KRI threshold logic that differentiates amber from red and produces a clear escalation trigger the risk committee will act on.
Run a scenario analysis cycle using regulator-current methodology and document the output in a format auditors accept without redrafting.
Produce a board-ready assurance map that shows control coverage, residual risk, and forward-looking appetite in one page.

The 12 modules

Module 1. NFR Taxonomy Architecture

Most NFR programmes inherit a taxonomy from a legacy operational risk framework and patch new categories on top. This module builds a clean taxonomy from first principles: conduct risk, operational risk, model risk, third-party/supply chain risk, data and information risk, and technology/cyber risk. Each category is defined with scope boundaries, overlap rules, and the regulator references (APRA CPS 230, ASIC RG 247, BCBS guidelines) that anchor the definitions to something defensible in an exam.

Module 2. RCSA Design and Refresh

An RCSA not updated since the previous regulatory cycle creates a false picture. This module covers RCSA scope definition (entity, business unit, and product level), the control log structure that maps each control to a taxonomy node, the refresh frequency and trigger logic, and the documentation standard that satisfies internal audit and a regulator walkthrough. Worked example: a three-line business unit with overlapping third-party and data risk exposure.

Module 3. Key Risk Indicator Design

KRIs that never change colour are not risk indicators - they are compliance theatre. This module covers the design logic for meaningful KRIs: leading versus lagging indicators, threshold calibration against appetite statements, the amber-red distinction that triggers an escalation protocol rather than a footnote, and the data sourcing workflow that keeps KRI values current without manual collection. Includes a KRI library for common NFR categories and a threshold calibration template.

Module 4. Model Risk Governance

Model risk is the fastest-growing NFR category at most financial institutions, driven by expanded AI and algorithmic decision use. This module covers model inventory management, model validation standards (SR 11-7 and equivalent), model risk rating methodology, escalation triggers for model failures, and the governance structure that keeps the board's model risk appetite statement connected to the actual model portfolio. Includes a model risk register template and a validation sign-off workflow.

Module 5. Third-Party and Supply Chain Risk

APRA CPS 230 and equivalent regimes now require financial institutions to map material service provider dependencies and demonstrate that operational disruption scenarios have been stress-tested. This module covers the third-party risk taxonomy, materiality thresholds, the due diligence framework for onboarding and annual review, concentration risk analysis across the provider portfolio, and the contractual provisions that satisfy regulatory requirements without creating unenforceable obligations. Worked through a payments processing and a cloud infrastructure scenario.

Module 6. Conduct Risk Framework

Conduct risk sits at the intersection of culture, incentives, and customer outcomes - hard to quantify but treated by regulators as the leading indicator of systemic problems. This module covers conduct risk taxonomy, the indicator set regulators look for (complaints data, whistleblower trends, product suitability metrics, incentive alignment reviews), the escalation path from front-line observations to board-level reporting, and the documentation standard that demonstrates a proactive culture.

Module 7. Operational Resilience and Scenario Analysis

Scenario analysis is only useful if it is calibrated to the current regulatory guidance and produces output the risk committee can act on. This module covers the scenario analysis cycle for operational resilience: scenario selection methodology (severe but plausible, regulator-current), scenario scoping against important business services, impact assessment structure, recovery time objective validation, and the documentation format that satisfies both APRA CPS 230 and internal audit. Includes a worked scenario using a payment processing disruption event.

Module 8. Data and Information Risk

Data risk straddles privacy regulation, information security, and operational risk in ways most RCSA structures do not handle cleanly. This module covers data risk taxonomy (availability, integrity, confidentiality, quality, lineage), the control framework that maps data risk nodes to the broader NFR taxonomy, the regulatory reference set (Privacy Act, CDR obligations, APRA CPG 235), and the KRI set for data risk that goes beyond standard cyber metrics. Includes a data risk register template and a lineage-to-control mapping worksheet.

Module 9. NFR Reporting and Board Pack Construction

The board pack NFR section fails when six risk categories are summarised across four different label sets and three colour scales. This module covers the reporting architecture that fixes it: a single taxonomy-anchored summary table, the narrative that moves from control coverage to residual risk to appetite position in one flow, the risk committee format that answers the questions non-executive directors actually ask, and the regulator submission format that maps to exam-day expectations.

Module 10. Assurance Mapping and Control Coverage

An assurance map shows the risk committee which risks have strong control coverage, which have partial coverage, and which have genuine gaps - without requiring the committee to read the underlying RCSA. This module covers assurance map design, the control coverage methodology that maps first-line, second-line, and third-line assurance to each taxonomy node, the gap analysis output that feeds directly into the risk treatment plan, and the update cadence that keeps the map current between formal RCSA refresh cycles.

Module 11. Regulator Engagement and Examination Readiness

APRA, ASIC, and AUSTRAC examinations of NFR programmes consistently return findings in the same four areas: taxonomy inconsistency, KRI threshold logic, scenario analysis currency, and documentation completeness. This module covers examination preparation: the self-assessment checklist against current regulatory guidance, the document pack structure examiners expect, the oral briefing format for the opening meeting, and the finding-response protocol that closes regulatory matters without creating new ones. Includes a pre-examination readiness checklist.

Module 12. Implementation Playbook and Programme Roadmap

The final module delivers a sequenced implementation roadmap for applying the course framework to your specific NFR programme: taxonomy adoption sequence, RCSA rebuild timeline, KRI library prioritisation, assurance map go-live milestones, and the stakeholder engagement plan that brings the risk committee, internal audit, and the business along at the same pace. The hand-built implementation playbook delivered alongside course access is calibrated to your role, your regulatory environment, and the maturity level of your current programme.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Risk committee deck feedback on NFR section clarity: Modules 9 and 10 directly address the taxonomy inconsistency and assurance map gaps that generate that feedback.

RCSA refresh overdue or flagged by internal audit: Modules 2 and 7 rebuild the RCSA structure and scenario analysis cycle from current regulatory standards.

KRIs that never change colour or trigger escalation: Module 3 redesigns KRI threshold logic so the dashboard reflects actual risk movement.

Preparation for APRA CPS 230 examination or equivalent regulatory review: Module 11 covers examination readiness and the document pack structure regulators expect to see.

What you get with this course

Twelve written modules covering the full NFR programme lifecycle from taxonomy design to board-level assurance.
Downloadable templates: NFR taxonomy framework, RCSA structure, KRI library and threshold calibration worksheet, model risk register, assurance map template, examination readiness checklist.
Worked examples for three common NFR scenarios: RCSA refresh post-regulatory guidance update, model risk escalation, and board pack NFR section rebuild.
Hand-built implementation playbook tailored to your role and regulatory environment, delivered alongside course access.
Access within 24 hours of purchase in the Art of Service learning environment.

What you will have in hand by Day 1, Week 1, Month 1

Course access and implementation playbook provisioned within 24 hours of purchase.

Each module is self-paced - most practitioners complete the full course across two to three weeks while applying each module's templates to their live programme.

Implementation playbook is hand-built by Gerard based on your role profile and delivered alongside initial course access.

Before and after

Before

NFR reporting uses four different category labels across six different control logs, the risk committee keeps sending the deck back for clarification, the RCSA has not been updated since the last regulatory cycle, and KRIs sit amber indefinitely with no escalation logic.

After

A single taxonomy anchors every control log, the RCSA maps cleanly to board-ready assurance output, KRIs have defined threshold logic that triggers actual decisions, and the examination readiness checklist shows no open gaps.

What happens if you do not address this

NFR programmes that cannot produce a coherent assurance narrative become the primary source of regulatory findings. APRA CPS 230 examinations in the current cycle have consistently cited taxonomy inconsistency and RCSA currency as material weaknesses. A finding at that level goes into the board risk committee minutes and requires a formal remediation response.

Who it is for

Non-financial risk professionals in financial services - typically Risk Managers, NFR Analysts, or Senior Analysts at banks, asset managers, or financial groups - who are accountable for the operational, conduct, model, third-party, and data risk picture across a business unit or the enterprise, and who need to produce board-level and regulator-facing assurance from a fragmented set of control logs and risk assessments.

Who this is NOT for. Financial risk specialists focused exclusively on market risk, credit risk, or liquidity risk who have no remit for non-financial or operational risk categories. Also not for audit professionals whose job is to test controls rather than design the risk taxonomy underlying them.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Approximately 4-6 hours per module across twelve modules. Most practitioners move through two to three modules per week, completing the full course in four to six weeks while applying each module directly to their programme.

Why $199 is the right number

Internal training programmes cover the organisation's own methodology but rarely address the taxonomy architecture problem or the regulator-facing documentation standard. External consultants charge project rates to produce the same RCSA rebuild and assurance map this course teaches you to build yourself. Regulatory guidance documents set the requirement but do not walk through implementation. This course bridges that gap at a fixed cost.

FAQ

Is this course relevant if my NFR programme already has an RCSA and KRI dashboard in place?

Yes. The course is specifically designed for practitioners who have a working programme but are getting push-back from the risk committee, internal audit, or regulators on taxonomy consistency, KRI logic, or assurance map quality. The modules on RCSA refresh, KRI design, and assurance mapping are calibrated to a programme that exists but needs structural improvement, not to a greenfield build.

Which regulatory framework does the course use as its primary reference?

The core regulatory anchors are APRA CPS 230 and CPG 230 (operational risk management), APRA CPG 235 (data risk), and ASIC RG 247 (conduct risk obligations). The taxonomy and RCSA structures are also cross-referenced to BCBS Principles for the Sound Management of Operational Risk and SR 11-7 for model risk, so the framework is portable across Australian-regulated entities and international institutions operating here.

What does the implementation playbook cover that is not already in the course modules?

The modules give you the framework and methodology. The implementation playbook is built specifically for your role and programme structure - it sequences the taxonomy adoption, RCSA refresh, and KRI redesign steps against the constraints of your actual regulatory calendar, stakeholder map, and current maturity level. It is the difference between understanding what to build and having a dated work plan for your specific situation.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.