Most organisations already have a mature way of handling credit, operational and information security risk, but artificial intelligence does not fit neatly into those registers. Its failures are probabilistic, they can repeat across thousands of decisions before anyone notices, and they often fall on customers and citizens rather than on the balance sheet. Regulators, auditors and boards now expect AI risk to be identified, owned, treated and monitored with the same rigour as any other principal risk, and ISO/IEC 42001 requires a documented AI risk assessment and risk treatment process from any organisation seeking certification.

The Risk Management for AI Governance, Responsible AI & ISO 42001 Training Course applies the full risk management cycle to AI systems. Week one establishes the frameworks and the process: an AI risk taxonomy, the relationship between ISO 31000, ISO/IEC 23894 and the NIST AI RMF, risk criteria and appetite, identification and analysis techniques adapted from IEC 31010, and treatment through Annex A controls recorded in a Statement of Applicability. Week two goes further, into quantifying exposure and stress testing models, adversarial and generative AI threats, supplier and model risk, monitoring, incident handling and reporting to the board, closing with an integrated project.

Teaching is workshop-based. Participants work through risk files for a digital lender, a hospital triage tool, a public benefits system and a customer-service chatbot, using spreadsheet models and templates they can take straight back to their own risk function.

On completing the programme, participants will be able to:

• Classify AI risks by source, lifecycle stage and affected party using a structured taxonomy.
• Compare ISO 31000, ISO/IEC 23894, the NIST AI RMF and the risk clauses of ISO/IEC 42001 and map them to one another.
• Define risk criteria, appetite and tolerance statements suited to AI systems and the harms they can cause.
• Apply FMEA, bow-tie and scenario techniques to identify and analyse risks in machine learning pipelines.
• Select and justify treatment controls and record them in a Statement of Applicability.
• Estimate AI risk exposure with sensitivity analysis, Monte Carlo simulation and stress tests.
• Assess adversarial, generative AI and third-party risks using recognised threat catalogues and due diligence tools.
• Design key risk indicators, incident playbooks and board-level risk reports for AI.

The course suits professionals who own, assess or challenge risk in organisations that build or buy AI, such as:

• Chief risk officers and heads of enterprise risk management
• Operational, technology and model risk managers
• Model validation and quantitative risk analysts in banks and insurers
• Compliance officers and data protection officers
• Internal auditors responsible for technology and AI assurance
• Chief information security officers and security architects
• Data science and machine learning team leads
• Risk and ICT officers in government agencies, regulators and development organisations
• Consultants advising clients on ISO/IEC 42001 implementation

Each participant goes home with a working AI risk toolkit, including:

• An AI risk taxonomy and register template pre-populated with common failure modes.
• A drafted AI risk appetite statement with tolerance thresholds for a chosen use case.
• A completed FMEA worksheet for a machine learning pipeline.
• A Statement of Applicability extract that justifies each included and excluded control.
• A spreadsheet Monte Carlo model estimating the cost of model error under different scenarios.
• A threat model for a large language model application, mapped to MITRE ATLAS and the OWASP LLM list.
• A set of key risk indicators with trigger levels and escalation routes.
• An AI incident response playbook and a one-page board risk report.

Every session applies a risk technique to a live example rather than describing it in the abstract. The approach combines:

• Short framework briefings followed straight away by application to a case
• Risk files from a digital lender, a hospital, a public benefits agency and a telecoms operator
• Spreadsheet labs for scoring, simulation and threshold analysis
• Threat-modelling and red-team exercises on a sample chatbot
• Tabletop incident simulations with rotating roles
• A capstone risk package reviewed by a mock board risk committee

A CPD-accredited Certificate of Completion issued by Vision Reach Global Consultancy is awarded to participants who attend all ten days and complete the risk labs and the integrated project.

It records the course title, dates and delivery format. It is a training certificate rather than ISO/IEC 42001 auditor or implementer certification, and the register and appetite statement you build can support your CPD records.