UN Risk Management and Internal Controls Training Course

This course equips participants with practical skills to manage risk and strengthen internal controls in UN programmes and operations. It focuses on enterprise risk management, risk registers, control design, programme and operational risks, assurance, and accountability.

Target Groups

• Programme and operations managers
• Risk and compliance focal points
• Finance, procurement, and administration officers
• Internal control and audit liaison staff
• Implementing partner managers
• Country office and mission staff
• Managers and supervisors seeking to strengthen organizational practice in this field
• Consultants and professionals supporting related organizations

Course Objectives

By the end of this course, participants will be able to:

• Explain UN risk management policies and the ERM approach
• Identify strategic, programmatic, financial, and operational risks
• Assess and rate risks using standard methods
• Build and maintain risk registers
• Design and implement internal controls
• Manage risks of implementing partners and third parties
• Address security, fraud, and safeguarding risks
• Establish monitoring, escalation, and reporting processes
• Prepare for assurance activities and audits
• Embed a risk-aware and accountable culture

Course Modules

Module 1: Risk Management in the UN System

• ERM policy and frameworks
• Risk appetite
• Roles and governance
• Three lines model
• Benefits of risk management

Module 2: Risk Identification

• Risk categories
• Identification techniques
• Context and horizon scanning
• Programme risks
• Risk statements

Module 3: Risk Assessment and Rating

• Likelihood and impact
• Risk matrices
• Inherent and residual risk
• Prioritization
• Documentation

Module 4: Risk Registers and Treatment

• Risk register structure
• Risk response options
• Action plans
• Risk ownership
• Updating registers

Module 5: Internal Control Frameworks

• Control environment
• Control activities
• Segregation of duties
• Delegations of authority
• Documentation

Module 6: Programme and Partner Risk

• Partner capacity and risk
• Assurance activities
• Third-party monitoring
• Cash transfer risk
• Supply chain risk

Module 7: Fraud, Security, and Safeguarding Risk

• Fraud risk factors
• Security risk management
• Sexual exploitation and abuse risk
• Data and cyber risk
• Business continuity

Module 8: Monitoring, Escalation, and Reporting

• Risk indicators
• Escalation protocols
• Risk reporting
• Management reviews
• Learning from incidents

Module 9: Assurance, Audit, and Culture

• Internal and external audit
• Oversight bodies
• Audit follow-up
• Compliance monitoring
• Risk culture

Module 10: Practical Exercises and Capstone Project

• Building a risk register for a country office programme
• Rating and prioritizing risks
• Designing controls for a process
• Developing a partner assurance plan
• Presenting a risk and control report