Turn Enterprise Risk Information into Informed Action

The Enterprise Risk Management II (Tactical Application) Certification Program is the second course in the three-part Enterprise Risk Management certification series. Building upon the organizational structure and ERM framework established in Enterprise Risk Management I (Structure), ERM II moves participants from foundational understanding into the practical and analytical application of enterprise risk management. This application-focused course develops the skills required to identify enterprise risks, analyze their causes and potential consequences, assess likelihood and impact, establish risk priorities, determine appropriate responses, develop mitigation strategies, assign accountability, and establish measures for monitoring risk. ERM II is where the ERM framework becomes operational. Participants move beyond asking: “How should our ERM program be structured?” and begin answering: “What are our risks, how significant are they, what should we do about them, and how will we know whether our actions are working? ”Through structured instruction and practical exercises, participants work through the tactical risk-management process and progressively develop the analytical components of an Enterprise Risk Management Plan and Risk Register. By the conclusion of ERM II, participants are prepared to move from tactical risk analysis and response planning into the organizational implementation and deployment activities addressed in Enterprise Risk Management III (Deployment).

Why Take Enterprise Risk Management II?
Establishing an ERM structure is essential—but structure alone does not manage risk. Organizations must be capable of systematically identifying the uncertainties that could affect their objectives and determining which risks require leadership attention, mitigation resources, monitoring, escalation, or acceptance.

Without a disciplined tactical methodology, organizations may:
* Treat all risks as equally important.
* Focus on highly visible risks while overlooking more significant enterprise exposures.
* React to symptoms rather than addressing underlying causes.
* Allocate resources to low-priority risks.
* Apply inconsistent risk-assessment criteria across departments.
* Develop mitigation actions without measurable outcomes.
* Fail to assign clear risk ownership.
* Allow identified risks to remain in reports without meaningful action.

ERM II provides the practical methodologies and tools necessary to address these challenges. Participants learn how to convert risk information into risk intelligence—and risk intelligence into informed organizational action.

The Tactical Risk Management Process
Enterprise Risk Management becomes meaningful when organizations can systematically evaluate uncertainty and determine what action should be taken.

ERM II develops this capability through a structured tactical process:
Organizational Objective → Risk Identification → Risk Analysis → Risk Assessment → Risk Prioritization → Risk Response → Mitigation → Ownership → Monitoring → Residual Risk

This process helps organizations move beyond simply maintaining a list of risks toward understanding which risks matter most, why they matter, what should be done about them, and whether the response is reducing exposure.

What You Will Learn
Throughout ERM II, participants develop practical competencies for analyzing and managing enterprise risks. Risk Identification - Learn structured methods for identifying events, conditions, threats, vulnerabilities, uncertainties, and opportunities that could affect organizational objectives. Participants examine risk across multiple areas of the enterprise, including:
* Strategic risk
* Operational risk
* Financial risk
* Technology and cybersecurity risk
* Human capital riskLegal and compliance risk
* Supply-chain and third-party risk
* Reputational risk
* Project and program risk
* Business continuity risk
* Emerging and external risk

The objective is to develop a comprehensive enterprise perspective rather than viewing risk through individual organizational silos.
* Writing Effective Risk Statements - Learn how to clearly articulate risk so decision-makers understand the cause, risk event, and potential consequence. Well-defined risk statements create the foundation for meaningful analysis, prioritization, mitigation, and reporting.
* Risk Analysis - Develop the ability to examine the conditions surrounding an identified risk. Participants learn to consider contributing factors, dependencies, existing controls, potential consequences, affected stakeholders, and the organizational objectives that may be impacted.
* Root Cause Analysis - Learn how to look beyond visible symptoms and determine the underlying conditions contributing to enterprise risk. Understanding root causes helps organizations design mitigation strategies that address the source of risk rather than repeatedly responding to its consequences.
* Likelihood Assessment - Develop a consistent approach for evaluating the probability or frequency of a risk event occurring. Participants learn why clearly defined assessment criteria are necessary to ensure risks are evaluated consistently throughout the organization.
* Impact Assessment - Learn how to evaluate the potential consequences of a risk across multiple organizational dimensions, including mission, operations, finances, customers, workforce, technology, compliance, reputation, and strategic objectives.
* Risk Scoring - Apply defined likelihood and impact criteria to establish risk scores that support comparison, prioritization, reporting, and decision-making.
* Risk Prioritization - Learn how to distinguish between risks requiring immediate leadership attention and those that can be managed through routine controls or monitoring. Prioritization helps ensure limited organizational resources are focused on the risks that could have the greatest impact on strategic objectives.
* Existing Controls - Evaluate the policies, procedures, systems, safeguards, processes, and management practices already in place to manage identified risks. Participants learn to consider both the existence and effectiveness of current controls.
* Risk Response Strategies - Learn how organizations can select appropriate responses based upon the nature, significance, and organizational context of each risk.

Responses may include:
* Avoid — Eliminate the activity or condition creating unacceptable exposure.
* Mitigate/Reduce — Take action to reduce likelihood, impact, or both.
* Transfer/Share — Shift or share portions of the exposure through contractual, insurance, partnership, or other mechanisms.
* Accept — Acknowledge the risk when exposure falls within established organizational tolerance. The appropriate response depends upon organizational objectives, risk appetite, resources, costs, benefits, and potential consequences.

Risk Mitigation Planning
Develop specific actions designed to reduce risk exposure. Participants learn to connect mitigation actions with: risk causes, expected outcomes, responsible owners, required resources, milestones, performance measures, completion dates, and monitoring requirements.

Risk Ownership and Accountability
Learn why every significant risk should have clearly defined ownership. Risk owners must understand the risk, monitor exposure, coordinate mitigation activities, communicate changes, and escalate concerns when necessary. Residual Risk - understand the difference between the risk that exists before additional action and the risk that remains after controls and mitigation strategies have been implemented. Participants learn to evaluate whether residual risk falls within acceptable organizational boundaries. Risk Monitoring - Develop methods for determining whether risk conditions are changing and whether mitigation activities are producing their intended results.

The ERM II Tactical Application Methodology
ERM II teaches participants to apply a disciplined tactical risk-management process:
1. Confirm the Organizational ObjectiveUnderstand what the organization is attempting to accomplish and why the objective matters.
2. Identify the RiskDetermine what uncertainty, event, condition, threat, or opportunity could affect successful achievement of the objective.
3. Define the Risk ClearlyDevelop a meaningful risk statement describing the cause, event, and potential consequence.
4. Analyze the RiskEvaluate contributing factors, dependencies, existing controls, affected stakeholders, and potential consequences.
5. Assess Likelihood and ImpactApply established criteria to determine the significance of the risk.
6. Establish the Risk RatingCalculate or assign an appropriate risk level based upon the organization's ERM methodology.
7. Prioritize the RiskDetermine the relative importance of the risk and the level of management attention required.
8. Select the Risk ResponseDetermine whether the organization should avoid, mitigate, transfer/share, or accept the risk.
9. Develop the Mitigation StrategyCreate specific actions addressing risk causes and reducing organizational exposure.
10. Assign Ownership and AccountabilityIdentify who owns the risk and who is responsible for mitigation activities.
11. Evaluate Residual RiskDetermine the expected exposure remaining after mitigation.
12. Establish Monitoring RequirementsIdentify measures, indicators, reporting requirements, review cycles, and escalation triggers.

From Risk Identification to Risk Action
A defining characteristic of ERM II is its emphasis on practical application.Participants do not simply learn definitions of likelihood, impact, mitigation, and residual risk. They apply them. Each major stage of the tactical risk-management process includes a corresponding exercise designed to reinforce learning and progressively build the participant's ERM work products.

The learning progression becomes: Identify → Analyze → Assess → Prioritize → Respond → Mitigate → Measure

This approach helps participants develop both an understanding of ERM methodology and the practical ability to apply it within an organization.

Developing the Enterprise Risk Register
One of the primary practical outcomes of ERM II is the development or enhancement of an Enterprise Risk Register. The Risk Register becomes a central management tool for documenting and communicating enterprise risk information. Depending upon organizational requirements, the Risk Register may include: risk identification number, organizational objective, risk category, risk statement, risk description, root causes, potential consequences, existing controls, likelihood rating, impact rating, inherent risk score, risk priority, risk owner, selected risk response, mitigation actions, responsible action owners, resource requirements, target completion dates, key risk indicators, residual risk rating, risk status, escalation requirements, monitoring and review dates. The objective is to transform the Risk Register from a static inventory of concerns into a dynamic enterprise management and decision-support tool.

Building the Risk Mitigation Plan
Identifying and scoring risks is not enough. Significant risks require action. ERM II teaches participants how to develop a Risk Mitigation Plan that connects identified enterprise risks with specific actions and accountability. A well-developed mitigation plan answers: 1) What are we going to do?, 2) Why are we doing it?, 3) Who is responsible?, 4) What resources are required?, 5) When will the action be completed?, 6) How will we measure progress?, 7) How much risk should remain after implementation?, and 8) When should the issue be escalated? This converts risk management from an assessment exercise into an actionable management process.

Who Should Enroll?
Executives and senior leaders, managers and supervisors, risk owners, program and project managers, operations professionals, strategy professionals, compliance professionals, internal audit professionals, financial professionals, cybersecurity and technology professionals, supply-chain and procurement professionals, business continuity professionals, organizational optimization professionals, government and military leaders, business owners and entrepreneurs and professionals pursuing Enterprise Risk Manager certification. Participants should ideally have completed Enterprise Risk Management I (Structure) or possess equivalent foundational ERM knowledge.

Certification Outcomes
Upon successful completion of Enterprise Risk Management II, participants should be better prepared to:
* Identify risks that could affect organizational objectives.
* Develop clear and meaningful enterprise risk statements.
* Analyze risk causes, consequences, dependencies, and existing controls.
* Apply consistent likelihood and impact criteria.
* Assess inherent risk exposure.
* Score and prioritize enterprise risks.
* Evaluate existing controls and their effectiveness.
* Select appropriate risk-response strategies.
* Develop actionable risk-mitigation plans.
* Assign risk ownership and mitigation accountability.
* Establish meaningful Key Risk Indicators and monitoring requirements.
* Evaluate residual risk following mitigation.
* Communicate risk information in a format useful to leadership and decision-makers.
* Develop and maintain an Enterprise Risk Register.
* Prepare enterprise risks and mitigation strategies for organizational deployment through ERM III.

Organizational Benefits
Organizations with trained ERM tactical practitioners are better equipped to move from generalized awareness of risk toward disciplined risk-informed decision-making.
ERM II capabilities can help organizations:
* Improve the quality of enterprise risk identification.
* Create consistent risk-assessment practices.
* Strengthen understanding of root causes.
* Improve prioritization of critical risks.
* Direct resources toward higher-priority exposures.
* Develop stronger mitigation strategies.
* Create clearer risk ownership and accountability.
* Improve communication between risk owners and leadership.
* Strengthen risk monitoring and escalation.
* Reduce fragmented risk-management practices.
* Improve organizational resilience.
* Connect enterprise risk management with strategic and operational decision-making.

Most importantly, ERM II helps organizations move from simply asking: “What could go wrong?” to determining: “What matters most, what are we going to do about it, who is responsible, and how will we know whether the risk is being effectively managed?”

Creating Risk Intelligence
Organizations generate significant amounts of information about problems, vulnerabilities, incidents, threats, controls, audits, performance, and emerging conditions. The challenge is converting that information into risk intelligence leadership can use.

ERM II teaches participants to organize and evaluate risk information so decision-makers can understand:
* What are our most significant risks?
* Which organizational objectives could be affected?
* What is causing the exposure?
* How likely is it to occur?
* What would the consequences be?
* What controls are already in place?
* What additional actions are required?
* Who owns the risk?
* Is the risk increasing or decreasing?
* Does the remaining exposure fall within our risk tolerance?

Answering these questions enables ERM to become a valuable organizational management capability rather than simply a compliance requirement.

The Second Step Toward Enterprise Risk Management Certification
Enterprise Risk Management II represents the transition from ERM structure to ERM application.
The three-part certification pathway progresses logically:
ERM I (Structure) - Build the ERM foundation. Establish governance, roles, responsibilities, terminology, risk categories, assessment criteria, and the organizational ERM framework.
ERM II (Tactical) - Apply the ERM methodology. Identify, analyze, assess, prioritize, respond to, mitigate, document, and monitor enterprise risks.
ERM III (Deployment) - Operationalize ERM across the enterprise. Deploy governance, integrate risk into decision-making, establish reporting and escalation, monitor enterprise exposure, and continuously improve the ERM program.
Together, the three programs develop professionals capable of progressing from understanding risk → analyzing risk → managing risk → deploying ERM as an enterprise capability.

Enterprise Risk Management II (Tactical Application) - Identify the Risk.  Analyze the Cause.  Assess the Exposure.  Prioritize What Matters.  Develop the Response.  Mitigate the Risk.  Measure the Results.

ERM II transforms risk information into risk intelligence—and risk intelligence into action.

Optimize • Achieve • Excel