Enterprise Risk Management
Registration RequiredA two-day Enterprise Risk Management programme designed to equip RwandAir managers with practical knowledge and tools to identify, assess, manage, monitor and report risks within their departments.
1. Programme OverviewWhy Enterprise Risk Management matters at RwandAir
RwandAir operates in a complex environment where strategic objectives are exposed to operational, financial, safety, regulatory, technological, human-capital, geopolitical, environmental and reputational risks.
Managers are at the centre of effective Enterprise Risk Management because they make operational decisions, own business processes, supervise controls and are often the first to identify changes in the organisation's risk exposure.
This two-day Enterprise Risk Management programme is therefore designed to equip RwandAir managers with practical knowledge and tools to identify, assess, manage, monitor and report risks within their respective departments while contributing to RwandAir's overall enterprise risk-management framework.
The programme will emphasise risk ownership and decision-making, rather than treating risk management as the responsibility of the Risk, Compliance or Internal Audit functions alone.
2. Overall Training ObjectiveThe programme-wide objective
The overall objective is to strengthen the capacity of RwandAir managers to identify, assess, manage, monitor and communicate risks within their areas of responsibility and integrate risk considerations into day-to-day management and strategic decision-making.
3. Specific Learning Objectives14 capabilities participants should develop
Explain the principles and business value of Enterprise Risk Management and how ERM supports RwandAir's strategic objectives.
Understand the responsibilities of managers as risk owners and distinguish management responsibilities from those of Risk Management, Compliance and Internal Audit.
Identify strategic, operational, financial, safety, technology, regulatory, people, ESG, reputational and emerging risks relevant to their departments.
Write clear and meaningful risk statements describing the cause, risk event and potential consequences.
Assess risks using likelihood and impact criteria and distinguish between inherent and residual risk.
Understand and apply risk appetite, risk tolerance and escalation thresholds when making management decisions.
Evaluate whether existing controls are appropriately designed and operating effectively.
Develop practical risk-treatment and mitigation actions for risks that exceed acceptable levels.
Develop and maintain effective departmental risk registers.
Establish and use Key Risk Indicators (KRIs) and early-warning indicators to monitor changing risk exposures.
Recognise interconnected and emerging risks that could affect multiple RwandAir departments.
Escalate significant risks appropriately and communicate risk information effectively to senior management.
Integrate risk considerations into planning, budgeting, projects, procurement, operations and other management decisions.
Apply ERM principles to realistic RwandAir and aviation-sector scenarios.
4–5. Two-Day Programme Structure10 modules across two training days
1Enterprise Risk Management for Managers
To enable managers to understand ERM as a management and decision-making discipline and appreciate their individual responsibilities for managing risk.
- Meaning and purpose of Enterprise Risk Management
- ERM versus traditional risk management
- Relationship between risk and organisational objectives
- Principles of ISO 31000 and COSO ERM
- Risk and opportunity
- Why ERM matters in the aviation industry
- Integrating ERM into normal management processes
- Role of the Board, Executive Management and managers
- The Three Lines Model
- Risk ownership versus Risk Management oversight
- Responsibilities of a RwandAir manager as a risk owner
- Building a strong organisational risk culture
Participants will receive different RwandAir-related risk scenarios and determine who should own, manage, monitor, report and provide assurance over each risk.
2Understanding RwandAir's Enterprise Risk Universe
To enable managers to recognise the different categories of risks that may affect RwandAir's strategic and operational objectives.
- Business strategy
- Route/network strategy
- Competition
- Partnerships and alliances
- Capital investment
- Geopolitical developments
- Flight and ground operations
- Operational disruptions
- Aircraft availability
- Maintenance and engineering
- Airport operations
- Supply-chain dependencies
- Third-party service providers
- Fuel-price volatility
- Foreign-exchange exposure
- Liquidity
- Credit exposure
- Cost escalation
- Revenue risks
- Cyberattacks
- System failures
- Data breaches
- Digital transformation
- Technology dependence
- Third-party technology providers
- Critical skills shortages
- Employee competency
- Succession planning
- Human error
- Employee conduct
- Aviation regulations
- Contractual risks
- Data protection
- International regulatory requirements
- Compliance failures
- Customer experience
- Social media
- Service disruptions
- Crisis communications
- Stakeholder confidence
- Climate-related physical risks
- Transition risks
- Carbon and emissions requirements
- Environmental obligations
- Sustainability expectations
- Artificial intelligence
- Geopolitical conflicts
- New regulations
- Pandemics and health emergencies
- Extreme weather events
- Changing customer behaviour
Participants develop a preliminary RwandAir Enterprise Risk Universe and identify the most important risks affecting their departments.
3Effective Risk Identification
To equip managers with practical techniques for systematically identifying risks before they become major incidents or threaten business objectives.
- Objective-based risk identification
- Process-based risk identification
- Risk workshops and brainstorming
- Scenario analysis
- Historical incidents and loss-event analysis
- External environment analysis
- Emerging-risk identification
- Identifying causes, events and consequences
- Avoiding vague risk descriptions
- Risk Statement Method: CAUSE → RISK EVENT → CONSEQUENCE
- Example: Due to dependence on critical technology infrastructure, a prolonged system outage could disrupt passenger processing and flight operations, resulting in delays, financial losses and reputational damage.
Each manager identifies 5–10 major risks within their department and develops properly structured risk statements.
4Risk Assessment and Prioritisation
To enable managers to assess identified risks consistently and prioritise management attention and resources.
- Qualitative and quantitative assessment
- Likelihood assessment
- Impact assessment
- Financial impact
- Operational impact
- Customer impact
- Regulatory impact
- Safety impact
- Reputational impact
- Inherent risk
- Existing controls
- Residual risk
- Risk velocity
- Risk interdependencies
- 5×5 risk matrices
- Risk heat maps
- Prioritising risks for management action
Using selected RwandAir scenarios, participants will work through the complete risk assessment process.
- Identify the risk.
- Determine its causes.
- Assess its consequences.
- Determine likelihood.
- Determine impact.
- Calculate the inherent risk rating.
- Identify existing controls.
- Evaluate control effectiveness.
- Determine residual risk.
- Decide whether additional management action is required.
5Risk Appetite, Tolerance and Management Decision-Making
To enable managers to understand how much risk RwandAir is prepared to accept and when risks should be escalated.
- Risk capacity
- Risk appetite
- Risk tolerance
- Risk limits
- Risk thresholds
- Relationship between strategy and risk appetite
- Risks with very low tolerance
- Translating enterprise risk appetite into departmental limits
- Escalation when limits are breached
- Risk acceptance authority
- Incorporating risk appetite into managerial decisions
Participants review several management scenarios and determine whether to Accept – Reduce – Transfer/Share – Avoid – Escalate the risk.
6Controls and Risk Treatment
To enable managers to evaluate existing controls and develop appropriate actions for unacceptable risks.
- Understanding internal controls
- Preventive controls
- Detective controls
- Corrective controls
- Manual versus automated controls
- Control ownership
- Control design effectiveness
- Control operating effectiveness
- Control gaps
- Cost versus benefit of controls
- Risk-treatment strategies
- Developing management action plans
- Assigning responsibilities and deadlines
- Tracking outstanding actions
Participants select major departmental risks and document: Risk → Existing Controls → Control Gaps → Residual Risk → Required Action → Owner → Deadline.
7Key Risk Indicators and Early-Warning Systems
To enable managers to develop indicators that provide early warning of increasing risk exposure.
- What is a Key Risk Indicator?
- KRIs versus KPIs
- Leading versus lagging indicators
- Setting thresholds
- Green, Amber and Red thresholds
- Linking KRIs to risk appetite
- Escalation triggers
- Data sources
- Monitoring frequency
- Management actions when thresholds are breached
Each group develops 3–5 KRIs for its priority risks, including thresholds and escalation actions.
- Flight disruptions
- Aircraft availability
- System downtime
- Customer complaints
- Employee turnover
- Critical vacancies
- Supplier performance
- Foreign-exchange exposure
- Fuel-price movements
- Regulatory breaches
- Cybersecurity incidents
- Outstanding audit/risk actions
8Emerging Risks, Business Continuity and Crisis Preparedness
To strengthen managers' ability to anticipate low-frequency/high-impact events and manage interconnected risks.
- Emerging-risk identification
- Scenario analysis
- Stress testing
- Business continuity
- Crisis management
- Operational resilience
- Critical processes
- Critical third parties
- Risk interdependencies
- Crisis escalation and communication
- Lessons learned following incidents
Participants respond to a scenario involving a cyberattack + critical operational system outage + flight disruptions + customer complaints + social-media escalation.
- Determine immediate risks.
- Identify departments affected.
- Assess business impact.
- Determine controls required.
- Determine escalation requirements.
- Define business continuity actions.
- Set communication priorities.
- Define short-term and long-term mitigation.
9Risk Monitoring, Escalation and Reporting
To enable managers to communicate relevant risk information clearly and support timely Executive Management decisions.
- Risk monitoring responsibilities
- Updating departmental risk registers
- Risk-review meetings
- Escalation criteria
- Risk dashboards
- Heat maps
- KRI reporting
- Reporting changes in risk exposure
- Emerging-risk reporting
- Reporting overdue management actions
- Communicating risks to Executive Management
- What management needs from a good risk report
Participants prepare a concise Management Risk Dashboard.
- Top risks
- Current risk ratings
- Movement/trend
- KRIs
- Control effectiveness
- Actions outstanding
- Emerging risks
- Risks requiring Executive Management attention
10ERM Integration and Management Action Planning
To ensure that participants translate the training into practical improvements within their departments.
- Integrating risk into strategic planning
- Risk-informed budgeting
- Risk in procurement and supplier management
- Risk in projects
- Risk in performance management
- Risk considerations in major management decisions
- Departmental risk-review meetings
- Strengthening risk culture
- Management accountability
Each management group develops a 90-Day ERM Action Plan for its department.
- Priority risks requiring attention
- Controls requiring improvement
- New KRIs to implement
- Risk-register improvements
- Required management actions
- Responsible persons
- Implementation deadlines
6. Training MethodologyPractical and participatory delivery
The programme will use a practical and participatory approach rather than lecture-based delivery.
Where RwandAir permits, selected existing policies, risk registers and risk-management tools can be incorporated into the exercises so that participants work on issues directly applicable to the organisation.
7. Expected Training OutcomesWhat the programme is expected to strengthen
At the conclusion of the two days, participating managers should be able to take greater ownership of risks within their respective functions.
The programme is expected to contribute to:
8. Key Practical OutputsPractical tools participants will build during the programme
During the programme, participants will work towards producing:
9. Proposed Daily ScheduleTwo-day programme agenda
Day One — Identifying and Assessing Enterprise Risks
Day Two — Managing, Monitoring and Reporting Risks
10. Programme SuccessFive questions managers should be able to answer
The success of the programme should ultimately be measured by managers' ability to answer five critical questions within their areas of responsibility:
What are our most important risks?
How significant are those risks?
Are our existing controls working effectively?
What indicators will tell us that our risk exposure is increasing?
What management action should we take, and when should the risk be escalated?
The programme will therefore position Enterprise Risk Management as an integral part of how RwandAir managers plan, make decisions, manage performance and protect the organisation's strategic objectives.