Last reviewed 2 November 2026 against the sources linked in this post.
The quarterly risk review is tomorrow, and the register still lists "cyber" as one line, rated amber. Then a finance colleague mentions a supplier asked to change its bank details by email. That is the gap risk manager training has to close: the risks that matter sit in every team, and the people closest to them are not risk specialists. The World Economic Forum's Global Risks Report 2026 ranks misinformation and disinformation #2 and cyber insecurity #6 on its two-year outlook, according to its survey of risk experts.
Certification programmes teach the frameworks. This list covers the other half: what your risk champions in each team need to recognise, escalate and prevent. You get 12 ready-made courses in 4 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The legal points describe US federal and EU rules, so use this as a syllabus, not a ruling.
All 12 courses at a glance
| Course | What it covers | Length | Law behind it? |
|---|---|---|---|
| Hazard identification and risk assessment for teams | Spotting hazards, scoring risk and choosing controls | 40 min | No |
| Safety law, committees, management systems and audits | Duties, safety committees and internal audits | 40 min | No |
| Cyber risk governance for managers and boards | The questions to ask and escalate on cyber risk | 40 min | No |
| Ransomware tabletop for managers | Rehearsing a ransomware decision process | Not yet live | No |
| Who is responsible? AI Act roles, deployer duties and your organisation's AI governance | AI roles, risk levels and intake to approval | 45 min | No (EU AI Act context) |
| Phishing & social engineering | Red flags, verification and reporting | 30 min | No |
| Social engineering, fraud and deepfakes | Payment, phone and impersonation scams | 35 min | No |
| Banking conduct, regulation and prudential risk essentials | Conduct, operational, market and liquidity risk | 40 min | No |
| Anti-bribery & corruption (FCPA) | Gifts, third parties and facilitation payments | 40 min | Yes (US federal law) |
| Code of conduct | A decision test, grey areas and speaking up | 35 min | No |
| Conflicts of interest | Disclosing and deciding on conflicts | 25 min | No |
| Data classification & handling | Classifying and handling sensitive information | 25 min | No |
The law sets rules for how organisations behave. Only the FCPA course here sits directly on a US federal law, and it does not require a course.
Hazard and operational risk
Hazard identification and risk assessment for teams
This 40-minute course teaches teams the foundation of any risk process: telling hazard from risk, walking a job step by step, scoring risk with a matrix and ranking controls from eliminate to PPE. Champions need it because they run the first assessment in their own area. In the scoring lesson learners place a hazard on the matrix themselves, which makes a good Pick Answer round.
Safety law, committees, management systems and audits
Risk managers often oversee the safety system without having written it. This 40-minute course covers employer, manager and worker duties, how a joint safety committee runs, a management system in five steps and internal inspections, ending with working with the regulator. A committee scenario asks learners to run a meeting and find and fix an issue.
Our pick: Hazard identification and risk assessment for teams. Every other risk process starts with someone spotting and scoring a hazard, so this is the shared language champions need first.
Cyber, fraud and AI risk
Cyber risk governance for managers and boards
This 40-minute course gives managers five questions to ask about cyber risk, with good answers, risk appetite and a short dashboard. It also covers the hard calls: paying, telling and trade-offs. Risk managers use it to agree what gets escalated and when. A "what would you do?" decision in a crisis is the best moment to poll the room. For the board's side of the table, see our guide to board of directors training.
Ransomware tabletop for managers
This tabletop for managers rehearses a ransomware decision process so risk owners know their roles before an incident. It has no live template page yet, so it is named here without a link. Until it goes live, use the cyber risk governance course above, which covers the same paying, telling and trade-off decisions.
Who is responsible? AI Act roles, deployer duties and your organisation's AI governance
AI now feeds the risk register. The European Commission describes the AI Act as a risk-based set of rules for AI developers and deployers regarding specific uses of AI. This 45-minute course, written for the European Union, covers roles (provider, deployer, other), four risk levels, deployer duties and a governance path from intake to approval and monitoring. In the sorting lesson, learners place real use cases into the right risk level.
Phishing & social engineering
Phishing is a leading operational risk that champions help reduce. This 30-minute course traces a business email compromise, teaches red flags across email, text, voice, QR codes and AI deepfakes, and ends with a 12-question final check. A spot-the-red-flags round works well as a Pick Answer quiz.
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
Payment fraud and deepfake impersonation sit on every modern risk register. This 35-minute course follows a convincing request for new bank details, teaches verifying money requests with a known number and covers faked voices and video. The grey-areas lesson asks why people comply with seniority, politeness and secrecy, which a Word Cloud captures quickly.
Our pick: Cyber risk governance for managers and boards. It turns cyber risk from a technical amber line into decisions people can name, which is what a risk review needs.
Financial and regulatory risk
Banking conduct, regulation and prudential risk essentials
This 40-minute course is written for compliance and risk champions. It covers who supervises what, fair treatment in five habits, operational, market and liquidity risk in plain words, and which rule applies in grey areas. Use it even outside banking: the sorting exercise on operational risk events works in any sector. Learners sort events into categories and compare.
Anti-bribery & corruption (FCPA)
Third-party bribery exposure is a core compliance risk to rate and monitor. The US Department of Justice says the FCPA's anti-bribery provisions prohibit corruptly offering, paying or promising anything of value to a foreign official to influence them or secure an improper advantage in obtaining or retaining business. This 40-minute course covers the rules in brief, a decision framework for gifts, travel and hospitality, third-party red flags and a 10-question final check. For a wider programme view, see our guide to compliance officer training.
Our pick: Banking conduct, regulation and prudential risk essentials. It gives risk teams one plain-English map of conduct, operational, market and liquidity risk, useful well beyond banks.
Ethics and information handling
Code of conduct
Conduct risk starts with a shared standard that champions can point to. This 35-minute course gives teams a four-question decision test and works through grey areas across common topics and speaking up. It ends with a 10-question final check at 80% to pass. Try a scenario round in which learners vote before the policy answer is shown.
Conflicts of interest
Undeclared conflicts are a classic hidden risk that champions help surface. This 25-minute course defines actual, potential and perceived conflicts, teaches "disclose, then decide" and has learners complete and update a conflict disclosure. A quick Rating Scale asks how confident people feel about when to disclose.
Data classification & handling
Information risk depends on staff classifying data correctly. This 25-minute course covers classification levels, what is allowed and not allowed at each, red flags and how to escalate a misclassification. In the case-practice round, learners sort everyday documents into the right class.
Our pick: Conflicts of interest. It is the shortest way to surface a risk that never appears in a system log: the one nobody declared.
How to roll the plan out
Order it by exposure. The World Economic Forum ranks cyber insecurity #6 and misinformation #2 on its two-year outlook, so put the cyber and fraud courses early for everyone who handles money, data or suppliers.
- In the first month: hazard identification, phishing, fraud and deepfakes, and the code of conduct, for all risk champions.
- Within the first quarter: conflicts of interest, data classification, cyber risk governance and, if you have third parties abroad, the FCPA course.
- Each year: a refresher quiz on each course, plus the AI governance course whenever a team adopts a new AI tool.
- When you need it: safety law and audits for those who oversee the safety system, banking conduct for financial services teams, and the ransomware tabletop once it goes live.
Add your own state or country rules where your teams work, and ask your lawyer or the regulator what applies. If your champions also lead people, our guide to leadership training for supervisors covers that side of the role.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live Q&A session deck, or both, with a post-course survey and a 30-day check-in to see what changed.
- Pick Answer: show five hazards and ask where each lands on the risk matrix, or which of four messages is the phishing attempt.
- Word Cloud: ask "Why would someone pay an urgent invoice without checking?" The biggest words show which pressure to train against.
- Rating Scale: before and after, ask "How confident are you that you would spot a conflict of interest?" from 1 to 5.
- Open Ended: collect anonymous near-misses at the end of a live session, so risks surface that never reach the register.
FAQ
What training do risk managers need?
Risk managers need risk assessment methods plus cyber, fraud, regulatory and conduct knowledge. The courses above cover the second group, which certification programmes may not cover.
What is a risk champion?
A risk champion is a team member who represents risk management in their area and reports risks upward. They are not risk specialists, so a short shared course gives them the same vocabulary.
Is risk manager certification worth it?
It can help careers, but it does not replace role-specific compliance training. Day to day, practical courses on fraud, cyber and conduct matter just as much to how risk is handled.
How often should risk training run?
Annually, with refreshers when the risk profile changes. A new AI tool, a new supplier or a fresh scam in the news is a good reason to run a short refresher sooner.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
