What you'll learn
- Determine which Saudi regulators apply to your organisation, from the Saudi Central Bank (SAMA) and the Capital Market Authority (CMA) to the National Cybersecurity Authority (NCA) and the Saudi Data and AI Authority (SDAIA).
- Apply the ISO 31000:2018 framework and process and compare it with COSO ERM (2017) to choose the right approach for your organisation.
- Draft a risk appetite statement and a board-approved risk policy with a measurable limit for each risk category.
- Map SAMA risk governance expectations, NCA cybersecurity controls and PDPL data protection risk obligations to your risks, controls and owners in a requirements register.
- Conduct risk identification with workshops, bow-tie analysis and pre-mortems, and record each risk as cause, event and consequence in a risk register.
- Assess risks on calibrated likelihood and impact scales, and calculate expected monetary value, then run a Monte Carlo risk analysis in Excel to set contingency.
- Evaluate control effectiveness and residual risk, then select the treatment option that fits your appetite: avoid, reduce, transfer or accept.
- Manage project, operational, cyber, third-party risk management, financial and fraud risks, and assess emerging AI, ESG and geopolitical risks.
- Design key risk indicators with green, amber and red thresholds, and prepare a concise board risk report that asks for clear decisions.
- Conduct a risk maturity assessment and a blameless incident review that feed lessons back into the risk register.
Course overview
A risk management certification and training course in Saudi Arabia should fix a common gap: risk registers that list dozens of risks but never show the board which three need a decision. Many professionals can recite the steps of a risk process. Fewer can set a measurable appetite, rate risks on calibrated scales and report to a committee in plain language.
You finish able to run a full enterprise risk management cycle at work. You apply ISO 31000:2018 and COSO ERM (2017), write risks as cause, event and consequence, analyse them with expected monetary value and Monte Carlo simulation, and track them with key risk indicators. The level is intermediate, for professionals who already handle risk, audit, compliance or project files and want a repeatable method.
The lessons start from Saudi supervisory practice, not generic theory. Module 6 covers the Saudi Central Bank (SAMA) expectation of a board-approved risk policy and an independent risk function that reports through a risk committee, the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls and their cybersecurity risk management requirement, and the Personal Data Protection Law (PDPL) obligations on consent, processors and breach notification. It also reviews the 2026 General Authority for Military Industries (GAMI) Risk Management Guide, which builds on ISO 31000 and COSO for the defence sector.
Nine modules cover ISO 31000, COSO ERM, SAMA governance expectations, the NCA controls, the PDPL and GAMI sector guidance, then end with a capstone programme for a Saudi company. Complete the course and pass the final exam to earn the Imtithal Academy Certificate of Completion. This risk management certification and training course in Saudi Arabia gives you a method you can show to a board, an auditor or a regulator.
Course curriculum
Module 1: Risk Management Foundations and the Saudi Context — 52 min
- Lesson 1.1: Core Risk Concepts Refresher8 min
- Lesson 1.2: The Saudi Risk Landscape: Vision 2030, Giga-Projects and Digital Transformation8 min
- Lesson 1.3: The Regulatory Map: SAMA, CMA, NCA, SDAIA and Sector Regulators8 min
- Lesson 1.4: Risk Roles and Career Pathways8 min
- Module 1 quiz: Risk Management Foundations and the Saudi Context10 questions
Module 2: Frameworks and Governance — 68 min
- Lesson 2.1: ISO 31000:2018 Principles and Framework8 min
- Lesson 2.2: The ISO 31000 Risk Management Process8 min
- Lesson 2.3: COSO ERM (2017) and Framework Comparison8 min
- Lesson 2.4: Governance and the Three Lines Model8 min
- Lesson 2.5: Risk Appetite, Tolerance and Capacity8 min
- Lesson 2.6: Risk Policy and Framework Documentation8 min
- Module 2 quiz: Frameworks and Governance10 questions
Module 3: Establishing Context and Risk Identification — 60 min
- Lesson 3.1: Internal and External Context (SWOT and PESTLE)8 min
- Lesson 3.2: Stakeholder Analysis8 min
- Lesson 3.3: Risk Identification Techniques8 min
- Lesson 3.4: Risk Taxonomy and Categories8 min
- Lesson 3.5: Writing Good Risk Statements and Building the Risk Register8 min
- Module 3 quiz: Establishing Context and Risk Identification10 questions
Module 4: Risk Analysis and Evaluation — 68 min
- Lesson 4.1: Qualitative Assessment and Heat Maps8 min
- Lesson 4.2: Calibrating Risk Scales for Your Organisation8 min
- Lesson 4.3: Quantitative Methods: EMV, Sensitivity Analysis and Monte Carlo8 min
- Lesson 4.4: Controls and Residual Risk8 min
- Lesson 4.5: Cognitive Bias and Expert Judgment8 min
- Lesson 4.6: Risk Evaluation and Prioritisation8 min
- Module 4 quiz: Risk Analysis and Evaluation10 questions
Module 5: Risk Treatment, Monitoring and Reporting — 60 min
- Lesson 5.1: Treatment Options: Avoid, Reduce, Transfer, Accept, Exploit8 min
- Lesson 5.2: Designing Controls and Action Plans8 min
- Lesson 5.3: Risk Transfer and Insurance8 min
- Lesson 5.4: Key Risk Indicators and Monitoring8 min
- Lesson 5.5: Risk Reporting and Dashboards8 min
- Module 5 quiz: Risk Treatment, Monitoring and Reporting10 questions
Module 6: Saudi Regulatory and Compliance Landscape — 60 min
- Lesson 6.1: SAMA Risk Governance Expectations8 min
- Lesson 6.2: NCA Cybersecurity Controls and Cyber Risk Management8 min
- Lesson 6.3: PDPL and Data Protection Risk8 min
- Lesson 6.4: Government and Sector-Specific Guides8 min
- Lesson 6.5: Integrated GRC and Compliance-to-Risk Mapping8 min
- Module 6 quiz: Saudi Regulatory and Compliance Landscape10 questions
Module 7: Specialised Risk Domains — 68 min
- Lesson 7.1: Project and Giga-Project Risk8 min
- Lesson 7.2: Operational Risk and Business Continuity8 min
- Lesson 7.3: Cyber and Third-Party Risk8 min
- Lesson 7.4: Financial Risk Essentials8 min
- Lesson 7.5: Emerging Risks: AI, ESG and Geopolitical8 min
- Lesson 7.6: Fraud and Compliance Risk8 min
- Module 7 quiz: Specialised Risk Domains10 questions
Module 8: Risk Culture, Communication and Maturity — 60 min
- Lesson 8.1: Building a Risk-Aware Culture8 min
- Lesson 8.2: Communicating Risk to Executives and Boards8 min
- Lesson 8.3: Risk Maturity Assessment8 min
- Lesson 8.4: Crisis and Incident Response Basics8 min
- Lesson 8.5: Continuous Improvement8 min
- Module 8 quiz: Risk Culture, Communication and Maturity10 questions
Module 9: Capstone Project and Exam Preparation — 44 min
- Lesson 9.1: Capstone Brief and Marking Criteria8 min
- Lesson 9.2: Capstone Deliverables Guide8 min
- Lesson 9.3: Exam Preparation and Final Review8 min
- Module 9 quiz: Capstone Project and Exam Preparation10 questions
Final examination — 60 min
- Final examination: Risk Management40 questions
Who is this course for?
- Risk and compliance officers who maintain risk registers and map SAMA, NCA and PDPL requirements to controls.
- Internal auditors who plan risk-based audits and test control effectiveness against the ISO 31000 process.
- GRC and cybersecurity analysts who turn gaps against the NCA Essential Cybersecurity Controls into rated business risks.
- Project and programme managers who set contingency with expected monetary value and Monte Carlo analysis on giga-project work.
- Finance and banking professionals in SAMA-supervised institutions who report risk to a board risk committee.
- Government and semi-government staff who build an entity risk framework and report to an executive committee.
- Business continuity and operations managers who run a business impact analysis and set recovery time objectives.
- Managers in construction, energy, healthcare and defence who work with sector regulator guidance such as the GAMI Risk Management Guide.
Prerequisites
This intermediate risk management course needs basic familiarity with business operations and risk terminology, and no prior certification. The course is available in Arabic and English, and you can study on a computer or phone with internet access, plus a spreadsheet such as Excel for the Monte Carlo exercise. Plan for about 7 hours of study at your own pace. Regulations and guidance change, so confirm current requirements on the official websites of SAMA, the NCA, SDAIA and your sector regulator before you apply them.
Assessment
A short quiz after each module and a final assessment. Pass mark: 70%, with up to 3 attempts.
Academy certificate of completion
Complete all lessons and pass the final assessment with 70% or more to receive a digital certificate in your name that you can download and share.
- Downloadable digital certificate
- Shows your name, the course title and completion date
- Suitable for training and CPD records
Frequently asked questions
What level is this risk management certification and training course in Saudi Arabia, and who is it for?
This risk management certification and training course in Saudi Arabia is intermediate. It suits professionals with roughly two to five years of experience in risk, compliance, internal audit, project management, GRC or cybersecurity, and anyone who has completed a foundation course. Basic familiarity with business operations and risk terminology is enough, and no prior certification is needed. Lesson 1.1 refreshes the core ideas before Module 2 moves into ISO 31000:2018, COSO ERM and the regulatory material from SAMA, the NCA and SDAIA.
Is the certificate accredited?
No. The certificate from this risk management certification and training course in Saudi Arabia is the Imtithal Academy Certificate of Completion, issued when you finish the course and pass the final exam. It is not a licence, a government accreditation or a professional qualification, and it is not issued by SAMA, the NCA, SDAIA or any other authority. You can add it to your CV, LinkedIn profile or employer training record as evidence of about 7 hours of structured study.
Is this course legal or regulatory advice?
No. The course is education, not legal, tax or regulatory advice. It explains how SAMA, the NCA, SDAIA and sector authorities set risk expectations, and it shows how to turn them into risks, controls and reports. Regulations change, so confirm current requirements on the official websites of the Saudi Central Bank, the National Cybersecurity Authority, the Saudi Data and AI Authority and your sector regulator. Take advice from a qualified adviser for decisions that affect your organisation.
How does ISO 31000 vs COSO ERM compare, and which should a Saudi organisation use?
ISO 31000:2018 is a set of guidelines built on principles, a framework and a risk process, and it is not certifiable. COSO ERM (2017) has five components and 20 principles and links risk to strategy and performance. They are compatible, and many organisations use the ISO 31000 process for assessments and COSO components for governance and reporting. Module 2 shows how to compare them against regulator expectations and document a hybrid approach in your risk policy.
What are the SAMA risk management requirements for the risk function?
For institutions supervised by the Saudi Central Bank (SAMA), published rules refer to a board-approved risk management policy and an independent risk management function that reports through a risk committee. SAMA also issues frameworks on cyber security, business continuity and outsourcing. Lesson 6.1 shows how to turn these expectations into a requirements register linked to risks, controls and owners. Always read the current SAMA rulebook for the documents that apply to your licence type.
How do the NCA Essential Cybersecurity Controls connect to risk management?
The National Cybersecurity Authority (NCA) Essential Cybersecurity Controls place cybersecurity risk management inside the governance domain, next to defence, resilience, and third-party and cloud domains. In Lesson 6.2 you convert control gaps into rated business risks, link controls to the risk register and report cyber indicators in the enterprise dashboard. Which NCA control sets apply to you depends on your classification and contracts, so confirm them on the official NCA website.
What Personal Data Protection Law (PDPL) obligations create risk for Saudi businesses?
The Personal Data Protection Law (PDPL), supervised by the Saudi Data and AI Authority (SDAIA), sets duties on lawful basis and consent, privacy notices, data subject rights, security, breach notification, retention, cross-border transfers and processor management. Each duty becomes a risk that you can rate, assign and monitor. Lesson 6.3 gives example risk statements and controls. Check the PDPL Implementing Regulations on the SDAIA website for current timeframes and penalties.
How do I build a risk register and a risk appetite statement?
Start from objectives and context, identify risks with workshops or a pre-mortem, then write each risk as cause, event and consequence with an owner, existing controls, a residual rating and dated actions. For appetite, set a level and a measurable limit or key risk indicator for each category, such as zero material regulatory breaches. Modules 2 and 3 provide the field lists and example tables, and the capstone asks you to produce both for a Saudi company.
How is the course assessed, and how many attempts do I get?
Each of the nine modules ends with a 10-question quiz. The final exam has 40 questions, a pass mark of 70% (28 correct answers) and 3 attempts, with a time limit of [insert time limit]. The capstone project is self-assessed against a 100-point rubric because the platform does not grade written work. The certificate is issued when you complete the course and pass the final exam.
Will this course prepare me for ISO 31000, PMI-RMP or CRISC exams?
It builds the practical foundation those credentials assume, but it is not an official exam-prep course for ISO 31000 Lead Risk Manager, PMI-RMP or CRISC. Each body sets its own syllabus, experience rules and exam. The intermediate level of this risk management certification and training course in Saudi Arabia suits professionals who want applied skills first and an external credential later, and Module 1 lists common credential pathways.
Imtithal Academy — English version
Training a team?
We offer company pricing with progress tracking for your staff and a certificate for every learner.