Tailor the responses to your specific context – organisation, industry and country – and consult with professionals or experts for specific advice or guidance. Be creative in exploring different prompts. 

1. Risk governance

• “Act as a CEO and write a business-focused practical risk management policy according to ISO 31000 for [web page URL].”
• “Act as a CEO and write a comprehensive risk strategy for [web page URL]. The strategy must detail all steps, actions, and deliverables to be produced including performance indicators to monitor progress and for reporting purposes. A risk management strategy is a structured approach to addressing risks and can be used in companies of all sizes and across any industry.”
• “Create a risk universe for [web page URL]. The risk universe is the list of risks the company faces or might face. This risk universe can be used as a checklist to identify, consolidate and aggregate risk events across the organisation for reporting and monitoring. Tell me how to apply the risk universe.”
• “What are the key components of a robust risk governance framework for a company with [number of employees] operating in the [industry] in [country]? How can we establish a structure that promotes effective risk management throughout the organisation?”
• “What roles and responsibilities should be defined for effective risk governance? How can we allocate accountability and ensure clear ownership of risks, controls and treatments?”
• “How can the board and senior management effectively engage in risk governance? What practices or mechanisms can be implemented to promote their active involvement?”
• “How can we define and communicate the organisation’s risk appetite and tolerance levels? What considerations should be considered when establishing these parameters?”
• “What policies and procedures should be developed to guide risk governance activities? How can we ensure they align with industry best practices and regulatory requirements?”
• “What reporting mechanisms should be in place to provide regular updates on risk governance activities? How can we effectively communicate risk information to relevant stakeholders?”
• “How can we foster a strong risk culture within the organisation? What initiatives can be implemented to promote risk awareness and encourage risk-conscious behaviours?”
• “What mechanisms should be established to monitor and review the effectiveness of risk governance practices? How can we ensure continuous improvement in risk management?”
• “Create a comprehensive business continuity and resilience strategy for [web page URL] that incorporates the managing of third-party and supply chain risks that complies with the requirements of ISO 22301.”
• “What are the steps to take to move from risk management 1.0 to risk management 2.0 and 3.0?”

2. Risk identification

• “Identify key strategic risk events that may impact the achievement of strategic objectives for [web page URL]. Risk is defined as the effect of uncertainty on objectives. For each risk identified, list linkage to a strategic objective, causes of the risk, consequences of the risk, possible controls and treatments to mitigate the risk, key risk indicators and key control indicators”
• “What are some common risks and issues that [country] organisations in [your industry] face? How can we identify and prioritise these risks within our organisation?”
• “How can we assess the likelihood and potential impact of [specific risk] on our organisation? What factors should we consider in our risk assessment process?”
• “What are some effective strategies or controls that can be implemented to mitigate risks associated with [specific area or process]? How can we evaluate their effectiveness?”
• “Are there any emerging risks or trends in [your industry] that we should be aware of? How can we proactively identify and assess these risks to stay ahead?”
• “What are some internal factors within our organisation and [industry] that may pose risks? How can we identify and evaluate risks related to our operations, systems, or culture when we operate as [organisational type]?”
• “What are some external factors or events that can impact our organisation in the [industry]? How can we identify and assess risks related to the [country] economy, regulatory changes, or geopolitical factors?”
• “How can we map and prioritise risks based on their likelihood and potential impact in [industry]? What tools or frameworks can be used to visually represent and analyse risk landscapes?”
• “How can we determine and define our organisation’s risk appetite and tolerance levels? What considerations should be considered when assessing risk tolerance in our [industry]?”
• “What are some common methods for identifying risks within an organisation operating in [industry]?”
• “How can we identify and categorise risks in different areas of our business?”
• “What techniques or tools can we use to ensure comprehensive risk identification?”
• “How to conduct a 2-hour risk identification workshop with the right stakeholders participating in the workshop? Develop the agenda for the workshop. For each agenda item, list out action steps to take, and duration. Highlight key outcomes.”

3. Risk scenario analysis

• “Based on historical data and industry trends, what are the potential risks and impacts of [specific scenario] on our organisation operating in [industry] and [country]?”
• “What is the likelihood of [specific risk] occurring in our organisation? What could be the potential severity or impact if it does happen?”
• “What are some effective mitigation strategies we can implement to minimise the risks associated with [specific scenario]? How can we proactively address these risks?”
• “In the event of [specific risk scenario], what steps should we take to respond effectively and recover our operations? Are there any key considerations or best practices?”
• “What are the potential costs and benefits of investing in risk mitigation measures for [specific scenario]? How can we assess the return on investment and prioritise our efforts?”
• “Based on similar past incidents or industry case studies, what are the key lessons learned that we should consider when planning for [specific risk scenario]?”
• “What are some emerging risks or trends in [our industry] that we should be aware of? How can we proactively assess and address these risks to ensure our resilience?”

4. Risk assessment

• “What are the key sources of risk that should be considered when conducting a risk assessment for our organisation operating in [industry] and [country]? How can we identify and document potential risks?”
• “What are the different methods and approaches available for analysing and evaluating risks? How can we assess the likelihood and impact of identified risks?”
• “What criteria and scoring systems can we use to prioritise risks based on their severity and potential consequences? How can we establish a consistent and objective risk rating process?”
• “What factors should we consider when assessing the likelihood and impact of risks?”
• “How can we prioritise risks based on their significance and potential consequences?”
• “What methods or models can we use to quantitatively or qualitatively assess risks?”

5. Risk analysis

• “How can we analyse the probability of [specific risk] occurring within our organisation operating in [industry]? What factors should we consider in our risk analysis process?”
• “What methods can we use to assess the potential impact of [specific risk] on our organisation? How can we evaluate the consequences of the risk materialising?”
• “How can we analyse our organisation’s exposure and vulnerability to [specific risk] operating in [industry]? What factors or assets are particularly susceptible to the risk?”
• “How can we evaluate the effectiveness of existing risk controls in mitigating [specific risk]? What indicators or metrics can we use to measure their performance?”
• “What are the potential interdependencies between different risks within our organisation? How can we analyse the cascading effects and correlations between risks?”
• “How can we analyse historical data and incident records to identify patterns and trends related to [specific risk]? What statistical methods or data visualisation techniques can we use?”
• “What are some hypothetical scenarios we can develop to analyse the impacts of [specific risk]? How can we simulate and evaluate different outcomes?”
• “How can we effectively report and communicate risk analysis findings to stakeholders? What are the key elements to include in risk analysis reports or presentations?”

6. Risk evaluation

• “How can we assess the likelihood and potential impact of [specific risk] in [industry]? What factors should we consider in our risk evaluation process?”
• “What methods or frameworks can we use to score and prioritise risks based on their likelihood and impact? How can we determine which risks require immediate attention?”
• “What are the advantages and limitations of quantitative and qualitative approaches to risk evaluation? How can we combine both methods to get a comprehensive understanding?”
• “How can we analyse and evaluate our organisation’s exposure and vulnerability to [specific risk] in [industry]? What indicators or metrics can we use to assess our readiness?”
• “What are some effective tools or techniques we can utilise for risk evaluation in [industry]? How can we leverage technology or data analysis to enhance our assessment capabilities?”
• “How can scenario analysis and simulation help in evaluating risks? What are the steps involved in conducting a scenario-based risk evaluation?”
• “How can we involve subject matter experts and engage relevant stakeholders in the risk evaluation process? What are the benefits of gathering diverse perspectives?”
• “What criteria or parameters should we use to evaluate the significance of risks in [industry]? How can we establish thresholds or benchmarks for risk acceptability?”

Professional bio

As a Chartered Accountant with over 25 years of international risk management and corporate governance experience in the private, not-for-profit, and public sectors, Patrick helps individuals and organizations make better decisions to achieve better results as a corporate and personal trainer and coach at Practicalrisktraining.com.