ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Risk workshop facilitation is the skill that decides whether a risk workshop produces a sharp, owned list of risks or a room full of polite agreement and a list nobody uses. Workshops remain one of the most common ways to identify and assess risks, and ISO/IEC 31010 recognises structured group techniques as a core method. But the method only works when the session is planned, facilitated and followed up properly.
This guide explains how to prepare a risk workshop, who to invite, how to structure the agenda, which techniques help surface real risks, how to handle group dynamics, how to agree ratings and how to close with clear actions. It is general guidance that you can adapt to any size of session.
A risk workshop brings people together to identify, discuss and assess risks in a particular area: a business unit, a project, a process or the whole enterprise. The value comes from combining different perspectives, challenging assumptions and building shared understanding and ownership. A questionnaire cannot do that.
Be clear about the aim: to identify new risks, to update an existing register, to rate risks, to test a scenario or to agree treatments. A workshop that tries to do everything in ninety minutes will do none of it well. Write the objective in one sentence and share it in advance.
Preparation determines most of the outcome. Define the scope and objective, gather inputs such as the existing enterprise risk register, incident data, audit findings and strategic objectives, and send a short pre-read. Agree the scales and definitions that will be used for ratings, using your risk criteria.
Plan the agenda with timings, choose the technique for each segment and prepare materials: templates, a projected risk grid, sticky notes or a shared board. Book the room, arrange remote tools if needed and appoint a scribe so the facilitator can concentrate on the discussion.
Invite people with real knowledge of the objectives and processes concerned, plus at least one person with authority to make decisions and one who can challenge, such as a risk or compliance specialist. Aim for six to twelve participants. Larger groups fragment, and smaller ones lack diversity.
Mix seniority carefully. If the most senior person speaks first, others may hold back, so consider collecting views anonymously before the discussion. Include front-line staff where possible, since they often know the practical weak points that management does not see.
| Stage | Key tasks | Common failure |
|---|---|---|
| Prepare | Set objective, scope, pre-read and logistics | Vague purpose and no scope |
| Invite | Choose people with knowledge and authority | Only senior people or only juniors |
| Run | Use structured techniques and manage time | Dominant voices, no structure |
| Rate | Apply the agreed scales and record reasons | Endless debate over scores |
| Close | Assign owners, dates and next steps | No follow-up, actions lost |
A typical half-day workshop begins with context: the objective, scope, ground rules and scales. Then move to identification, followed by assessment, then treatment and actions. Keep a rhythm of short inputs, individual thinking and group discussion.
Set ground rules: focus on the objective, one conversation at a time, no blame, challenge ideas not people, and confidentiality where needed. Use a “parking lot” for issues outside scope. Watch the clock and protect time for the final actions segment, which is the first to be squeezed and the most important.
Use structured techniques instead of open discussion alone. Silent brainstorming on sticky notes lets everyone contribute before the group discusses. Prompt lists based on your risk taxonomy make sure categories are not missed. A pre-mortem asks: “imagine we failed; what went wrong?”. Bow-tie analysis explores causes and consequences of a key event.
Ask about objectives, not just risks: “what could stop us achieving this?” Ask about near misses and workarounds, which reveal control weaknesses. Use scenarios for complex or severe risks; see risk scenario analysis for a method.
Agree beforehand how ratings work. Give each participant a chance to score independently, then reveal and discuss outliers. That avoids anchoring on the first opinion and reveals genuine disagreement. Aim for reasoned consensus, and record the rationale, not just the score.
If discussion stalls, note the disagreement and the assumptions behind each view, then assign someone to gather evidence after the session. Do not let a single risk consume the meeting. Plot results on a risk heat map to show priorities and focus the remaining time on the top items.
Facilitators need to manage behaviour. Dominant voices can be handled by inviting others by name and using structured rounds. Defensive reactions can be eased by focusing on the system, not individuals. Groupthink can be countered by assigning a devil’s advocate and asking for dissenting views.
Manage remote and hybrid sessions with extra care: use polls, chat and breakout rooms so remote participants are not sidelined. If tension arises, pause, restate the objective and ground rules and, if necessary, take a short break. A calm, neutral tone matters more than technical expertise.
Finish by confirming each risk’s owner, the agreed treatment and a date. Read back the top risks and actions so everyone hears the same thing. Ask what has been missed. Agree how and when the results will be reported and when the next review will occur.
Circulate the record within a day or two: risks identified, ratings and reasons, actions with owners and dates, and open questions. Enter agreed risks into the register, and track actions until closure. A workshop with no follow-up teaches people that risk work is a ritual.
Frequent errors include no clear objective, too many participants, no pre-work, letting senior voices dominate, skipping ratings criteria, spending the whole session on identification, ending without owners, failing to circulate results and never returning to the actions. Another is using the workshop as the only source of risk information, when it should be combined with data and interviews.
Avoid these with a tight plan, structured techniques, disciplined timekeeping and a firm follow-up process.
Online sessions need shorter segments, clear roles and tools that allow anonymous input. Send materials early, test the technology and use a shared board where everyone can add risks at once. Keep cameras on where possible, use breakout rooms for small-group discussion and rotate who reports back. Consider splitting a long session into two shorter ones on different days, since attention drops faster on screen.
In hybrid meetings, make sure people in the room do not overshadow remote colleagues. Ask remote participants first, and have the scribe monitor the chat for points that might otherwise be missed.
A finance director wants to refresh the risks for a treasury function. A facilitator sends a pre-read with the current register and recent incidents, and invites ten people from treasury, operations, IT, legal and internal audit. The session starts with silent brainstorming and a pre-mortem, moves to independent rating and ends with owners and actions.
Fifteen risks are confirmed, four new ones are added and three are removed as outdated. Actions have owners and dates, and the record is circulated the next day. Three months later, the group reviews progress. The session worked because it had a plan, structure and follow-up.
After each workshop, ask participants for quick feedback: was the purpose clear, was the time well used, did everyone contribute, what would improve it? Review the outcomes after a few months: how many actions were completed, how many risks materialised and were they identified? Use the lessons to adjust the format.
Train more people in facilitation, so the risk team is not the only source of skill. Share templates, agendas and ground rules in a simple toolkit, and encourage business units to run their own sessions with light support from the second line, as described in the three lines model.
If you want a report and workbook that record risks, ratings, owners and actions from workshops in a consistent structure, the Enterprise Risk Assessment Report and Workbook provides a layout for enterprise risk assessment. Whichever tool you use, strong risk workshop facilitation combines preparation, structure and disciplined follow-up, so the time spent produces decisions rather than paper.
Typically two to four hours for a focused area. Longer sessions need breaks and clear segments, and every session should protect time for owners and actions.
Six to twelve is a good range. Fewer lacks diversity of view, and more fragments discussion.
A neutral person skilled in group discussion, often from the risk function or an external facilitator, supported by a scribe. The facilitator should not also be the main subject of the session.
Use silent brainstorming, independent scoring, structured rounds and explicit invitations to quieter participants.
Circulate the record quickly, enter risks in the register, track actions to closure and review progress at an agreed date.
September 30, 2026
