Covers risk identification, assessment, appetite, controls, ownership, monitoring, internal control, and assurance. Learners build a risk register and select proportionate treatments.