Learn how to use the free GRC Workshop ERM Toolkit with this step-by-step guide. Discover how to document risks, assess inherent and residual risk, evaluate controls, monitor risk appetite, track treatment actions, and interpret dashboards using a realistic, fictional business scenario.
You've downloaded the GRC Workshop Enterprise Risk Management Toolkit. What should you do first?
An ERM workbook can contain risk registers, assessment criteria, control information, appetite thresholds, treatment plans and dashboards. Understanding how these components connect is essential to using the workbook correctly.
This guide walks you through the process using a fictional organisation and a realistic risk scenario.
By the end, you should understand how to:
You don't need previous experience using a GRC platform. Basic familiarity with Excel will help.
GRC Workshop provides two editions of the toolkit.
Sample ERM Workbook
Contains fictional risk records, assessments and related information. This is the recommended starting point if you're learning.
Clean ERM Template
Provides the workbook structure for entering your own information without the populated fictional operational records.
Use a separate copy for practice so you can return to the original sample.
Important: The workbook contains calculated fields. Do not overwrite formulas or replace calculated outputs with manually entered values.
The toolkit contains several related worksheets.
| Worksheet | Main purpose |
|---|---|
| README | Explains the workbook and its overall structure |
| Methodology | Defines assessment criteria and configurable parameters |
| Appetite | Records risk appetite and tolerance thresholds |
| Risk Register | Maintains identified risks and assessments |
| Breach Monitor | Displays risks exceeding approved thresholds |
| Treatment Tracker | Records risk mitigation actions |
| Risk Acceptance Register | Documents formal decisions to accept risk |
| Risk-Control Matrix | Connects risks to relevant controls |
| KRI Tracker | Monitors risk indicators |
| Dashboard | Summarises risk information |
| Scenario Analysis | Supports illustrative loss scenario assessments |
| Risk Aggregation and Aggregation Map | Explore shared exposures and risk concentration |
| Snapshot Capture, Snapshot History and Snapshot Trends | Support historical risk monitoring |
| Change Log | Records voluntarily documented changes |
| Exception Register | Records authorised exceptions to specified integrity findings |
| Checks | Identifies data-quality and governance issues |
You do not need to complete every worksheet immediately.
For your first assessment, concentrate on Methodology → Appetite → Risk Register → Treatment Tracker → Breach Monitor → Dashboard → Checks.
Open the Methodology worksheet.
This worksheet establishes how risk assessments should be interpreted.
The workbook uses five-point likelihood and impact scales. These support a common qualitative scoring approach:
Risk score = Likelihood × Impact
For example:
The workbook uses defined risk bands to classify calculated scores.
However, the numbers alone do not explain the business significance of a risk.
A likelihood rating should be supported by relevant assumptions or evidence, while an impact rating should reflect potential consequences for organisational objectives.
Review the likelihood descriptions, impact descriptions and risk bands before entering any assessments.
Also examine the configuration settings, including the residual assessment validity period and the workbook's assessment date.
For this exercise, retain the provided methodology.
Learning point: A risk score is meaningful only when its underlying assessment criteria are understood.
Open the Appetite worksheet.
This worksheet contains risk categories and associated appetite and tolerance thresholds.
The distinction matters:
Risk appetite describes the level of exposure the organisation is willing to retain in pursuit of its objectives.
Risk tolerance provides a further boundary or limit against which exposure can be evaluated.
In this toolkit, approved numerical thresholds are used to classify residual risk exposure.
The worksheet also contains governance information, including approval and effective dates.
Review the available risk categories and compare their appetite and tolerance thresholds.
Notice that different categories can have different thresholds.
For example, an organisation may be more willing to accept certain strategic risks than risks involving sensitive customer information.
Do not change the thresholds during your first exercise.
Learning point: A risk's acceptability depends on the organisation's approved criteria, not simply whether its score is labelled Medium or High.
We'll use a fictional company called Meridian Financial Services Ltd.
Meridian is a UK financial technology company providing digital payment services.
Its customer-facing application is hosted in a cloud environment.
The company relies on the availability of its cloud infrastructure to process transactions.
Meridian's technology team identifies that the disaster recovery plan has not been tested against the current production architecture.
Management is concerned that a significant cloud disruption could cause an extended payment service outage.
Your task is to document and assess this risk.
Open the Risk Register worksheet.
Find the next available risk record and enter a unique Risk ID.
For this exercise, use:
Risk ID: R-009
Before entering it, check that the ID is not already in use.
Risk title: Cloud service disruption
Risk description:
An extended outage affecting the primary cloud environment, combined with unverified recovery arrangements, could interrupt payment processing and result in customer disruption, financial losses and contractual consequences.
Risk category: Operational
Risk owner: Head of Technology
Use the category name exactly as configured in the Appetite worksheet.
A useful risk statement connects the potential event with its causes or contributing conditions and consequences.
Avoid vague statements such as "Cloud risk" or "System failure".
The risk should be understandable to someone who was not involved in the original assessment.
Inherent risk describes the underlying exposure before considering the effects of relevant controls, according to the methodology used for this exercise.
In the Risk Register, locate the inherent likelihood and impact fields.
For the fictional scenario, use:
| Assessment | Rating |
|---|---|
| Inherent likelihood | 4 |
| Inherent impact | 5 |
| Calculated inherent score | 20 |
The workbook should calculate the score and its associated risk rating.
Likelihood justification: Meridian depends heavily on its primary cloud environment, and recovery capability has not been validated against the current architecture.
Impact justification: An extended outage could prevent customer transactions, interrupt operations and create significant financial and contractual consequences.
These are illustrative assumptions for training. In a real assessment, the analyst would need supporting evidence and would apply the organisation's likelihood and impact definitions.
Learning point: Risk scoring requires defensible reasoning, not simply selecting numbers.
Next, identify the measures Meridian already has in place.
For this exercise, assume the following controls exist:
| Control | Assessment observation |
|---|---|
| Infrastructure redundancy | Configured within the primary cloud environment |
| Backup arrangements | Backups are performed regularly |
| Monitoring and alerting | Service health alerts are configured |
| Incident response plan | Documented and communicated |
| Disaster recovery testing | Not completed against the current architecture |
The organisation has several controls, but an important assurance gap remains.
A backup process does not automatically demonstrate that the organisation can restore critical services within its required recovery timeframe.
Use the relevant control information fields in the Risk Register and Risk-Control Matrix to document the controls and their relationship to the risk.
Where applicable, identify supporting evidence such as:
Do not classify a control as effective solely because a policy or configuration exists.
Learning point: Control design, implementation and operating effectiveness are related but distinct assessment considerations.
Residual risk is the risk remaining after considering the relevant treatment measures.
For this exercise, assume the available evidence supports the following provisional assessment:
| Assessment | Rating |
|---|---|
| Residual likelihood | 3 |
| Residual impact | 5 |
| Calculated residual score | 15 |
The residual likelihood is lower than the inherent likelihood because existing controls provide some protection.
The impact remains severe because an extended disruption could still have significant business consequences.
The workbook includes validation requirements for authoritative residual assessments.
Complete the relevant fields for:
Use fictional assessment information appropriate to the exercise.
The workbook's governance checks may reject incomplete, invalid, future-dated, expired or unapproved assessments.
If a residual assessment is not valid, the workbook may use the inherent assessment as a conservative fallback.
Review the calculated residual score, assessment validity status and authoritative score used by the workbook.
Do not assume that typing a residual likelihood and impact automatically creates an approved residual assessment.
Learning point: A residual risk assessment should be evidence-supported and subject to appropriate review.
Return to the Risk Register and review the appetite-related output fields.
The workbook compares the applicable residual exposure against the configured category thresholds, subject to the validity of those thresholds.
For the sample methodology, the Operational category uses an appetite threshold of 9 and tolerance limit of 15.
A valid residual score of 15 therefore exceeds appetite but does not exceed the tolerance limit.
The expected classification is Appetite breach.
If the residual assessment is invalid, or the appetite configuration has changed, the workbook may display a different result.
An appetite breach is a governance signal requiring attention.
It does not necessarily mean that all business activity must stop.
The appropriate response depends on the organisation's risk policy, delegated authorities, treatment options and decision-making arrangements.
The analyst should communicate the exposure and support the responsible owner in determining the next action.
Learning point: Risk evaluation connects assessment results to organisational decisions.
Open the Treatment Tracker worksheet.
Create a treatment action linked to the new risk.
Use the following fictional information:
| Field | Example |
|---|---|
| Action ID | A-009 |
| Risk ID | R-009 |
| Action | Conduct an end-to-end disaster recovery exercise |
| Action owner | Head of Infrastructure |
| Status | Not started |
| Target date | 30 days after assessment |
| Expected outcome | Demonstrate recovery capability and identify remediation requirements |
Check that the Action ID is unique before entering it.
Additional actions could include addressing recovery deficiencies, validating recovery objectives and reassessing the risk once improvements have been tested.
A recommendation is not the same as an implemented control.
Treatment tracking establishes accountability for the work required to modify the risk.
The analyst should monitor progress, review completion evidence and arrange reassessment where appropriate.
Learning point: Treatment actions should be specific, owned, measurable and time-bound.
Open the Breach Monitor worksheet.
This worksheet provides a consolidated view of risks exceeding the applicable appetite or tolerance thresholds.
Locate the risk you created.
Review its:
If the risk is not displayed as expected, review the risk assessment validity, category selection and appetite configuration.
The Breach Monitor is designed to support oversight, not replace the underlying assessment record.
Learning point: Significant risks should remain visible until they are appropriately managed, even when formal acceptance decisions exist.
Risk treatment is not always immediately possible.
An organisation may decide to retain a particular exposure for a defined period, subject to authorised approval and appropriate conditions.
The Risk Acceptance Register supports documentation of such decisions.
It includes information such as the risk concerned, rationale, conditions, decision, approver authority and expiry.
For this first exercise, do not create an approved acceptance unless you are deliberately practising the formal acceptance workflow.
Remember:
Recording an acceptance does not mean the underlying risk disappears or its appetite breach is erased.
Risk acceptance should remain distinguishable from risk reduction.
Open the Dashboard worksheet.
The dashboard consolidates information from the underlying workbook.
Review the headline risk metrics, risk ratings, breach information and visual summaries.
After entering your fictional risk, consider these questions:
Dashboard information is only as reliable as the source records and calculations behind it.
Learning point: A GRC analyst should be able to explain where dashboard figures come from, not simply present them.
Open the Checks worksheet.
This is an important final step.
The workbook includes checks for certain data-quality and governance issues, including invalid or duplicate records and incomplete assessment information.
Review any findings and determine what caused them.
Possible issues include:
Do not delete validation formulas or conceal warnings to make the workbook appear complete.
Correct the underlying information or follow the documented governance process where a legitimate exception is permitted.
Learning point: Data integrity is part of risk governance. An inaccurate risk register can lead to poor management decisions.
Once you are comfortable with the basic workflow, explore the toolkit's additional capabilities.
KRI Tracker: Monitor indicators that may signal changing exposure.
Scenario Analysis: Explore illustrative financial consequences under defined assumptions.
Risk Aggregation: Examine concentrations and shared exposure drivers. Ordinal risk scores are screening indicators, not additive financial loss measures.
Snapshot Capture and History: Compare risk positions over time using controlled, manually preserved snapshots.
Change Log: Document important changes and decisions. This is a voluntary record, not a tamper-proof audit trail.
Exception Register: Review the documented mechanism for specific authorised integrity-check exceptions. It is separate from ordinary business risk acceptance.
These capabilities support more advanced monitoring and reporting activities.
Entering risk scores without understanding the methodology
Review the assessment criteria first.
Confusing inherent and residual risk
Existing controls should be considered when evaluating residual exposure.
Assuming documented controls are effective
Request and evaluate evidence.
Using the wrong risk category
Risk appetite comparisons depend on correct categorisation.
Overwriting calculated cells
Preserve the workbook's formulas.
Treating acceptance as remediation
An accepted risk may still exceed appetite.
Ignoring integrity warnings
Investigate and resolve the underlying issues.
Treating scenario estimates as precise forecasts
Understand assumptions and uncertainty.
Before finishing your first assessment, confirm that you have:
Completing one risk assessment is the beginning.
To develop stronger practical GRC skills, try assessing a different scenario, such as a supplier data breach, privileged access weakness or regulatory compliance failure.
Compare the evidence, risk assessment and treatment decisions required in each situation.
You can also explore GRC Workshop's educational resources on inherent and residual risk, control effectiveness, risk appetite and risk treatment.
Download the Clean ERM Template to practise independently, or return to the Sample ERM Workbook to study completed examples.
The goal is not simply to fill in a spreadsheet. It is to understand the reasoning, evidence, accountability and decisions behind effective risk management.