# Enterprise Risk Management Certificate: Build a Board-Ready Evidence Portfolio

> Turn ERM learning into BOARD-6: six applied artefacts covering objectives, ownership, assessment, response options, triggers and a board decision memo.

- Canonical page: https://mtfinstitute.com/insights/enterprise-risk-management-certificate-board-ready-evidence-portfolio/
- Content type: Article
- Editorial category: Guides & Frameworks
- Publisher: MTF Institute of Management, Technology and Finance
- Author: MTF Institute Editorial Team- Published: 2026-08-29
- Updated: 2026-08-29
- Language: English
- Topics: Risk Management, Executive Education, Governance, Business Continuity

## Enterprise Risk Management Certificate: Build a Board-Ready Evidence Portfolio

An enterprise risk management certificate should help a manager convert uncertainty into decisions, ownership and review—not merely repeat risk terminology. The strongest evidence of learning is a small portfolio that shows how a risk was framed, assessed, treated, monitored and escalated.

This guide presents the BOARD-6 portfolio: six privacy-safe artefacts a learner can build around one real or simulated business scenario.

## Start with a decision under uncertainty

Choose a bounded decision such as entering a supplier relationship, launching a service, changing a critical process or preparing for a disruption. Write the decision before listing risks:

`Decision owner + decision date + objective + uncertainty + non-negotiable constraint.`

Example: “The operations director must decide by 30 September whether to consolidate two logistics suppliers while preserving regulatory traceability and a 48-hour recovery capability.”

## The BOARD-6 portfolio

| Artefact | What it demonstrates | Minimum contents | Weight |
|---|---|---|---:|
| **B — Business objective map** | Risk is connected to value | objective, decision, stakeholders, constraints | 15 |
| **O — Ownership map** | Accountability is explicit | risk owner, control owner, action owner, escalation owner | 15 |
| **A — Assessment register** | Uncertainty is assessed consistently | event, cause, consequence, likelihood, impact, evidence | 20 |
| **R — Response options** | Treatment is a decision | avoid, reduce, transfer/share, accept; cost and residual risk | 20 |
| **D — Dashboard and triggers** | Monitoring leads to action | indicators, thresholds, source, cadence, owner | 15 |
| **6 — Six-line board memo** | Analysis is compressed for governance | decision, exposure, options, recommendation, trigger, next review | 15 |

Score the portfolio out of 100. Below 60 indicates a learning draft. From 60–79 it may support a management discussion. At 80 or above it may be ready for formal review if the evidence and authority are validated. A score never replaces organizational approval or specialist legal, safety or technical review.

## A worked example

Suppose a company considers consolidating two suppliers into one. Annual operating savings are estimated at €120,000, but the single supplier creates disruption and concentration exposure.

Use three scenarios:

| Scenario | Annual probability | Estimated consequence | Expected annual loss |
|---|---:|---:|---:|
| Short disruption | 20% | €40,000 | €8,000 |
| Major disruption | 5% | €300,000 | €15,000 |
| Regulatory traceability failure | 3% | €200,000 | €6,000 |
| **Total modeled exposure** |  |  | **€29,000** |

Expected loss is not the maximum loss, and it is not a forecast. It is one comparison aid. The €120,000 saving should be tested against control cost, recovery arrangements, downside concentration and risk appetite—not simply reduced by €29,000 and declared “safe.”

## Make ownership operational

Separate four roles:

- **Risk owner:** accountable for exposure relative to objective and appetite.
- **Control owner:** accountable for a preventive, detective or corrective control.
- **Action owner:** delivers a time-bounded treatment task.
- **Escalation owner:** decides when a threshold is exceeded.

The [ISO 31000 overview](https://www.iso.org/iso-31000-risk-management.html) presents risk management as integrated with governance, strategy, planning and reporting. The practical implication is that a register without decision rights is incomplete.

## Build indicators with triggers

Avoid dashboards made only of red, amber and green labels. Every indicator needs:

1. a definition and source;
2. an owner;
3. a threshold;
4. a required action;
5. a review date.

For the supplier case, a leading indicator could be “percentage of critical components with verified alternate routing.” A trigger could be “below 90% for two weekly reviews,” with a named escalation to the operations director.

## The six-line board memo

Use this structure:

1. **Decision:** what approval or direction is required?
2. **Objective:** what value is being protected or created?
3. **Exposure:** which uncertainty could materially change the result?
4. **Options:** what choices and residual risks exist?
5. **Recommendation:** what should be done and why?
6. **Trigger:** what evidence would cause the decision to be revisited?

Keep uncertainty visible. Do not present a single risk score as objective truth when inputs are judgmental.

## What to show an employer

- a sanitized objective and decision map;
- a risk register with evidence and assumptions;
- one treatment comparison including cost and residual risk;
- a dashboard with trigger-to-action logic;
- a short governance memo;
- a reflection explaining what you would validate in production.

Do not reveal confidential risk registers, security weaknesses or personal data. A simulated case should be labelled as simulated.

## Deepen the capability

Professionals who want structured learning in risk frameworks, business continuity, resilience and governance can explore MTF Institute’s [Enterprise Risk Management and Business Continuity programme](https://mtfinstitute.com/programs/enterprise-risk-management-business-continuity/). Use course study to deepen the discipline and the BOARD-6 portfolio to make applied judgment visible.

## References

- [ISO — ISO 31000 Risk management](https://www.iso.org/iso-31000-risk-management.html)
- [US Government Accountability Office — Green Book](https://www.gao.gov/greenbook)



## Citation

When citing or summarizing this material, link to the canonical HTML page: https://mtfinstitute.com/insights/enterprise-risk-management-certificate-board-ready-evidence-portfolio/