• Defining corporate governance and why it exists
• The relationship between ownership, management, and oversight
• Why governance failures happen — and what they cost

• From the Cadbury Report to Sarbanes-Oxley and the OECD Principles
• How major corporate scandals reshaped global governance codes
• The evolution of governance in Egypt and the MENA region

• Accountability, Fairness, Transparency, and Responsibility
• Applying the four principles to real board and management decisions

• Board composition, independence, and committee structures
• Fiduciary duties and the boundary between governance and management
• Board evaluation and succession planning basics

• The Board's role in setting and overseeing strategy
• Aligning strategic objectives with risk appetite
• Strategy monitoring and course-correction mechanisms

• Designing a policy framework that supports governance objectives
• Delegation of Authority (DOA) as a governance control
• Keeping policies living documents, not shelf-ware

• The Board's risk oversight responsibility
• Risk appetite statements and their governance implications
• Connecting enterprise risk management to strategic decision-making

• The compliance function's place in the governance structure
• Regulatory obligations and the cost of non-compliance
• Board and Audit Committee oversight of compliance

• Internal audit as the Board's independent assurance function
• The Three Lines Model and internal audit's reporting relationship to the Audit Committee
• Case study: Enron — where governance broke down, and why
• Closing assessment and certificate requirements

• What is AI, machine learning, generative AI and AI agents explained through GRC examples
• How language models generate responses, and why convincing errors occur
• Traditional automation, document analysis and prediction compared in business terms
• Available context, approved source documents and connecting AI to those sources
• Benefits, limitations and the changing responsibilities of GRC professionals
• Exercise: Classify business scenarios by AI capability and identify where a human decision is essential.

Applied Output: A shared AI glossary and an initial list of suitable GRC activities.

• AI for GRC and GRC over AI as complementary responsibilities
• Assessing value, feasibility, data quality and the consequences of an incorrect result
• Information classification, approved tools, access permissions and supplier settings
• Preparing relevant, current and complete documents using anonymised training data
• Prioritising a pilot and defining its boundaries, owner and review points
• Exercise: Rank candidate use cases and assess the information needed for the preferred pilot.

Applied Output: A use-case prioritisation matrix and information-readiness checklist.

• Specifying the task, business context, source criteria and expected output format
• Requiring source references and separating facts, assumptions and recommendations
• Asking AI to identify missing information and avoid unsupported conclusions
• Checking citations, completeness, reasoning and calculations against original evidence
• Refining prompts and documenting significant changes and reviewer decisions
• Exercise: Compare a weak prompt with an improved prompt and correct unsupported output.

Applied Output: A reusable prompt template and completed output-validation checklist.

• Comparing policies with approved requirements and identifying inconsistent wording
• Identifying gaps, duplication and unclear accountability across procedures
• Drafting policy amendments, governance charters and responsibility matrices
• Summarising committee minutes and identifying actions, owners and due dates
• Preserving policy approval and document-control responsibilities
• Exercise: Review a sample policy, trace each gap to its source and draft an amendment.

Applied Output: A policy gap assessment with proposed wording and reviewer comments.

• Extracting potential risks from process narratives, incidents and operating context
• Writing risk statements using cause, event and impact
• Applying agreed likelihood and impact criteria while explaining uncertainty
• Distinguishing existing controls from proposed controls and assessing residual exposure
• Developing scenarios, treatment options and key risk indicators for owner review
• Exercise: Build a risk assessment from a process narrative and challenge unsupported scores.

Applied Output: A draft risk register with supporting evidence, assumptions and proposed treatments.

• Extracting obligations from supplied regulations, standards and contracts
• Distinguishing binding requirements, guidance and internal commitments
• Mapping obligations to controls, owners and evidence with exact source locations
• Comparing revisions and analysing their impact on policies and business processes
• Verifying applicability and escalating ambiguous interpretation to the appropriate expert
• Exercise: Compare two requirement extracts and prepare a compliance change assessment.

Applied Output: Obligations register and action plan with source traceability.

• Drafting control objectives and descriptions that specify who does what and when
• Mapping risks and obligations to controls and identifying coverage gaps or duplication
• Developing test steps and identifying the evidence needed for each conclusion
• Using sample data to flag exceptions, then checking false positives and missing records
• Understanding the data feeds, thresholds and ownership needed for ongoing monitoring
• Exercise: Assess a control and analyse a sample exception report using documented criteria.

Applied Output: A control assessment and test plan with validated exceptions.

• Reviewing supplier questionnaires and comparing claims with supporting documents
• Identifying contract issues, evidence gaps and follow-up questions for specialist review
• Considering privacy, cybersecurity, business continuity and dependency risks
• Summarising assessment results without masking uncertainty or evidence limitations
• Preparing a management brief with prioritised issues, accountable owners and actions
• Exercise: Assess a fictional supplier and prepare a decision-support brief for management.

Applied Output: A third-party assessment and concise management report.

• Supporting risk-based audit planning, engagement scope and audit procedures
• Reviewing policies, interviews and records while distinguishing evidence from inference
• Drafting findings with criteria, condition, cause, risk and practical recommendations
• Challenging AI-assisted findings and reviewing management actions and report quality
• Documenting AI use while retaining professional skepticism and audit accountability
• Exercise: Draft and critique an audit finding using a defined evidence pack.

Applied Output: A reviewed finding and record of the validation performed.

• AI accountability, acceptable-use rules, use-case inventories and risk classification
• Privacy, data leakage, bias, inaccurate outputs, prompt injection and excessive autonomy
• Lifecycle approvals, vendor assessment, access controls and human-review requirements
• Monitoring performance changes, incidents, exceptions and system retirement
• Introducing NIST AI RMF, ISO/IEC 42001 and COSO guidance, with an overview of applicable AI regulation
• Exercise: Develop controls for an AI service and assign accountable owners and review evidence.

Applied Output: AI risk and control matrix and governance checklist.

• Assessing process readiness, stakeholder responsibilities and change-management needs
• Defining a pilot with approved information, review criteria and success measures
• Measuring time saved alongside quality, coverage, errors and reviewer effort
• Establishing stop, improve and scale decisions and a 30-, 60- and 90-day roadmap
• Exercise: Develop an implementation plan for a prioritised use case.

Applied Output: A pilot charter and 90-day implementation roadmap.

• Apply the course methods to one fictional business process and evidence pack
• Identify risks, map obligations, assess controls and prepare a management recommendation
• Define AI safeguards, human approval points and evidence-retention requirements
• Present the solution for peer challenge and facilitator feedback
• Complete an individual scenario assessment and identify actions to transfer learning to work
• Exercise: Case preparation, presentations and peer challenge, assessment and debrief.

Applied Output: A consolidated GRC assessment and an individual application plan.

• What risk is — and how ERM differs from traditional, siloed risk management
• The COSO ERM Framework: components and principles
• Risk appetite, risk tolerance, and risk capacity — defining the boundaries
• Linking risk management to strategy and organizational objectives

• Positioning the risk function within the Three Lines Model
• Roles of the Board, Risk Committee, and management in risk oversight
• Risk Management vs. Compliance vs. Internal Audit: boundaries and handoffs
• Building a risk governance structure and reporting lines

• Risk identification techniques: workshops, interviews, process walkthroughs
• Assessing likelihood and impact — qualitative and quantitative approaches
• Building and reading a risk heat map
• Constructing and maintaining a corporate risk register

• The four risk response strategies: avoid, mitigate, transfer, accept
• Designing proportionate control activities for identified risks
• Cost-benefit thinking in risk treatment decisions

• Designing Key Risk Indicators (KRIs) and setting thresholds
• Continuous risk monitoring vs. periodic reassessment
• Reporting risk to the Board, Risk Committee, and Executive Management
• Workshop: building a mini risk register with KRIs for a business process

• Operational risk fundamentals and common failure points
• Business continuity and disaster recovery planning basics
• Crisis management and incident response coordination

• Integrating risk assessment into strategic and investment decisions
• Case study discussion: risk failures and lessons learned
• Closing assessment and certificate requirements

• What compliance is — and what it is not
• Positioning the compliance function within the Three Lines Model
• Compliance vs. Risk Management vs. Internal Audit: boundaries and overlaps
• Independence, authority, and reporting lines of the compliance function

• Key Egyptian regulators: CBE, FRA, and sector-specific bodies
• Relevant international frameworks: FATF, ISO 37301, OECD principles
• Reading and interpreting regulatory requirements into internal obligations
• Building and maintaining a compliance obligations register

• Compliance risk assessment methodology
• Designing a risk-based compliance monitoring plan
• Key Risk Indicators (KRIs) and early warning signals
• Workshop: building a mini compliance monitoring plan

• AML/CFT fundamentals and typologies
• KYC, Customer Due Diligence, and Enhanced Due Diligence
• Sanctions screening and suspicious activity reporting obligations

• Designing effective compliance policies and procedures
• Code of conduct and whistleblowing mechanisms
• Embedding compliance into board and committee governance structures

• Handling and escalating compliance breaches
• Investigation fundamentals: evidence, documentation, confidentiality
• Reporting to the Board and Audit Committee
• Case study discussion drawn from a real compliance breach scenario

• "Tone from the top" and its practical translation into culture
• Building and sustaining an ethical organizational culture
• Designing compliance training and awareness programs
• Closing assessment and certificate requirements

• Mandate and value proposition of internal audit
• Positioning internal audit within the Three Lines Model

• Functional vs. administrative reporting lines
• Threats to objectivity and safeguards

• How governance, risk management, and control interrelate
• The internal auditor's assurance role across all three

• Building an engagement plan and scope
• Overview of the CIA certification structure
• Case discussion: "Is this internal audit or internal control?"

• The IIA's Core Principles for the Professional Practice of Internal Auditing
• Applying the Code of Ethics in practice

• Purpose and required content of an audit charter
• Approval and periodic review process

• Internal and external quality assessments
• Building continuous improvement into the audit function

• Building the annual audit plan on a risk-based methodology
• Linking the audit universe to organizational risk

• Preventive, detective, and corrective controls
• Distinguishing inherent risk from residual risk

• Structuring an RCM: objectives, risks, controls, and testing procedures
• Using the RCM as the backbone of fieldwork

• Statistical vs. judgmental sampling
• Determining sample size and selection method

• Hands-on construction of a Risk & Control Matrix for a real business cycle

• Condition, Criteria, Cause, Consequence, Corrective Action
• Writing observations that withstand management pushback

• Rating findings and overall engagement results consistently
• Aligning ratings with the organization's risk appetite

• Accurate, objective, clear, concise, constructive, complete, and timely reporting
• Communicating findings to management and the Audit Committee

• Inquiry, observation, inspection, and re-performance
• Gathering sufficient, reliable, and relevant audit evidence

• Documentation requirements that support conclusions
• Review and sign-off protocols

• Tracking management action plans to closure
• Closing assessment and certificate requirements

• Reading the organization's governance, risk, and control landscape as a leader, not just an auditor
• Framework briefing, Egyptian practice segment, and applied group work

• Negotiating mandate, charter, and reporting lines under GIAS Domain III
• Aligning the charter with board and audit committee expectations

• Designing a forward-looking audit strategy reflecting industry, structure, and culture
• Aligning strategy with the organization's risk management maturity and team capability

• Constructing a risk-based audit plan tied directly to the audit universe
• Prioritization logic for a defensible annual plan

• Independence and objectivity as leadership disciplines, not compliance checkboxes
• Identifying and managing independence threats across the function

• Building the collective competencies required by Standard 3.1
• Recognizing and correcting toxic leadership behaviors

• Budgeting and resourcing the audit function for growth
• Making the business case for AI and data analytics adoption in audit

• Building trust-based relationships with boards, regulators, and other assurance providers (GIAS Principle 11)
• Designing recurring communication routines that build credibility over time

• Coordinating with other assurance providers and managing reliance
• Clarifying internal audit's ownership of fraud risk oversight

• Evaluating and strengthening the function's QAIP (Standards 8.3–8.4, 12.1–12.2)
• Setting performance objectives and measures that matter to the board

• Producing boardroom-grade reporting that influences governance decisions
• Structuring annual and quarterly reports for maximum impact

• Live simulation presenting as CAE before a mock Audit Committee
• Assessed on boardroom communication, insight, and leadership presence

• The cybersecurity profession, career paths and the value of recognised credentials
• The five ISC2 CC domains and how they map to this programme
• CC exam format, scoring and logistics for participants planning to sit the exam
• A structured four-week study plan

• CIA triad, AAA, non-repudiation and privacy
• Risk management lifecycle and risk treatment options
• Technical, administrative and physical controls
• ISC2 Code of Ethics, due care and due diligence
• Practice: Domain-level scenario questions with reasoned review of every option.

• GRC purpose and leading frameworks
• Laws, regulations, policies, standards and procedures
• Business continuity and disaster recovery
• Security awareness, metrics and key risk indicators (KRIs)
• Practice: Classify governance documents and controls from realistic organisational examples.

• Identity lifecycle: provisioning, review and deprovisioning
• Least privilege and separation of duties
• Access control models: DAC, MAC, RBAC and ABAC
• Practice: Identify access control weaknesses in workplace scenarios and select the right remedy.

• OSI and TCP/IP models, ports and protocols
• Firewalls, wireless security and network segmentation
• Defence in depth and Zero Trust
• Cloud service models and the shared responsibility model
• Practice: Domain-level questions on network threats, safeguards and cloud responsibilities.

• Data classification, handling and encryption
• Logging, monitoring and event triage
• Threat intelligence and common attack types
• Incident response plans, roles and exercises
• Practice: Walk through an incident scenario from detection to recovery and lessons learned.

• Integrated review across all five domains
• Full-length mock exams aligned with the ISC2 CC exam
• Reasoning review of incorrect answers and remaining knowledge gaps
• Final exam strategy and next steps in the cybersecurity career path

Applied Output: A personal readiness assessment and a clear plan for the ISC2 CC exam or the next stage of professional development.