Please enable JavaScript.
Coggle requires JavaScript to display documents.
ISO 31000 'Risk management - Principles & guidelines - Coggle…
ISO 31000 'Risk management - Principles & guidelines
Structured approach to implementing enterprise risk management (ERM)
Risk can impact firm in the short, medium & long term
Applies to all types of organisations
Risk assessments: (i) identify risk; (ii) evaluate or rank risk
Risk ranking: (i) quantitative, (ii) semi-quantitative, (iii) qualitative
Risk classification systems: enables a firm to identify strategies, tactics & operations that are most vulnerable
Published in 2009
Defines risk as "the effect of uncertainty on objectives"
Risk may be negative (hazard risk), positive (opportunity risk) or a deviation from the expected
Risk classification systems: (i) financial control, (ii) operational efficiency, (iii) reputational exposure
Principles of risk management
Aligned to corporate activities
Comprehensive in scope
Proportionate to risk level
Embedded in routine activities
Dynamic: responsive to changing circumstances
Context of risk management
Risk aware culture
Risk management process
Components: 7Rs and 4Ts of hazard risk management
Describes components of risk management implementation framework
Board's mandate & commitment
Design of framework, implement risk management, monitor & review framework, and improve framework
Framework for managing risk
Risk treatment: activity of selecting and implementing appropriate control measures
Risk assessment: assists in the effective and efficient operation of the firm by identifying those risks that require management attention
The Board: overall responsibility for risk management. Ensure risk management is embedded in all process and activity
Audit Committee: routine report from GRMC; sets annual audit programmes & priorities; monitors progress with audit recommendations
Group Risk Management Committee (GRMC): formulate strategy & policy based on risk appetite, risk attitudes & risk exposures; receives reports from BUs, review risk management activities; track RM activity in BU & keep the risk management context review
Disclosure Committee: review & evaluate disclosure + controls & procedures; consider materiality of information disclosed to external parties
Business Units: produce specific policy statements, manage control risk self-certification activities
Part 2: ERM
Must be comprehensive
Implementation and benchmarking: establish risk assessment procedures + undertake risk assessments