ISO 31000:2018
Objective: To provide a set of internationally recognised principles and guidance on the practice of risk management in organisations - these principles may be used to help improve the design and implementation of a risk management framework within an organisation
Provides a universal benchmark for risk management practice, helping an organisation to improve the effectiveness of its risk management framework and related activities, irrespective of market sector of business model
Encourages organisations to adapt the principles in order to design and implement a risk management framework that is consistent with the nature, scale and complexity of their activities
Covers a wide range of topics
Definitions for key terms such as risk, uncertainty and risk management
The importance of managing both the opportunities and threats that may come from exposure to risk
The basic principles for effective risk management such as developing a risk aware culture, ensuring that it supports the organisations strategic objectives and ensuring it is practices on a continuous basis to keep track of changing risks and exposures
How to design, implement, review and improve an effective risk management framework
The key components of an effective risk management process for identifying, assessing, monitroing and controlling risk
Three main topic areas
Principles for risk management
The core principle is that risk management activity should help protect and create value in organisations. Value might be protected through the prevention of costly negative risk events.
Value might be created by using risk management to satisfy the expectations of stakeholders or to help an organisation fulfil its strategic objectives
Additional principles call for risk management frameworks to be structured, includive, customised, dynamic and responsive and integrated
Core element of on effective risk management framework
The standard highlights how the external and internal context of an organisation will influence the design, implementation and ongoing review and improvement of the framework
External context means factors such as regulation, technological development and market forces
Internal context relates to factors such as the culture and structure of the organisation
The standard emphasises the importance of leadership in designing and implementing effective risk management frameworks
The standard argues that tangible commitment to effective risk management is needed from an organisation's leaders, including its managers, senior managers and board or equivalent.
Support for an organisation's risk management activities should be evidenced by what they leaders say and do. Leaders must communicate the importance of operating an effective framework and support this operation through their own actions
The risk management process
The guidance discusses three core elements
Establishing the context
Risk assessment
Risk treatment
These elements are supported by three activities
Establishing the context
Establishing the context includes understanding the internal and external drivers that may affect an organisation's exposure to risk, such as the physical environment, technology, organisational structures and processes
Context also means understanding the types of risk that may affect an organisation and the various assessment and controls tools that are available for use
The aim is to ensure that the organisation understands the range and scope of its objectives and activities, and the risks that are associated with them
Risk Assessment
Risk assessment means that an organisation should identify, analyse and evaluate its exposure to all sources of risk to its objectives
Risk assessment may involve the use of statistical models or qualitative judgement
Risk treatment
Risk treatment is another term for risk control.
The aim is to ensure that the level of exposure is controlled - not too high or too law
The level of control will be influenced by the risk appetite of an organisation
Communication and consultation
This is about communicating risk management information (such as risk management policies and procedures, or risk exposures) in a timely, accurate and factual way
Risk communication includes consulting with key stakeholders to ensure that they understand the risks that an organisation is taking and are satisfied that the organisations approach to managing these risks is appropriate
Communication seeks to promote awareness and understanding of risk and how to deal with it whereas consultation involves obtaining feedback and information to support decision making
Recording and reporting
Recording means ensuring that identified risks are documented properly
It also means documenting risk management processes and procedures to ensure that they are understood clearly and implemented coherently across the organisation
Reporting means reporting on an organisation's risk exposures and the measures taken to control these exposures to relevant decision makers and stakeholders
Monitoring and review
Monitoring and reviewing is about learning, improving and adapting
The performance of an organisation's risk management framework can vary
If performance declines, changes may be required to maintain the efficiency and effectiveness of the framework
Performance monitoring and review night include activities such as audits, control effectiveness reviews and compliance reviews
ISO 31000 makes it clear that organisations should review and upgrade their risk management activities on a regular basis
Risk and an organisations exposures to risk are never static
It is essentially helps improve the management of risk against an international benchmark for good practice
To be effective risk management must
Be integrated into all the firm's activities
Be structured and all inclusive
Be tailored to the specific organisation
Include the views of all stakeholders
Be dynamic - to anticipate, detect, acknowledge change
Have up to date information
Be part of the cultural fabric of the organisation
Subject to continuous improvement