Introduction to ISO 31000:2018 Risk Management
ISO 31000 Standard has been revised providing more strategic guidance than its predecessor ISO 31000:2009, placing more emphasis on the involvement of senior management and the integration of risk management into the organization.
The purpose of ISO 31000 is to provide principles and generic guidelines on risk management, and aims to deliver a single universally recognised standard for practitioners and companies employing risk management processes to replace the numerous existing standards, methodologies that varied between industries, subject matters and regions.
What is Risk Management?
- The identification, evaluation and prioritisation of risk to prevent injuries or illness, and the possibility of losing something of value including, protecting financial assets, and social status.
- Risks can come from various sources including uncertainty in financial markets, legal liabilities, accidents, natural causes and disasters, deliberate attack from an opposition, or project failures.
- There are two types of events
- Negative events classified as risks
- Positive events classified as opportunities
The purpose of risk management is to minimise, monitor, and control the probability or impact of unfortunate events (a risk becoming an issue) or to maximise the realisation of an opportunity.
Risks affecting organisations can have consequences in terms of damage to professional reputation, economic performance as well as environmental, safety and societal outcomes. Therefore, managing risk effectively helps organisations to perform well in an environment full of uncertainty.
The updated version of risk management guidelines released in February 2018 has been developed to help organisations manage the uncertainty.
Why ISO 31000 was revised
Keep it Simple
ISO 31000 can be used to better position an organisation so it can best achieve objectives, improve the identification of threats, identify opportunities, and effectively allocate resources in the management of risk
ISO 31000:2018 provides a more strategic guidance for the way we work today
The revised version of ISO 31000 published in February 2018 takes into account the evolution of the market and new challenges faced by business and organisations in today’s digital age, and major advancement in technology since the standard was first released in 2009.
One example of this is the increased complexity of economic systems and emerging risk factors such as digital currency, both of which can present new and different types of risks to an organisation on an international scale.
ISO 31000 Risk Management Principles, Framework and Process
Risk Management Principles
The Principles provide guidance for managing risk
- Integrated as part of organisations daily activities
- A structured and comprehensive approach for consistent results
- Customised to meet organisations internal and external circumstances
- Inclusive so the knowledge views and of ideas of all stakeholders are considered to improve risk management awareness
- Dynamic to enable appropriate quick response to risk events
- Best available current and historical information, along with future expectations should be timely, clear and available to stakeholders
- Human and cultural factors have an essential influence all aspects of risk management
- Continual improvement through learning and experience
Risk Management Framework
The Framework helps integrating risk management with daily activities and functions
- Senior management should show Leadership and commitment to ensure that risk management is integrated into all organisational activities
- Integration of risk management is a dynamic and iterative process, and should be customised to the organisation’s objectives and operations
- Design of the risk management framework includes internal and external considerations. This includes data information systems, interdependencies, organisational structure, roles and accountabilities
- Implementation of the risk management framework requires planning and resources to ensure the right decisions are made by the right people at the right time
Risk Management Process
The Process should be customised to align with organisations way of working and objectives
- Communication and Consultation ensures internal and external stakeholders are aware and have an understanding of risk, and an opportunity to provide feedback to support decision-making
- Establishing Scope, Context and Criteria of risk management activities, will help define the risk management process for effective risk assessment and appropriate treatment
- Risk Assessment should be performed regularly and collaboratively with internal and external stakeholder, identifying, analysing and evaluating threats and opportunities
- Risk Treatment involves identifying best options, planning, implementation and measuring the effectiveness of the implemented treatment
The information contained within this article does in no way constitute legal advice. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, articles, templates, or related graphics contained on the website. Any reliance you place on such information is therefore strictly at your own risk.