ISO 31000 Risk Management – Principles and Guidelines

ISO 31000 is organized into the following main clauses:

Clause 3: Principles

Clause 4: Framework

Clause 5: Process

Each of these key activities is listed below.

Clause 3: Principles of risk management 

In order to have an effective risk management, an organization has to comply with these 11 principles.

1. Risk management creates and protects value;
2. Risk management is an integral part of all organizational processes;
3. Risk management is part of decision making;
4. Risk management explicitly addresses uncertainty;
5. Risk management is systematic, structured and timely;
6. Risk management is based on the best available information;
7. Risk management is tailored;
8. Risk management takes human and cultural factors into account;
9. Risk management is transparent and inclusive;
10. Risk management is dynamic, iterative and responsive to change;
11. Risk management facilitates continual improvement of the organization.

Clause 4: Framework 

ISO 31000 states that the success of risk management will depend on the effectiveness of the management framework providing the foundations and arrangements what will embed it throughout the organization at all levels.

The framework:

• assists in managing risks effectively through the application of the risk management process;
• ensures that information about risk derived from the risk management process is adequately reported; and
• ensures that these information is used as a basis for decision making and accountability at all relevant organizational levels.

This clause describes the necessary components of the framework for managing risk and the way in which they interrelate in an iterative manner.

Mandate and commitment: Management of the organization needs to demonstrate a strong and sustained commitment to risk management by defining risk management policy, objectives, ensuring legal and regulatory compliance, ensuring necessary resources are allocated to risk management, communicating the benefits of risk management to all stakeholders.

Design of framework for managing risk: Before the implementation, the organization must design a framework for managing risk. This includes:

•  Understanding of the organization and its context
•  Establishing risk management policy
•  Ensuring accountability, authority and appropriate competence for risk management
•  Integrating risk management into organizational processes
•  Allocating appropriate resources
•  Establishing internal and external communication and reporting mechanisms

Risk assessment: Risk assessment is the overall process of risk identification, analysis and evaluation.

 

• Risk identification: Through applying risk identification tools and techniques, the organization should identify risk sources, areas of impacts, events and causes, and their potential consequences.
• Risk analysis: Risk analysis involves the development of understanding of the risk, consideration of the causes and risk sources, their positive and negative consequences, the likelihood that those consequences can occur, provides an input to risk evaluation and decision whether risks need to be treated, and on the most appropriate risk treatment strategies and methods.
• Risk evaluation: The purpose of this step is to assist in decision making about which risks need treatment and priority for treatment implementation.

Risk treatment: Risk treatment options should be selected based on the outcome of the risk assessment, the expected cost for implementing and benefiting from these options.

 

Monitoring and review: Monitoring and review can be periodic or ad hoc, and should be a planned part of the risk management process.

 

Recording the risk management process: Risk management activities should be traceable. In the risk management process, records provide the foundation for improvement in methods and tool, as well as in the overall process.

 

Monitoring and review: Monitoring and review can be periodic or ad hoc, and should be a planned part of the risk management process.

 

Recording the risk management process: Risk management activities should be traceable. In the risk management process, records provide the foundation for improvement in methods and tool, as well as in the overall process.

 

Clause 5: Process 

ISO 31000 states that the success of risk management will depend on the effectiveness of the management

 

•  The risk management process should be:

1. An integral part of management;
2. Embedded in the culture and practices;
3. Tailored to the business processes of the organization.

•  Risk management process comprises the following activities:

Communication and consultation: Communication and consultation with external and internal stakeholders should take place during all stages of the risk management process.

 

Establishing the context: By establishing the context, the organization articulates its objectives, defines the external and internal parameters to be taken into account when managing risk, and sets the scope and risk criteria for the remaining process.

 

Link between ISO 31000 and other standards 

ISO 31000 can be easily linked with other Risk Management standards, like ISO Guide 73:2009 – Risk management vocabulary, and ISO/IEC 31010:2009 – Risk management – Risk assessment techniques. ISO/IEC 31010 is a supporting standard for ISO 31000 and provides guidance on selection and application of systematic techniques for risk assessment.

Link with ISO 27005 

Based on the ISO 31000 framework, the ISO 27005 standard explains in detail how to conduct a risk assessment and a risk treatment, within the context of information security.

Risk management - the business benefits 

As with all major undertakings within an organization, it is essential to gain the backing and sponsorship of executive management. By far the best way to achieve this, rather than through highlighting the negative aspects of not having risk management, is to illustrate the positive gains of having an effective risk management framework in place.

Risk management allows an organization to ensure that it knows and understands the risks it faces. The adoption of an effective risk management process within an organization will have benefits in a number of areas, examples of which include:

• Increased likelihood of achieving objectives
• Encouraged proactive management
• Awareness of the need to identify and treat risk throughout the organization
• Improved identification of opportunities and threats
• Compliance with relevant legal and regulatory requirements and international norms
• Improved mandatory and voluntary reporting
• Improved governance
• Improved stakeholder confidence and trust
• Establishment of a reliable basis for decision making and planning
• Improved controls
• Effective allocation and use of resources for risk treatment

Implementation of risk management with PECB risk management framework 

Making the decision to implement a risk management framework based on ISO 31000 is often a very simple one, as the benefits are well documented. By following a structured and effective methodology, an organization can be sure to cover all minimum practices required for the implementation of risk management programme.

There is no single blueprint for implementing ISO 31000 that will work for every company, but there are some common steps that will allow you to balance the often conflicting requirements and prepare you for a successful certification audit.

PECB has developed a framework for risk management. It is called “PECB Risk Management Framework” and is based on applicable best practices.

For more information, please visit ISO 31000 training courses.

 

Choosing the right certification 

The certified ISO 31000 Risk Manager credential is a professional certification for professionals needing to demonstrate the competence to implement, maintain and manage a risk management program according to ISO 31000.

 

---

 

PRINCIPAL AUTHORS:

 

Eric LACHAPELLE, PECB

Besnik HUNDOZI, PECB