ISO 31000

Scope

The difference between the terms risk management framework and risk management process is described by ISO as in the following:

Risk management framework - set of components that provide the foundations and organizational arrangements for designing, implementing, mentoring, reviewing and continually improving risk management throughout the organization. With the help of the PDCA cycle, can be improved on an ongoing basis.

Risk management process - systematic application of management policies, procedures and practices to the activities of communication, consulting, establishing the context, and identifying, analyzing, evaluating, treating, monitoring and reviewing risk. In other words, what ISO 31000 does is that it formalizes risk management practices, and this approach is intended to facilitate broader adoption by companies who require an enterprise risk management standard that accommodates multiple ‘silo-centric’ management systems.

The scope of this approach to risk management is to enable all strategic, management and operational tasks of an organization throughout projects, functions, and processes to be aligned to a common set of risk management objectives.

Accordingly, ISO 31000 is intended for a broad stakeholder group including:

• executive level stakeholders
• appointment holders in the enterprise risk management group
• risk analysts and management officers
• line managers and project managers
• compliance and internal auditors
• independent practitioners.

Definitions

One of the key paradigm shifts proposed in ISO 31000 is a change in how risk is conceptualised and defined. Under both ISO 31000 and ISO Guide 73, the definition of "risk" is no longer "chance or probability of loss", but "effect of uncertainty on objectives" ... thus causing the word "risk" to refer to negative consequences of uncertainty, as well as positive ones.

A similar definition was adopted in ISO 9001:2015 (Quality Management Systems), in which risk is defined as, "effect of uncertainty." Additionally, a new risk related requirement, "risk-based thinking" was introduced there.

Likewise, a broad new definition for stakeholder was established in ISO 31000, "Person or persons that can affect, be affected by, or perceive themselves to be affected by a decision or activity." It is the verbatim definition given for the term "interested party" as defined in ISO 9001:2015.

Framework approach

ISO 31000:2009 has been developed on the basis of an existing standard on risk management, called AS/NZS 4360:2004. Whereas the initial Standards Australia approach provided a process by which risk management could be undertaken, the first version ISO 31000:2009 addresses the entire management that supports the design, implementation, maintenance and improvement of risk management processes.

Implementation

The intent of ISO 31000 is to be applied within existing management systems to formalize and improve risk management processes as opposed to wholesale substitution of management practices. Subsequently, when implementing ISO 31000, attention is to be given to integrating existing risk management processes in the new paradigm addressed in the standard.

The focus of many ISO 31000 'harmonization' programmes have centered on:

• Transferring accountability gaps in enterprise risk management
• Aligning objectives of the governance frameworks with ISO 31000
• Embedding management reporting mechanisms
• Creating uniform risk criteria and evaluation metrics

Implications

While adopting any new standard may have re-engineering implications to existing management practices, no requirement to conform is set out in this standard. A detailed framework is described to ensure that an organization will have "the foundations and arrangements" required to embed needed organizational capabilities in order to maintain successful risk management practices. Foundations include risk management policy, objectives and mandate and commitment by top management. Arrangements include plans, relationships, accountabilities, resources, processes and activities.

Accordingly, senior position holders in an enterprise risk management organisation will need to be cognisant of the implications for adopting the standard and be able to develop effective strategies for implementing the standard, embedding it as an integral part of all organizational processes including supply chains and commercial operations. In domains that concern risk management which may operate using relatively unsophisticated risk management processes, such as security and corporate social responsibility, more material change will be required, such as creating a clearly articulated risk management policy, formalising risk ownership processes, structuring framework processes and adopting continuous improvement programmes.

Certain aspects of top management accountability, strategic policy implementation and effective governance frameworks including communications and consultation, will require more consideration by organisations that have used previous risk management methodologies which have not specified such requirements.

Managing risk

ISO 31000 gives a list on how to deal with risk:

1. Avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk
2. Accepting or increasing the risk in order to pursue an opportunity
3. Removing the risk source
4. Changing the likelihood
5. Changing the consequences
6. Sharing the risk with another party or parties (including contracts and risk financing)
7. Retaining the risk by informed decision

Certification

ISO 31000 has not been developed with the intention for certification.

International adoption

• Countries – The G31000 Risk Institute, an international NGO committed to promoting the ISO 31000 risk management standard, has reached out to governments, institutions, and organizations across both the public and private sectors, as well as individuals, urging them to adopt and promote ISO 31000:2018. As a result of these efforts, ISO 31000 has been adopted as a national standard in 82 countries and translated into 23 languages.
• Translations – While ISO publishes the ISO 31000 standard in [missing text]. The standard has been translated into 23 languages, enhancing its accessibility and global reach. (source : G31000 Risk Institute)
• 'Certified ISO 31000 risk professionals – Numerous professionals have obtained ISO 31000-related certifications through organizations like G31000 Risk Institute, PECB, Exemplar Global, and the Global Trust Association. The G31000 Risk Institute claims over 8,000+ risk professionals certified, worldwide.
• Number of ISO 31000 standard sold, printed or downloaded – While ISO does not disclose the number of copies sold, the ISO 31000 standard is considered as one of the most popular, along with ISO 9001, ISO 14001 and ISO 45001 standard. Numerous national ISO representatives also sell the ISO 31000 standard.