ISO 31000 Risk management process

The international risk management standard, ISO 31000:2018 Risk management — Guidelines, provides guidelines on managing risk. These guidelines can be customised to any situation and applied to any activity, including decision-making.

ISO 31000 can be used by anyone – individuals, groups of people, families, teams, organisations and governments – who wants to:

  • Create and protect value by managing risks.
  • Making decisions.
  • Setting and achieving objectives.
  • Improving performance.

In the context of this risk management standard, ‘risk’ is defined as ‘the effect of uncertainty on objectives’. The notion of risk is closely linked to uncertainty.

Risk can only be meaningfully defined in relation to objectives because it relates to the effect of uncertainty on objectives that have a potential consequence – good or bad – on your success.

It cannot exist in a vacuum. It must exist in relation to the achievement of your objectives.

The simplest definition of risk is “uncertainty that matters”. Risk can affect one or more of your objectives, or what might happen.

To the extent practicable, your objectives should be:

  • specific;
  • measurable either qualitatively or quantitatively;
  • achievable within the constraints imposed by the context;
  • relevant to the larger goals or context; and
  • achievable within a stated time frame.

Organisations of all types and sizes face external and internal factors and influences that make it uncertain whether they will achieve their objectives.

Managing risk is iterative. It assists organisations in setting strategy, achieving objectives and making informed decisions. It is part of governance and leadership and is fundamental to how an organisation is managed at all levels.

The management of risk enables you to, for example:

  •  increase the likelihood of achieving objectives;
  •  encourage proactive management;
  •  be aware of the need to identify and treat risk throughout the organisation;
  •  improve the identification of opportunities and threats;
  •  comply with relevant legal and regulatory requirements and international norms;
  •  improve mandatory and voluntary reporting;
  •  improve governance;
  •  improve stakeholder confidence and trust;
  •  establish a reliable basis for decision making and planning;
  •  improve controls;
  •  effectively allocate and use resources for risk treatment;
  •  improve operational effectiveness and efficiency;
  •  enhance health and safety performance, as well as environmental protection;
  •  improve loss prevention and incident management;
  •  minimise losses;
  •  improve organisational learning; and
  •  improve organisational resilience.

Managing risk is based on the risk management process. The risk management process involves the systematic application of policies, procedures and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing, recording and reporting risk.

It comprises the activities described in the diagram shown below.

[Source: ISO 31000:2018 Risk management process]

Properly designed and implemented, your risk management framework will ensure that the risk management process is a part of all activities throughout the organisation, including decision-making, and that changes in external and internal contexts will be adequately captured. A risk management framework set of components that provide the foundations and organisational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the organisation.

Your risk management activities should be an integral part of management and decision-making and integrated into the structure, operations and processes of an organisation. It can be applied at strategic, operational, programme or project levels.

There can be many applications of the risk management process. But it must be customised to achieve objectives and to suit the external and internal context in which it is applied.

The dynamic and variable nature of human behaviour and culture should be considered throughout your risk management process.

Although the risk management process is often presented as sequential steps, in practice, they are iterative activities.

A summary of the key activities for the risk management process is shown in the table below.

[Source; Author]

Communication and consultation

Effective communication and consultation are essential to ensure that those responsible for identifying and managing risks and those with a vested interest understand the basis on which risk-informed decisions are made and reasons why particular actions and treatments are selected.

The purpose of communication and consultation is to assist relevant stakeholders in understanding risk, the basis on which decisions are made and the reasons why particular actions are required. It is a continual and iterative process to provide, share or obtain information, and to engage in dialogue with stakeholders regarding the management of risk.

A stakeholder is a person or organisation that can affect, be affected by, or perceive themselves to be affected by a decision or activity.

Communication seeks to promote awareness and understanding of risk, whereas consultation involves obtaining feedback and information to support decision-making.

Consultation is a two-way process of informed communication between an individual or organisation and its stakeholders on an issue before making a decision or determining a direction on that issue. It is:

  • a process which impacts a decision through influence rather than power; and
  • an input to decision making, not joint decision making.

Close coordination between two stakeholders should facilitate the factual, timely, relevant, accurate and understandable exchange of information, considering the confidentiality and integrity of information as well as the privacy rights of individuals. The information can relate to the existence, nature, form, likelihood, significance, evaluation, acceptability and treatment of the management of risk.

Communication and consultation with appropriate external and internal stakeholders should take place within and throughout all activities of the risk management process.

Risk management is enhanced through effective communication and consultation when all parties and stakeholders understand each other’s perspectives and, where appropriate, are actively involved in the decision-making process.

A collaborative and consultative approach is more likely to:

  • Help establish the context appropriately and ensure that the interests of all stakeholders are understood and considered.
  • Ensure that uncertainties, risks, issues and opportunities are adequately identified and managed.
  • Bring together different areas of expertise when assessing or analysing risks to ensure different, and sometimes opposing, views are appropriately considered when defining the risk criteria and when assessing risks.
  • Help secure endorsement, support and commitment for a treatment plan.
  • Enhance any change management processes associated with making risk-informed decisions.

Methods of communication and consultation may include meetings, reports, on-line communication systems and learning packages, newsletters and flow charts.

Scope, context and criteria

The purpose of establishing the scope, the context and criteria is to customise the risk management process and enabling effective risk assessment and appropriate risk treatment.

Defining the scope

You should define the scope of your risk management activities.

As your risk management activities may be applied at different levels (e.g. strategic, operational, programme, project, or other activities), it is important to be clear about the scope under consideration, the relevant objectives to be considered and their alignment with your objectives.

When planning the approach, considerations include:

  • Objectives and decisions that need to be made.
  • Outcomes expected from the activities.
  • Time, location, specific inclusions and exclusions.
  • Appropriate risk assessment tools and techniques.
  • Resources required, responsibilities and records to be kept.
  • Relationships with other projects, processes and activities.

External and internal context

Your external and internal context is the environment in which you seek to define and achieve your objectives.

The context of your risk management activities should be established from the understanding of the external and internal environment in which you operate in. It should reflect the specific environment to which the risk management activities are to be applied.

Establishing the context sets the structure and foundation within which the risk assessment should be undertaken. It ensures that reasons for carrying out the risk assessment are clear. It also provides the backdrop of circumstances against which risks can be identified and assessed.

Understanding the context is important because:

  • Risk management takes place in the context of your objectives and activities.
  • Your individual, team or organisational factors can be a source of uncertainty, risk and opportunity.
  • The purpose and scope of the risk management process may be interrelated with your objectives.

Defining risk criteria

You should specify the amount and type of risk that you may or may not take, relative to your objectives.

Risk criteria are the terms of reference against which the significance of a risk is determined. It is a set the criteria for:

  • Deciding whether a risk or an opportunity can be accepted in pursuit of your objectives.
    • Sometimes referred to as risk appetite, it specifies a technique to determine the magnitude of risk, or a parameter related to risk, together with a limit beyond which risk becomes unacceptable.
    • The acceptability of risk can also be defined by specifying the acceptable variation in specific performance measures linked to objectives.
    • Different criteria might be specified according to the type of consequence. For example, the criteria for accepting financial risk may differ from those defined for risk to human life.
  • Evaluating the significance of a risk.
    • An evaluation of the significance of a risk compared to other risks is often based on an estimate of the magnitude of risk compared with criteria which are directly related to thresholds set around your objectives.
    • Comparison with these criteria can inform you which risks should be focused on for treatment, based on their potential to drive outcomes outside of thresholds set around objectives.
    • The magnitude of risk is seldom the only criterion relevant to decisions about the significance of a risk. Other relevant factors can include sustainability (e.g. triple bottom line) and resilience, ethical and legal criteria, the effectiveness of controls, the maximum impact if controls are not present or fail, the timing of the consequences, the costs of controls and stakeholder views.
  • Deciding between options.
    • An organisation will be faced with many decisions where several, often competing, objectives are potentially affected, and there are both potential adverse outcomes and potential benefits to consider. For such decisions, several criteria might need to be met and trade-offs between competing objectives might be required.
    • Criteria relevant to the decision should be identified. How the criteria are to be weighted or trade-offs made should be decided and accounted for.
    • In setting criteria, the possibility that costs and benefits may differ for different stakeholders should be considered.
    • The way in which different forms of uncertainty are to be taken into account should be decided.

This is where your attitude, appetite and tolerance for risk come in.

  • Risk attitude is your approach to assess and eventually pursue, retain, take or turn away from risk.
  • Risk appetite is the amount and type of risk that you are willing to pursue or retain to achieve our objectives and outcomes.
  • Risk tolerance is your readiness to bear the risk after risk treatments are implemented to achieve your objectives and outcomes.

While criteria should be established at the beginning of the risk assessment process, they are dynamic and should be continually reviewed and amended, if necessary.

To set the criteria to evaluate the significance of a risk and to support decision-making processes, the following should be considered:

  • The nature and type of uncertainties, risks and opportunities that can affect outcomes and objectives (both tangible and intangible).
  • How consequences – both positive and negative – and likelihood will be defined and measured.
  • Time-related factors.
  • Consistency in the use of measurements.
  • How the level of risk is to be determined.
  • How combinations and sequences of multiple risks will be taken into account.
  • The capacity to manage risks.

Risk assessment

Risk assessment is the overall process of:

  • Risk identification – A process of finding, recognising and describing risks.
  • Risk analysis – A process to comprehend the nature of risk and to determine the level of risk.
  • Risk evaluation – A process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable.

Risk assessment should be conducted systematically, iteratively and collaboratively. This activity draws on the knowledge and views of stakeholders. It should use the best available information, supplemented by further enquiry as necessary.

Successful risk assessment is dependent on effective communication and consultation with internal and external stakeholders.

Involving stakeholders during the r