Risk Management and ISO 31000

Doug Newdick

What Is Risk Management?

Risk is:
The effect of uncertainty on the ability of an organisation to meet its objectives.

Risk management is:

The range of activities that an organisation intentionally undertakes to understand and reduce these effects.

Effective risk management is:

Executing these activities efficiently and in a way that actually and demonstrably improves the ability of the organisation to meet its objectives in a repeatable fashion.

Risk Management and ISO 31000

What Is ISO 31000?

ISO 31000:2009 is: An international standard that provides principles and guidelines for effective risk management Not specific to any industry or sector Able to be applied to any kind of risk Able to be applied to any kind of organisation Intended to be tailored to meet the needs of the organisation The generic approach described in this Standard provides the principles and guidelines for managing any form of risk in a systematic, transparent and credible manner and within any scope and context.

Risk Management and ISO 31000

What Does ISO 31000 Cover?

ISO 31000:2009 contains:

A set of risk management terms and their definitions A set of principles for guiding and informing effective risk management for an enterprise An outline and process for creating a risk management framework An outline and process for creating a risk management process
Clear Sensible Brief (24 pages)

ISO 31000 is:

Risk Management and ISO 31000

What Does ISO 31000 Not Cover?

Detailed instructions on how to manage risk A complete risk management framework A complete risk management process Formats or attributes for describing risks Templates Guidance on how to identify risks Advice on how to manage risks for a specific domain
Risk Management and ISO 31000

Background to ISO 31000

Australia and NZ developed AS/NZS 4360:1999 in 1999. This was revised and reissued as AS/NZS 4360:2004 in 2004. Australia and New Zealand led the world in enterprise risk management at this point! There was no agreed de jure or de facto international standard in place at this stage. There were a small number of competing frameworks which were regarded as unsatisfactory. In 2005 the International Standards Organisation started work on ISO 31000 using AS/NZS 4360:2004 as its first draft. ISO 31000 was issued to widespread acclaim in 2009.

Risk Management and ISO 31000

ISO 31000 An Overview

Principles guide the creation of the framework The framework defines the process

Principles

Framework

Process

The performance of the process feeds back into the framework

Risk Management and ISO 31000

ISO 31000 An Overview: Principles

Risk Management Principles Creates and protects value Based on the best information

Integral part of organisational processes

Tailored

Part of decision making

Takes human and cultural factors into account

Explicitly addresses uncertainty

Transparent and inclusive

Systematic, structured, and timely

Dynamic, iterative and responsive to change

Facilitates continual improvement of the organisation

Risk Management and ISO 31000

ISO 31000 An Overview: Framework

Mandate and commitment

Design of framework for managing risk

Understanding the organisation and its context Establishing risk management policy

Accountability

Integration into organisational processes Establishing internal communication and reporting mechanisms

Resources

Establishing external communication and reporting mechanisms

Implementing risk management Continual improvement of the framework

Implementing the framework for managing risk Implementing the risk management process

Monitoring and review of the framework

Risk Management and ISO 31000

ISO 31000 An Overview: Process

Establishing the context

Risk assessment Risk identification Communication and consultation Monitoring and review

Risk analysis

Risk evaluation

Risk treatment

Risk Management and ISO 31000

Why Use ISO 31000?

Save yourself time and effort:

Facilitate communication:

Using the terms, principles and guidelines in ISO 31000 means you dont have to spend time and effort creating your own. You can spend time on the things that really add value managing the actual risks. Avoid misunderstandings by using concepts and terms that are well known in the risk management community. Take advantage of the significant expertise in risk management that the ISO has used in coming up with the standard. Ensure you dont miss out any aspects of risk management by using the standard as a checklist.

Provide higher quality output:

Risk Management and ISO 31000

How Do I Apply ISO 31000?

When should I use ISO 31000?

When you are asked to identify or assess risks When you are asked to manage risks When you are asked to assess a risk management framework or process
Use it to frame the scope of the work Use it to guide the engagement Use it to create a risk management process

How should I use ISO 31000

Risk Management and ISO 31000

ISO 31000 In Summary

ISO 31000 gives you a structured, credible foundation for discussions with about risk and risk management. ISO 31000 gives you a starting point for a risk management process if you dont have one. ISO 31000 gives you a standard vocabulary for talking about risks and risk management. ISO 31000 gives you a baseline for comparisons and assessments of risk management processes.

Risk Management and ISO 31000

For Further Resources

Visit my blog:
http://dougnewdick.wordpress.com

Follow me on Twitter:
@dougnewdick

Risk Management and ISO 31000