Keeping risk management simple

February 26, 2018 | rabate

Damage to reputation or brand, cybercrime, political risk and terrorism are some of the risks that private and public organizations of all types and sizes around the world must face with increasing frequency. The ISO has recently revealed the latest version of ISO 31000, aimed to help manage the uncertainty.

Risk enters every decision in life, but clearly some decisions need a structured approach. For example, a senior executive or government official may need to make risk judgements associated with very complex situations. Dealing with risk is part of governance and leadership, and is fundamental to how an organization is managed at all levels.

Yesterday’s risk management practices are no longer adequate to deal with today’s threats and they need to evolve, say the ISO. These considerations were at the heart of the revision of ISO 31000, Risk management – Guidelines. ISO 31000:2018 delivers a clearer, shorter and more concise guide that will help organizations use risk management principles to improve planning and make better decisions.

The main changes since the previous edition are as follows:

Jason Brown, Chair of technical committee ISO/TC 262 on risk management that developed the standard, says: “The revised version of ISO 31000 focuses on the integration with the organization and the role of leaders and their responsibility. Risk practitioners are often at the margins of organizational management and this emphasis will help them demonstrate that risk management is an integral part of business.”

Each section of the standard was reviewed in the spirit of clarity, using simpler language to facilitate understanding and make it accessible to all stakeholders. The 2018 version places a greater focus on creating and protecting value as the key driver of risk management and features other related principles such as continual improvement, the inclusion of stakeholders, being customized to the organization and consideration of human and cultural factors.

Risk is now defined as the “effect of uncertainty on objectives”, which focuses on the effect of incomplete knowledge of events or circumstances on an organization’s decision making. This requires a change in the traditional understanding of risk, forcing organizations to tailor risk management to their needs and objectives – a key benefit of the standard. Jason Brown explains: “ISO 31000 provides a risk management framework that supports all activities, including decision making across all levels of the organization. The ISO 31000 framework and its processes should be integrated with management systems to ensure consistency and the effectiveness of management control across all areas of the organization.” This would include strategy and planning, organizational resilience, IT, corporate governance, HR, compliance, quality, health and safety, business continuity, crisis management and security.

The resulting standard is not just a new version of ISO 31000. Reaching beyond a simple revision, it gives new meaning to the way we will manage risk tomorrow. As regards certification, ISO 31000:2018 provides guidelines, not requirements, and is therefore not intended for certification purposes. This gives managers the flexibility to implement the standard in a way that suits the needs and objectives of their organization.

Brown adds that the principle objective of ISO/TC 262 is to help organizations ensure their viability and success over the longer term, in the interests of all stakeholders, by providing good risk management practice. Because “failure to manage risks is inherently risking failure.”


February 2018

You May Also Be Interested In

Leave a Reply

Please Login to comment
Notify of