ISO
31000:2018, Risk management – Guidelines, provides principles, framework and a
process for managing risk. It can be used by any organization regardless of its
size, activity or sector.Using ISO 31000 can help organizations increase the
likelihood of achieving objectives, improve the identification of opportunities
and threats and effectively allocate and use resources for risk treatment. However,
ISO 31000 cannot be used for certification purposes, but does provide guidance
for internal or external audit programmes. Organizations using it can compare
their risk management practices with an internationally recognised benchmark,
providing sound principles for effective management and corporate governance. ISO
31000 was originally published in 2009 and an updated version was published in
February 2018. However, the overall purpose of ISO 31000 remains the same –
integrating the management of risk into a strategic and operational management
system. ISO 31000 states that the guidelines should be used by people who
create and protect value in organisations by managing risks, making decisions,
setting and achieving objectives and improving performance. The guidelines are
applicable to all types and sizes of organisations and relevant to all external
and internal factors and influences. They also state that managing risk assists
organisations in setting strategy, achieving objectives and making informed
decisions. Managing risk is part of governance and leadership and is
fundamental to how organisations are managed at all levels.
ISO 31000
states that the purpose of risk management is the creation and protection of
value. The principles set out in ISO 31000 provide guidance on the
characteristics of effective and efficient risk management, communicating its
value and explaining its intention and purpose. There are total of eight
principles presented in the standard, The ISO 31000 guidelines provide a
statement of risk management principles. The eight principles are described
below:
1. Framework
and processes should be customised and proportionate.
2.
Appropriate and timely involvement of stakeholders is necessary.
3. Structured
and comprehensive approach is required.
4. Risk
management is an integral part of all organisational activities.
5. Risk
management anticipates, detects, acknowledges and responds to changes.
6. Risk
management explicitly considers any limitations of available information.
7. Human and
cultural factors influence all aspects of risk management.
8. Risk
management is continually improved through learning and experience.
The first
five principles provide guidance on how a risk management initiative should be
designed, and principles six, seven and eight relate to the operation of the
risk management initiative. These latter principles confirm that the best
information available should be used; human and cultural factors should be
considered; and the risk management arrangements should ensure continual
improvement. The first five principles are concerned with the design and
planning of the risk management initiative and these principles are often
summarised as proportionate, aligned, comprehensive, embedded and dynamic
(PACED)
User questions & answers