After establishing the
risk management Framework, an organization is ready to develop the Process. The
Process, as defined by ISO 31000, is “multi-step and iterative; designed to
identify and analyze risks in the organizational context.†Major elements of
the Process are-
-Communication and consultation:
This is concerned with engaging internal and external stakeholders throughout
the risk management process. The Standard promotes a “consultative team approachâ€.
From the outset, good communication with key stakeholders will help establish
expectations, shape the context of risk management and ensure their needs are
considered – very important for buy in. Throughout the risk management process,
various written and verbal communications between the risk manager, risk owner
and stakeholders will continue to occur.
-Establishing context:
Establishing context is about setting the parameters or boundaries around the organizations
risk appetite and risk management activities. It requires consideration of the
external factors such as social, cultural, political and economic and the
alignment with internal factors such as strategy, resources and capabilities.
PEST Analysis is a simple and widely-used tool that helps you understand the
"big picture" of your Political, Economic, Socio-Cultural and Technological
environment. The risk manager will then need to establish context of the risk
management processes which includes amongst other things establishing a risk
management policy, processes, methodologies, plans, risk rating criteria,
training and reporting processes.
-Risk assessment:
Comprises of the processes for identifying, analyzing and evaluating risks.
Ideally, the organization will utilize a range of risk identification techniques
including brainstorming, work breakdown analysis, and expert facilitation.
ISO/IEC 31010:2009 provides further guidance on selection and application of
some systematic techniques for risk assessment. Risk analysis considers
possible causes, sources, likelihood and consequences to establish the inherent
risk. Existing management controls should be identified and effectiveness assessed
to determine the level of residual risk. After this analysis, an evaluation of
the level of risk is required to makes decisions about further risk treatment.
-Risk treatment: Where the
level of risk remains intolerable, risk treatment is necessary. Risk owners can
treat risks by avoiding the risk, treating the risk sources, modifying
likelihood, changing consequences or sharing elements of the risk. The
remaining level of risk retained should be within risk appetite.
-Monitoring and review:
Planned, regular monitoring of the risks and the risk management framework
including processes is critical to keeping the risk management framework
relevant to the changing needs of the organization and external influences.
Monitoring and review will be undertaken by risk owners, management and the
board (or equivalent). An independent review of the risk management framework
should be undertaken from time-to-time.
User questions & answers