ISO 31000 is a family of standards relating to risk management codified by the International
Organization for Standardization.
The purpose of ISO 31000:2009 is to provide principles and generic guidelines on risk
management.
ISO 31000 seeks to provide a universally recognised paradigm for practitioners and companies employing
risk management processes to replace the myriad of existing standards, methodologies and paradigms
that differed between industries, subject matters and regions.
Currently, the ISO 31000 family is expected to include:
ISO 31000:2009 - Principles and Guidelines on Implementation
ISO/IEC 31010:2009 - Risk Management - Risk Assessment Techniques
ISO Guide 73:2009 - Risk Management - Vocabulary ISO also designed its ISO 21500 Guidance on
Project Management standard to align with ISO 31000:2009.
Introduction ISO 31000 was published as a standard on the
13th of November 2009, and provides a standard on the implementation of risk management.
A revised and harmonised ISO/IEC Guide 73 was published at the same time.
The purpose of ISO 31000:2009 is to be applicable and adaptable for "any public, private or
community enterprise, association, group or individual."
Accordingly, the general scope of ISO 31000 - as a family of risk management standards
- is not developed for a particular industry group, management system or subject matter
field in mind, rather to provide best practice structure and guidance to all operations concerned
with risk management.
Scope ISO 31000:2009 provides generic guidelines
for the design, implementation and maintenance of risk management processes throughout an
organization.
This approach to formalizing risk management practices will facilitate broader adoption
by companies who require an enterprise risk management standard that accommodates multiple
‘silo-centric’ management systems.
The scope of this approach to risk management is to enable all strategic, management and
operational tasks of an organization throughout projects, functions, and processes to be aligned
to a common set of risk management objectives.
Accordingly, ISO 31000:2009 is intended for a broad stakeholder group including:
executive level stakeholders appointment holders in the enterprise risk
management group risk analysts and management officers
line managers and project managers compliance and internal auditors
independent practitioners.
Risk conceptualisation
One of the key paradigm shifts proposed in ISO 31000 is a controversial change in how
risk is conceptualised.
Under the ISO 31000:2009 and a consequential major revision of the terminology in ISO Guide
73, the definition of "risk" is no longer "chance or probability of loss", but "the
effect of uncertainty on objectives" ... thus causing the word "risk" to refer to positive
possibilities as well as negative ones.
ISO 31000 framework approach ISO 31000:2009 has been received as a replacement
to the existing standard on risk management, AS/NZS 4360:2004.
Whereas the Standards Australia approach provided a process by which risk management could be
undertaken, ISO 31000:2009 addresses the entire management system that supports the design,
implementation, maintenance and improvement of risk management processes.
Implementation The intent of ISO 31000 is to be applied within
existing management systems to formalise and improve risk management processes as opposed
to wholesale substitution of legacy management practices.
Subsequently, when implementing ISO 31000, attention is to be given to integrating existing
risk management processes in the new paradigm addressed in the standard.
The focus of many ISO 31000 'harmonisation' programmes have centred on:
Transferring accountability gaps in enterprise risk management
Aligning objectives of the governance frameworks with ISO 31000
Embedding management system reporting mechanisms Creating uniform risk criteria and evaluation
metrics Implications
Most implications for adopting the new standard concern the re-engineering of existing management
practices to conform with the documentation, communication and socialisation of the new
risk management operating paradigm; as opposed to wholesale re-orientation of management
practice throughout an organisation.
Accordingly, most senior position holders in an enterprise risk management organisation
will need to be cognisant of the implication for adopting the standard and be able to develop
effective strategies for implementing the standard across supply chains and commercial
operations.
Certain aspects of top management accountability, strategic policy implementation and effective
governance frameworks, will require more consideration by organisations that have previously used
now redundant risk management methodologies.
In some domains that concern risk management, in particular security and corporate social
responsibility, which may operate using relatively unsophisticated risk management processes,
more material change will be required, particularly regarding a clearly articulated risk management
policy, formalising risk ownership processes, structuring framework processes and adopting
continuous improvement programmes.
Managing risk ISO 31000:2009 gives a list on how to deal
with risk: Avoiding the risk by deciding not to start
or continue with the activity that gives rise to the risk
Accepting or increasing the risk in order to pursue an opportunity
Removing the risk source Changing the likelihood
Changing the consequences Sharing the risk with another party or parties
Retaining the risk by informed decision Accreditation
ISO 31000 has not been developed with the intention for certification.
Starting from March 2013, accreditation and certification of Professional Certificate
Lead Trainer & Consultant for ISO 31000 would be organized and conferred by Academy of Professional
Certification in Hong Kong.
APC is an authorized representative of ISO/TC262 for HKSAR Hong Kong.
See also Enterprise risk management
International Organization for Standardization International Disaster and Risk Conference
ISO 9000 ISO 14001
ISO/PAS 28000 PDCA
Risk RiskAoA
Risk management Risk management tools
Security risk References
Airmic / Alarm / IRM "A structured approach to Enterprise Risk Management and the requirements
of ISO 31000" External links
Standard International Organization for Standardization Standard AS/NZS ISO 31000:2009 Risk management
- Principles and guidelines Discussion : LinkedIn discussion forum on
ISO 31000:2009 Risk management - Principles and guidelines
Article ISO 31000 : The Gold Standard, Alex Dali and Christopher Lajtha, Strategic Risk,
September 2009 Presentation Présentation Powerpoint par
Kevin W Knight, Chairman du comité international ISO 31000,2004-2011 LINK NOT WOKING