ISO 31000 RM cheat sheet

Risk is defined as the 'effect of uncertainty on objectives'; the effect is a deviation from the expected and may be positive, negative, or both.

Uncertainty is the state, even partial, of deficiency of information related to, or understanding or knowledge of, an event, its consequence, or likelihood.

Risk management is defined as coordinated activities to direct and control an organization with regard to risk.

The eight principles (Clause 4) are: integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, and continual improvement.

Risk criteria are the terms of reference for evaluating the significance of risk; risk appetite is the amount and type of risk an organization is willing to pursue or retain; risk attitude is its approach to pursue, retain, take, or turn away from risk.

Risk owner is the person or entity with accountability and authority to manage a risk; residual risk is the risk remaining after risk treatment.

Risk source (an element with potential to give rise to risk), event (an occurrence or change of circumstances), and consequence (an outcome affecting objectives) are distinct but linked concepts.

Likelihood is the chance of something happening; combined with consequence it defines the level of risk.

ISO 31000:2018 is guidance and is not intended for certification; it is generic and applicable to any organization regardless of size, sector, or type of risk.

Risk management framework is the set of components providing the foundations and organizational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the organization.

The framework sequence in Clause 5 is: leadership and commitment, integration, design, implementation, evaluation, improvement.

Design (5.4) has five elements: understanding the organization and its context; articulating risk management commitment; assigning organizational roles, authorities, responsibilities and accountabilities; allocating resources; establishing communication and consultation.

Leadership and commitment requires top management to link risk management to the organization's strategy and direction and to supply authority, resources, and visible support.

Integration means risk management is embedded in governance, planning, and decision-making throughout the organization rather than operated as a separate, parallel activity.

Framework evaluation compares the framework's performance against its purpose, plans, and indicators; improvement covers both adapting to change and continually improving.

A framework is customized to the organization's external and internal context, objectives, and needs; an off-the-shelf template is not a compliant substitute.

Implementation follows establishment of the design elements (context, commitment, roles, resources, communication), and the framework cycle is iterative rather than a one-off sequence.

Risk management process is the systematic application of management policies, procedures and practices to communicating, consulting, establishing context, and identifying, analyzing, evaluating, treating, monitoring and reviewing risk.

Clause 6 order is: communication and consultation; scope, context and criteria; risk assessment; risk treatment; monitoring and review; recording and reporting.

Risk assessment comprises three sub-steps in order: risk identification, risk analysis, and risk evaluation.

Identification finds, recognizes and describes risks including sources, events, causes and consequences; analysis comprehends the nature of the risk and determines its level; evaluation compares that level against risk criteria to decide on action.

Communication and consultation is not a single stage; it applies throughout the process and involves both internal and external stakeholders.

Scope, context and criteria sets the risk criteria used for all later evaluation; criteria derive from objectives, values, and legal or regulatory obligations and may be revised as context changes.

Risk analysis considers likelihood, consequences, effectiveness of existing controls, and uncertainty; risk evaluation yields a decision to accept, avoid, share, or treat the risk further.

Risk treatment selects and implements one or more options to modify risk, produces a treatment plan with responsibilities and timelines, and leaves residual risk that must be compared against criteria.

Monitoring and review is continual, while recording and reporting runs throughout, documenting decisions and providing evidence for governance and traceability.