ISO 31000 RM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk (ISO 31000)

The effect of uncertainty on objectives. The effect is a deviation from the expected and can be positive, negative, or both; risk is often described by reference to potential events and consequences.

Uncertainty

The state, even partial, of deficiency of information related to, or understanding or knowledge of, an event, its consequence, or likelihood. It underlies every risk and cannot be fully eliminated.

Risk management

Coordinated activities to direct and control an organization with regard to risk. It covers the principles, framework and process by which an organization manages risk systematically.

Risk attitude

An organization's approach to assess and eventually pursue, retain, take or turn away from risk. It shapes behaviour and is distinct from risk appetite, which states how much risk is acceptable.

Risk appetite

The amount and type of risk that an organization is willing to pursue or retain. It is expressed through risk criteria and guides decisions about which risks to treat and which to accept.

Risk criteria

Terms of reference against which the significance of a risk is evaluated. They reflect organizational objectives, values and legal obligations, and may be revised as context changes.

Risk owner

A person or entity with the accountability and authority to manage a risk. Assigning ownership ensures each identified risk has a named decision-maker responsible for its treatment.

Residual risk

The risk remaining after risk treatment has been applied. It should be documented and compared against risk criteria to determine whether further treatment is required.

Risk source

An element which alone or in combination has the potential to give rise to risk. Sources are what risk identification seeks to find before consequences and likelihood are analyzed.

Consequence

The outcome of an event affecting objectives. Consequences can be certain or uncertain and can have positive or negative, direct or indirect effects on an organization's goals.

Likelihood

The chance of something happening. It may be described qualitatively, semi-quantitatively or quantitatively and is combined with consequence when analyzing the level of risk.

Risk management framework

A set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the organization.

Leadership and commitment

The framework element in which top management directs and supports risk management, aligns it with strategy, and provides the authority and resources needed for it to function.

Integration of risk management

The framework element requiring risk management to be embedded in all organizational activities, including governance, planning and decision-making, rather than run as a separate parallel activity.

Framework design

The framework element covering understanding the organization's context, articulating commitment, assigning roles and authorities, allocating resources, and establishing communication and consultation before implementation.

Assigning roles and authorities

A design activity that defines who is accountable for managing risk at each level. Clear responsibilities prevent gaps and overlaps and enable risk owners to act.

Allocating resources

A design activity in which the organization determines and provides the people, methods, tools, information and budget needed for risk management to operate effectively.

Framework evaluation

Periodic measurement of whether the risk management framework is effective, comparing its performance with its purpose, plans and indicators so that gaps and weaknesses are identified.

Framework improvement

Adapting the framework to internal and external change and continually improving its suitability, adequacy and effectiveness so that risk management remains relevant over time.

Top management

The person or group of people who directs and controls an organization at the highest level. ISO 31000 requires their leadership and commitment for the framework to succeed.

Customized framework

A framework tailored to the organization's external and internal context, objectives and needs, rather than adopted as an off-the-shelf template copied from another organization.

Risk management process

The systematic application of management policies, procedures and practices to communicating, consulting, establishing context, and identifying, analyzing, evaluating, treating, monitoring and reviewing risk.

Scope, context and criteria

The process step defining the boundaries of risk management activity, describing the external and internal context, and setting risk criteria against which risks will later be evaluated.

Risk identification

The process of finding, recognizing and describing risks, including risk sources, events, causes and potential consequences, using techniques appropriate to the objectives and context.

Risk analysis

The process to comprehend the nature and characteristics of a risk and determine its level, considering likelihood, consequences, effectiveness of controls and the uncertainty involved.

Risk evaluation

The process of comparing the results of risk analysis with established risk criteria to decide whether additional treatment is needed or the risk can be accepted as it stands.

Risk treatment

The process to modify risk by selecting and implementing one or more options, such as avoiding the risk, changing likelihood or consequence, sharing it, or retaining it by informed decision.

Risk treatment plan

A document specifying the chosen treatment options, resources, responsibilities, timelines and performance measures, together with the expected residual risk after implementation.

Monitoring

Continual checking, supervising or critically observing the status of risk and its treatment in order to identify change from the performance level required or expected.

Review

An activity undertaken to determine the suitability, adequacy and effectiveness of the subject matter in achieving established objectives, used to update both risks and the process itself.

Recording and reporting

Process activities that document risk management results and communicate them across the organization, providing evidence of decisions, supporting governance, and enabling traceability of treatment.

Communication and consultation

A process step, repeated at every stage, that brings stakeholders into the sharing of information and dialogue so differing views are considered and decisions are supported.