Fundamental Principles and Concepts of Risk Management
What "risk" actually means
ISO 31000:2018 defines risk as the effect of uncertainty on objectives, where an effect is a deviation from what is expected and may be positive or negative. Uncertainty is the state of deficient information related to understanding or knowledge of an event, its consequence or likelihood. Three things follow: risk is not a synonym for hazard or loss; opportunity is inside the definition; and risk cannot be assessed independently of objectives.
The principles
Risk management is integrated, structured and comprehensive, customized, inclusive, dynamic, based on best available information, considers human and cultural factors, and is continually improved. Its purpose is value creation and protection - not risk minimization. "Inclusive" means stakeholders are appropriately and timely involved; it is not identical to the process activity of communication and consultation.
Traps to expect
- ISO 31000 is not a management system standard: it gives guidelines, not requirements, and organizations cannot be certified to it. Certification belongs to standards such as ISO 9001 or ISO/IEC 27001.
- "Likelihood × severity score" is a common scoring technique, not the definition of risk. An option offering it as the definition is wrong.
- Distinguish risk owner (accountable, with authority to manage a risk) from a person merely performing a treatment task; and risk appetite (amount and type of risk an organization is willing to pursue) from risk attitude (the approach used to assess and eventually pursue, retain, avoid or take risk).
Rule of thumb
If an option treats risk as downside only, or makes risk management a standalone function owned by a risk department, eliminate it. ISO 31000's logic is effect on objectives plus integration into everything the organization does.