Establishing a Risk Management Framework
Framework versus process
The framework (Clause 5) is the set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management across the organization. The process (Clause 6) is the systematic application of policies, procedures and practices to a specific decision or activity. Questions frequently swap them: assigning roles and allocating resources belongs to the framework; analysing a particular risk belongs to the process.
Component order
Leadership and commitment; integration; design; implementation; evaluation; improvement. Under design: understanding the organization and its context, articulating risk management commitment, assigning organizational roles, responsibilities, authorities and accountabilities, allocating resources, and establishing communication and consultation. Note that communication and consultation appears here and in the process - it is not exclusive to either.
Traps
- Options implying a risk manager, a risk committee, or a consultant must own risk management. Accountability sits with leadership and with risk owners at all levels; the governing body and top management provide leadership and commitment.
- Treating the framework as a one-off document set or project deliverable. It is dynamic and must be monitored, evaluated and improved, and adapted when the organization's context changes.
- Confusing evaluation (measuring framework performance against its purpose, plans and indicators) with improvement (adapting and continually improving).
Worked example and rule of thumb
An organization writes a policy and trains staff, then stops. Leadership and design exist; evaluation and improvement do not. The diagnosis is "the framework is not maintained and improved", not "there is no framework". Ask of any option: does it describe an arrangement (framework) or an activity on a specific risk (process)?