PECB ISO 31000 Foundation cheat sheet

Risk is defined as the effect of uncertainty on objectives; the effect is a deviation from what is expected and can be positive, negative, or both.

Risk is usually expressed in terms of risk sources, potential events, their consequences, and their likelihood; ISO 31000 does not mandate a single formula such as risk = likelihood × consequence.

Uncertainty is the state, even partial, of deficiency of information related to understanding or knowledge of an event, its consequence, or likelihood.

ISO 31000 principles: risk management is integrated, structured and comprehensive, customized, inclusive, dynamic, uses best available information, considers human and cultural factors, and is continually improved.

Purpose of risk management per ISO 31000 is the creation and protection of value; it improves performance, encourages innovation, and supports the achievement of objectives.

Risk management is not a stand-alone activity separate from the main activities and processes of the organization; it is part of decision-making and integrated into governance and leadership.

Inclusive risk management means the appropriate and timely involvement of stakeholders, enabling their knowledge, views, and perceptions to be considered.

Dynamic risk management means risks are reviewed and responded to as the organization's external and internal context changes, with emerging risks anticipated.

Best available information principle: inputs to risk management are based on historical and current information plus future expectations, acknowledging limitations and uncertainties of data.

Framework components in ISO 31000: leadership and commitment, integration, design, implementation, evaluation, and improvement; the framework is not a management system standard with certification requirements.

Leadership and commitment includes aligning risk management with organizational strategy, establishing a risk management policy, and ensuring resources are allocated.

Design of the framework covers understanding the organization and its context, articulating risk management commitment, assigning organizational roles and responsibilities, and allocating resources.

Risk management process steps: communication and consultation; scope, context, and criteria; risk assessment (identification, analysis, evaluation); risk treatment; monitoring and review; recording and reporting.

Communication and consultation are iterative and occur at every stage of the process, involving internal and external stakeholders as appropriate.

Risk identification aims to find, recognize, and describe risks, including risk sources, events, causes, and potential consequences; it uses techniques such as brainstorming, interviews, and checklists.

Risk analysis determines the nature and level of risk, considering likelihood, consequences, and their interactions, plus the effectiveness of existing controls.

Risk evaluation compares analysis results against risk criteria to decide whether further treatment is needed or the risk is acceptable.

Risk treatment options include avoiding the risk, taking or increasing the risk to pursue an opportunity, removing the risk source, changing likelihood or consequence, sharing the risk, and retaining the risk by informed decision.

Monitoring and review should be planned and periodic, verifying controls are effective, obtaining further information, and learning lessons; recording and reporting document the process and its outcomes.