Risk management framework and risk management process
This domain tests Clause 5 (framework) and Clause 6 (process). You must know the components, their order and iteration, and the difference between the framework - the arrangements that embed risk management - and the process - the activities applied to risks.
Framework
- Leadership and commitment: top management ensures integration and provides resources.
- Integration: risk management is part of governance, strategy, planning and performance, not a parallel activity.
- Design: understand context; articulate commitment; assign roles, authorities, responsibilities and accountabilities; allocate resources; establish communication and consultation.
- Implementation, evaluation and improvement: the framework is adapted and continually improved.
Process
- Scope, context and criteria: establish external and internal context and the risk criteria against which significance is judged.
- Risk assessment: identification (find, recognize, describe risks), analysis (causes, consequences, likelihood, controls, uncertainty) and evaluation (compare with criteria).
- Risk treatment: select options, plan, implement and check residual risk.
- Communication and consultation, and monitoring and review, run throughout rather than as one-off steps.
- Recording and reporting document the process and its outcomes.
Worked example
A bank plans a new instant-payment feature. Scope and criteria set the objective - launch within six months, with no more than a defined fraud-loss threshold. Identification finds fraud, outage and third-party dependency. Analysis shows outage likelihood and consequence; evaluation compares the result with the fraud threshold and decides treatment is required. The team selects a control (transaction limits), records the residual risk and monitors fraud data after launch. The framework element is visible in assigned ownership and executive review.
Traps
- Drawing the process as a straight line; ISO 31000 expects iteration.
- Starting treatment before evaluation.
- Calling the framework a “risk management process”.
- Omitting risk criteria until after analysis.
- Treating recording and reporting as an afterthought.