ISO 31000 Lead Risk Manager cheat sheet

Risk is defined as the effect of uncertainty on objectives; effects are deviations from the expected, positive or negative, and objectives can be expressed in financial, safety, environmental, or other terms.

Uncertainty is a state of deficient information related to understanding or knowledge of an event, its consequence, or likelihood; risk exists whenever objectives are exposed to uncertainty.

ISO 31000 principles: risk management is integrated, structured and comprehensive, customized, inclusive, dynamic, uses best available information, considers human and cultural factors, and supports continual improvement.

Risk management creates and protects value; it is not a standalone activity but part of governance, leadership, strategy, planning, and decision-making at all levels.

Risk is characterized by reference to potential events and consequences, or a combination of these; likelihood is the chance of something happening, whether defined qualitatively or quantitatively.

A consequence is the outcome of an event affecting objectives; consequences can be certain or uncertain and expressed qualitatively or quantitatively, with escalation, cascades, and cumulative effects possible.

Risk criteria are terms of reference against which significance of risk is evaluated; they derive from internal and external context and from legal, regulatory, and stakeholder obligations.

Key terms: risk source (element alone or in combination with potential to give rise to risk), event (occurrence of a particular set of circumstances), and control (measure that maintains or modifies risk).

ISO 31000 is a guidance standard, not a certifiable management system standard; ISO/IEC 31010 supports risk assessment technique selection and ISO Guide 73 supplies vocabulary.

The framework is the set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing, and continually improving risk management throughout the organization.

Framework components: leadership and commitment, integration, design, implementation, evaluation, and improvement; the framework is not the same as the risk management process it supports.

Design of the framework requires understanding the organization and its context, articulating risk management commitment, assigning organizational roles, authorities, responsibilities, and accountabilities, allocating resources, and establishing communication and consultation.

Leadership and commitment means top management ensures the framework's components are integrated into significant organizational activities and that risk management is embedded in governance and decision-making.

The risk management policy states the organization's commitment to risk management, links it to objectives and strategy, and provides the basis for setting risk criteria and allocating resources.

Accountability for managing risk is held by the person or body with authority; responsibility can be delegated, but accountability cannot be fully transferred.

Integration means risk management is part of, and not separate from, purpose, governance, leadership and commitment, strategy, objectives, and operations.

Evaluation of the framework uses metrics and indicators to judge whether the framework supports organizational objectives; improvement adapts and enhances the framework to address internal and external changes.

Gap analysis, maturity models, and framework benchmarking are common tools for evaluating framework adequacy; outputs feed the improvement loop, not the risk treatment plan directly.

The risk management process comprises establishing scope, context, and criteria; risk assessment (identification, analysis, evaluation); risk treatment; recording and reporting; and monitoring, review, communication, and consultation.

Establishing context includes external context (legal, regulatory, market, cultural, competitive), internal context (governance, capabilities, culture, information systems), and risk criteria for evaluation.

Risk identification aims to find, recognize, and describe risks that may help or prevent the organization from achieving objectives; it includes opportunities as well as threats and considers causes and consequences.

Risk analysis determines the nature, level, and characteristics of risk, including likelihood, consequence, complexity, velocity, and interactions; it provides input to risk evaluation and treatment decisions.

Risk evaluation compares analysis results with risk criteria to determine whether the risk is acceptable or tolerable and whether treatment is required; it supports priority ordering for treatment.

Qualitative techniques (brainstorming, Delphi, scenario analysis, SWIFT, HAZOP, bow-tie) are used when data are limited or when a rapid, structured view is needed; each has strengths and limitations.

Quantitative techniques (fault tree, event tree, Monte Carlo simulation, Bayesian networks, FMEA with RPN) express risk in numerical terms and require data quality and model assumptions to be validated.

Risk assessment should be systematic, iterative, and collaborative, drawing on diverse knowledge and views of stakeholders, and should be documented so results can be traced, reviewed, and repeated.

Risk criteria should be defined before analysis to avoid post-hoc justification; they must consider legal and regulatory requirements, organizational objectives, and stakeholder views.

Risk treatment options: avoid the risk, take or increase the risk to pursue an opportunity, remove the risk source, change the likelihood or consequence, share the risk, and retain the risk by informed decision.

Selecting treatment options involves balancing costs and benefits, considering stakeholder views, and evaluating whether residual risk is acceptable against risk criteria.

Treatment plans specify the selected options, responsible parties, resources, performance measures, timing, and expected outcomes; they should be integrated into management plans and budgets.

Controls are the measures that maintain or modify risk; they include preventive, detective, and corrective controls, and their effectiveness must be assessed, not assumed.

Residual risk is the risk remaining after treatment; secondary risk is a new risk arising from a treatment action itself, and both must be identified and evaluated.

Risk owners are accountable for treatment decisions and must have authority and resources to implement and monitor the treatment.

Sharing risk through insurance, contracts, or partnerships transfers some financial or operational consequence but not accountability for the risk itself.

Treatment effectiveness is judged by comparing residual risk with risk criteria; if residual risk is not acceptable, treatment should be revised, and the decision to retain risk should be recorded.

Opportunity treatment may involve taking or increasing risk to pursue a beneficial outcome; not all treatment reduces risk, and some treatment deliberately increases exposure.

The risk management process should be documented and reported through formal records, including the risk register, risk treatment plans, assessment results, and decisions and their rationale.

A risk register typically records risk description, cause, consequence, likelihood, impact, risk rating, controls, residual rating, risk owner, treatment actions, and review dates.

Reporting should be tailored to the audience: operational reports for front-line managers, tactical reports for middle management, and strategic reports for the board and executives.

Reporting should be timely, accurate, concise, and comparable over time; it should include changes in risk levels, treatment progress, incidents, and emerging risks.

The principle of traceability requires that risk information be linked to objectives, decisions, and evidence so that assessments can be audited and repeated.

Legal, regulatory, and contractual reporting obligations (e.g., safety, environmental, financial disclosures) may require specific content, format, frequency, and retention periods.

Confidentiality and data protection requirements must be applied to risk records; access should be limited to those with a legitimate need.

Records of risk assessment should include the context, criteria, techniques used, assumptions, participants, and limitations, so results can be interpreted correctly by others.

Monitoring is the continual checking, supervising, critically observing, or determining the status of a process, system, or activity; review is the determination of the suitability, adequacy, and effectiveness of the subject to achieve objectives.

Monitoring and review should cover the risk management framework, the process, and the risks themselves, with defined frequency, responsibility, and escalation triggers.

Key risk indicators (KRIs) are metrics that provide early warning of increasing risk exposure; they should be linked to risk appetite and have defined thresholds and response actions.

Communication and consultation are integral to all process steps; they involve sharing information and engaging stakeholders to obtain feedback and improve decisions.

Communication promotes awareness and understanding of risk, while consultation seeks informed input from stakeholders before decisions are made; the two should not be conflated.

Stakeholders include those who affect, are affected by, or perceive themselves to be affected by a decision or activity; their views should inform risk criteria and treatment.

Review triggers include changes in internal or external context, incidents, near misses, audit findings, changes in risk criteria, and scheduled intervals.

Findings from monitoring and review feed continual improvement of the framework and process; they should also update risk records and the risk register.

Internal audit, self-assessment, and independent assurance can support monitoring; results should be reported to those with authority to act.