ISO 31000 Lead Risk Manager: Fundamental Principles and Concepts of Risk Management

Domain 1 - Fundamental principles and concepts of risk management

This domain tests whether you can use ISO 31000:2018 vocabulary precisely and apply the eight principles that separate risk management from ad hoc problem solving.

Core rules

• Risk is the effect of uncertainty on objectives, and that effect can be positive, negative or both; it is described in terms of consequences and likelihood. Uncertainty is the state, even partial, of deficiency of information related to understanding or knowledge of an event, its consequence or likelihood.
• Risk is objective-relative: no objectives, no risk. Two organisations facing the same hazard carry different risks because their objectives differ.
• The eight principles - integrated, structured and comprehensive, customised, inclusive, dynamic, best available information, human and cultural factors, continual improvement - describe why risk management works. They sit above both the framework and the process.
• Risk owner: person with accountability and authority to manage a risk. Risk source: an element which alone or in combination has the potential to give rise to risk. Control: a measure that maintains and/or modifies risk. Residual risk: risk remaining after treatment.

Worked example

A logistics firm's main depot lease expires in 90 days and no renewal has been negotiated. Is that a risk? No. The expiry is a dated certainty, so it is an issue for issue management. The genuine risk is loss of depot capacity disrupts customer delivery objectives - uncertain, describable in consequences and likelihood, with a named owner, analysable and treatable. Answers that label the certain lease expiry as a risk lose marks.

Traps that cost marks

• Defining risk as probability × impact or as downside only.
• Confusing risk criteria (the reference against which significance is evaluated) with risk appetite (the amount of risk an organisation is willing to pursue or retain).
• Mixing the principles, the framework and the process into one list, or crediting ISO 31000 with prescriptive controls it does not contain.