Establishment of the Risk Management Framework
Domain 2 - Establishment of the risk management framework
This domain tests clause 5: how an organisation builds the arrangements that make risk management part of normal work rather than a side project.
Core rules
- The framework has six components: leadership and commitment, integration, design, implementation, evaluation, improvement. They loop; they are not project phases with a finish line.
- Integration comes before tooling. Risk management must be embedded in governance, strategy, planning, budgeting, performance and culture; buying a register does not create a framework.
- Design covers understanding the organisation and its context, articulating a risk management commitment (typically a policy approved by top management), assigning roles, authorities, responsibilities and accountabilities, allocating resources, and establishing communication and consultation.
- Evaluation asks whether the framework is achieving its purpose: performance indicators, reviews, and whether it remains fit for purpose and adequate in a changing context.
- ISO 31000:2018 is not a certifiable standard. There is no accredited ISO 31000 certificate; a supplier claiming one is a red flag.
Worked example
An organisation has a populated risk register but no policy, no executive risk sponsor, and no link from risks to annual planning. Mapping to the framework: leadership and commitment is absent, roles and authorities are undefined, and integration is missing. The register is a process artefact, not evidence of a framework. Priority actions are a top-management commitment statement, named framework roles, and a planning-cycle hook - before any software purchase.
Traps that cost marks
- Confusing the framework (the permanent arrangement) with the process (the repeated sequence of activities).
- Treating implementation as a one-off launch rather than a continuing cycle of evaluation and improvement.
- Copying another organisation's framework template without adapting it to the internal and external context.