Stand­ard­ised Risk Man­age­ment: ISO 31000

The topic of risk man­age­ment is so important that no company can afford to be negligent in this regard. There are dangers – but also op­por­tun­it­ies – in a company’s various areas and man­age­ment must be prepared for them. Only in this way can suitable solution processes be in­tro­duced. In order to establish a good risk man­age­ment system (RMS) in your company, the or­gan­isa­tion­al man­age­ment should adhere to the ISO 31000 standard.

A business venture is always as­so­ci­ated with economic, technical and strategic con­sid­er­a­tions, as well as other in­cal­cul­able factors. These risks cannot be elim­in­ated – the company has to face them. The risk man­age­ment system provides in­struc­tions and processes for how you should respond in risky situ­ations in order to limit damages as best as possible. However, ISO 31000 does not view risks as always negative. According to the standard, there are also positive risks. Whenever there is un­cer­tainty as to whether a future event causes a deviation from self-defined ob­ject­ives, we are dealing with risk.

The In­ter­na­tion­al Or­gan­isa­tion for Stand­ard­isa­tion (ISO) has es­tab­lished various standards for the man­age­ment of companies: ISO 9001 deals with quality man­age­ment, ISO 14001 provides guidelines for en­vir­on­ment­al man­age­ment, and ISO 50001 is a standard for energy man­age­ment. ISO 31000, on the other hand, has risk man­age­ment as its focus. Here it is a matter of handling different risks within the company. The standard is designed this way so that any risk can be addressed, and the ap­plic­a­tion of systems is also not defined for specific companies. Both small and medium-sized busi­nesses and large cor­por­a­tions can organise their companies with more con­fid­ence by im­ple­ment­ing the guidelines.

In contrast to other ISO standards, ISO 31000 is spe­cific­ally not intended for cer­ti­fic­a­tion. While with similar standards, a system is designed according to pre­scribed guidelines before un­der­go­ing an audit and, if suc­cess­ful, receives the re­spect­ive cer­ti­fic­ate that is valid in­ter­na­tion­ally, this is not the case with ISO 31000. Instead, the standard should be un­der­stood as a reference or set of guidelines: Anyone who would like to implement an efficient RMS within their company can make use of the reg­u­la­tions.

In addition to an in­tro­duct­ory chapter and an appendix, the standard comprises prin­ciples, a framework, and an ex­plan­a­tion of the process.

With 11 prin­ciples, ISO 31000 specifies a framework which the sub­sequent models of the standard can be based on. They clarify the im­port­ance of risk man­age­ment and provide basic in­struc­tions for struc­tur­ing a risk man­age­ment system.

• Value: An RMS ensures that company goals are met, thereby creating value.
• In­teg­ra­tion: If the decision is taken to implement RMS within a company, it must be in­teg­rated into all areas.
• Decisions: If decisions are taken that affect the future of the company, an RMS should be used.
• Un­cer­tainty: An uncertain future is a central component of an RMS and in this respect is con­sidered as a given.
• System: A sound and up-to-date structure is essential for keeping the system in good func­tion­ing order.
• In­form­a­tion: With the help of an RMS, all available data forms the basis for decision-making.
• Ad­apt­a­tion: The RMS must be cus­tom­ised and adapted to the company’s cir­cum­stances.
• In­di­vidu­al: A good RMS takes the factors of culture and the in­di­vidu­al seriously and is aligned ac­cord­ingly.
• Trans­par­ency: All involved stake­hold­ers have full insight into the RMS.
• Dynamics: A well-func­tion­ing RMS adjusts to new cir­cum­stances without any issues.
• Im­prove­ment: A con­tinu­ous process enables the RMS to steadily improve.

The fourth chapter of ISO 31000 describes a framework for the risk man­age­ment system. This is based on the prin­ciples and in turn es­tab­lishes five different points that a system needs to comply with.

• In­teg­ra­tion: Before a risk man­age­ment system can be suc­cess­fully im­ple­men­ted, the company’s exact structure must be un­der­stood. The man­age­ment then decides on a strategy and assigns re­spons­ib­il­it­ies.
• Struc­tur­ing: Internal and external factors are taken into con­sid­er­a­tion when struc­tur­ing an RMS. In a written statement, the or­gan­isa­tion­al man­age­ment pledges their com­mit­ment to risk man­age­ment and makes the strategy and role dis­tri­bu­tion clear to all employees.
• Im­ple­ment­a­tion: In order to implement an RMS in a company, changes to the op­er­a­tion­al processes are required. The goal is to have the system accepted by all employees and become part of their work routine.
• As­sess­ment: In order to guarantee long-term ef­fect­ive­ness, the RMS must be regularly evaluated. Here, the defined goals are compared with the actual results.
• Im­prove­ment: The regular checks also enable constant im­prove­ments. The RMS should dy­nam­ic­ally adapt to company changes and in doing so become more and more effective with time.

If you have im­ple­men­ted the framework within your company, it is then a matter of in­tro­du­cing and executing risk man­age­ment processes. In contrast to the framework and the basic prin­ciples, the processes are specific actions that are tailored to the company. ISO 31000 should be generally ap­plic­able to all companies in any industry, however, the standard here only provides initial sug­ges­tions. These have to be adapted to the company when im­ple­ment­ing the standard.

In doing so, two factors play the greatest roles: com­mu­nic­a­tion and risk as­sess­ment. The stake­hold­ers (all in­di­vidu­als affected by risk man­age­ment according to ISO 31000) must be informed about the im­ple­ment­a­tion steps. Through con­ver­sa­tions with all employees, the RMS can also always be better adjusted to the needs of the company over time.

Part of risk as­sess­ment is initially identi­fy­ing potential risks. Once an overview of the risks has been created, they can be dis­trib­uted to the re­spons­ible parties. These in­di­vidu­als sub­sequently analyse and assess the risks based on the analysis. The risk as­sess­ment in turn provides in­form­a­tion for de­term­in­ing to what extent and with what resources these potential events are to be faced.

If you have carried out the as­sess­ment, risk con­trolling can begin. Here it is possible to either com­pletely avoid certain risks, whose magnitude can only be reduced, or to accept the effects and do nothing about them. The company can also decide to hand over their man­age­ment to an external third party. The mon­it­or­ing of risks as well as reporting about the findings conclude the process.

Other ISO standards related to business man­age­ment have the big advantage of enabling companies to strive toward cer­ti­fic­a­tion. With a cer­ti­fic­ate, a company can prove at an in­ter­na­tion­al level that it has im­ple­men­ted a stand­ard­ised system. ISO 31000 does not provide for this option, yet it is still worth im­ple­ment­ing the guidelines.

Whether or not risk man­age­ment is suc­cess­ful can have con­sequences that are critical for the business: If a company im­ple­ments an in­ad­equate RMS, the risks sometimes might not be iden­ti­fied at all or only too late. Without a sound risk man­age­ment system, there are also no suitable in­struc­tions for con­trolling risk. In contrast, in the ISO 31000 standard you can find tips and dir­ec­tions for action that have been prepared by experts. Anyone who adheres to the guidelines has therefore im­ple­men­ted a very useful system within their company.

However, in­tro­du­cing or switching to an RMS that complies with ISO 31000 also comes with a dis­ad­vant­age: The im­ple­ment­a­tion is time-intensive and sometimes also cost-intensive. The standard demands an in-depth analysis of the topic. Necessary changes cannot be planned in one meeting and then executed in a matter of days. Instead, you need to in­tens­ively consider the cir­cum­stances of your company, the potential risks, as well as a system for dealing with these risks. Planning and im­ple­ment­a­tion can involve a lot of work. The re­spons­ible stake­hold­ers also need to make the necessary ca­pa­cit­ies available to this end. This can lead to ad­di­tion­al costs.

Please note the legal dis­claim­er relating to this article