GAQM ISO-31000-CLA - ISO 31000 - Certified Lead Risk Manager

Risk management is becoming the basis for all decision making2. Risk management helps organizations to identify opportunities and threats, evaluate alternatives, and make informed choices.

Risk assessment teams are composed of cross functional subject matter experts, risk experts, and process owners. Risk assessment teams conduct risk assessments for specific areas or projects within the organization.

According to 3, page 7, one of the current trends in auditing, risk management and compliance is “increasing expectations for internal auditors to take a more focused oversight role with respect to enterprise-wide governance processes”. Internal auditors can provide independent assurance on how well an organization manages its risks using various tools such as audits, reviews, assessments and evaluations.

A governance, risk and compliance (GRC) framework is expected to improve efficiency by aligning strategy, processes, technology and people. GRC aims to integrate these elements to achieve organisational objectives while managing risks and complying with regulations.

A pure risk only leads to the possibility of a loss, whereas a speculative risk may lead to a gain12. For example, entering into a contract to purchase a new factory is a speculative risk, as it could result in either profit or loss depending on market conditions.

The ISO 31000:2018 standard provides a framework for risk management, with a focus on the strategic and integrated aspects of risk management. It outlines principles, a framework, and a process for managing risk in organizations of all kinds. The focus of the standard is on aligningrisk management with the organization’s context, objectives, and strategy, and on integrating risk management into all aspects of an organization’s governance, culture, and performance. 

According to , page 17, a crisis management team (CMT) is “a group of senior managers who have been delegated authority by an organization’s executive leadership team to make decisions during a crisis”. A centralized decision making structure allows for faster and more coordinated responses in an emergency situation.

Uncertainty leads to a changing context2. This means that uncertainty creates variability in outcomes and expectations, which may affect the objectives and scope of risk management.

Full accountability for risk controls and treatment and decision making involves risk are two of the enhanced risk management attributes according to ISO 31000:20091. These attributes indicate that risk management is integrated into governance and decision-making processes.

According to 1, systemic risk is “the possibility that an event at the company level could trigger severe instability or collapse an entire industry or economy”. It is different from other types of risks that affect only specific parts or aspects of an organization 2.