GAQM ISO-31000-CLA - ISO 31000 - Certified Lead Risk Manager

ISO 31000:2018 consists of risk management principles, framework, and process that have been adopted as a national risk management standard by more than 60 countries23. It provides guidelines on managing any type of risk faced by organizations.

Transparency and inclusiveness are key ISO 31000:2018 attributes. Transparency means that risk management activities are visible, understandable, and verifiable by relevant stakeholders. Inclusiveness means that appropriate stakeholders are involved in risk management decisions and actions.

Records are one of the tools used by risk managers for communication between stakeholdersand interested parties2. Records help to share information, insights, recommendations, and decisions related to risk management.

A business interruption review is an evaluation of the effectiveness of a business continuity plan, which is a set of procedures and resources to ensure that an organisation can continue its critical functions in the event of a disruption12.

Enhanced risk management emphasizes the continual improvement of risk management capabilities1. This means that risk management is regularly reviewed and updated to ensure its relevance, adequacy, and effectiveness.

According to , page 8, hazard risk is “the traditional pure risk that only has a downside”. It is usually associated with natural disasters, accidents, lawsuits or other events that cause harm or damage.

Inclusiveness is another critical attribute of good risk management. Inclusiveness helps to ensure that different perspectives, knowledge, and values are considered in risk management.

According to ISO/IEC Guide73 (2009), clause 1., risk is defined as “the effect of uncertainty on objectives”. This definition applies to both ISO/IEC Guide73 (2009) and ISO31000 (2018), which are standards for risk management terminology and principles respectively.

Risk management is tailored4. Tailored means that risk management takes into account the specific needs, objectives, and characteristics of each organization and its context.

 Enhanced risk management ensures that uncertainty is managed so the organization can meet its objectives4. Enhanced risk management involves applying a systematic and logical process to identify, analyze, evaluate, treat, monitor, review, and communicate risks.