Stan­dard­ized Risk Man­age­ment: ISO 31000

The topic of risk man­age­ment is so important that no company can afford to be negligent in this regard. There are dangers – but also op­por­tu­ni­ties – in a company’s various areas and man­age­ment must be prepared for them. Only in this way can suitable solution processes be in­tro­duced. In order to establish a good risk man­age­ment system (RMS) in your company, the or­ga­ni­za­tion­al man­age­ment should adhere to the ISO 31000 standard.

A business venture is always as­so­ci­at­ed with economic, technical and strategic con­sid­er­a­tions, as well as other in­cal­cu­la­ble factors. These risks cannot be elim­i­nat­ed – the company has to face them. The risk man­age­ment system provides in­struc­tions and processes for how you should respond in risky sit­u­a­tions in order to limit damages as best as possible. However, ISO 31000 does not view risks as always negative. According to the standard, there are also positive risks. Whenever there is un­cer­tain­ty as to whether a future event causes a deviation from self-defined ob­jec­tives, we are dealing with risk.

The In­ter­na­tion­al Or­ga­ni­za­tion for Stan­dard­iza­tion (ISO) has es­tab­lished various standards for the man­age­ment of companies: ISO 9001 deals with quality man­age­ment, ISO 14001 provides guide­lines for en­vi­ron­men­tal man­age­ment, and ISO 50001 is a standard for energy man­age­ment. ISO 31000, on the other hand, has risk man­age­ment as its focus. Here it is a matter of handling different risks within the company. The standard is designed this way so that any risk can be addressed, and the ap­pli­ca­tion of systems is also not defined for specific companies. Both small and medium-sized busi­ness­es and large cor­po­ra­tions can organize their companies with more con­fi­dence by im­ple­ment­ing the guide­lines.

In contrast to other ISO standards, ISO 31000 is specif­i­cal­ly not intended for cer­ti­fi­ca­tion. While with similar standards, a system is designed according to pre­scribed guide­lines before un­der­go­ing an audit and, if suc­cess­ful, receives the re­spec­tive cer­tifi­cate that is valid in­ter­na­tion­al­ly, this is not the case with ISO 31000. Instead, the standard should be un­der­stood as a reference or set of guide­lines: Anyone who would like to implement an efficient RMS within their company can make use of the reg­u­la­tions.

In addition to an in­tro­duc­to­ry chapter and an appendix, the standard comprises prin­ci­ples, a framework, and an ex­pla­na­tion of the process.

With 11 prin­ci­ples, ISO 31000 specifies a framework which the sub­se­quent models of the standard can be based on. They clarify the im­por­tance of risk man­age­ment and provide basic in­struc­tions for struc­tur­ing a risk man­age­ment system.

• Value: An RMS ensures that company goals are met, thereby creating value.
• In­te­gra­tion: If the decision is taken to implement RMS within a company, it must be in­te­grat­ed into all areas.
• Decisions: If decisions are taken that affect the future of the company, an RMS should be used.
• Un­cer­tain­ty: An uncertain future is a central component of an RMS and in this respect is con­sid­ered as a given.
• System: A sound and up-to-date structure is essential for keeping the system in good func­tion­ing order.
• In­for­ma­tion: With the help of an RMS, all available data forms the basis for decision-making.
• Adap­ta­tion: The RMS must be cus­tomized and adapted to the company’s cir­cum­stances.
• In­di­vid­ual: A good RMS takes the factors of culture and the in­di­vid­ual seriously and is aligned ac­cord­ing­ly.
• Trans­paren­cy: All involved stake­hold­ers have full insight into the RMS.
• Dynamics: A well-func­tion­ing RMS adjusts to new cir­cum­stances without any issues.
• Im­prove­ment: A con­tin­u­ous process enables the RMS to steadily improve.

The fourth chapter of ISO 31000 describes a framework for the risk man­age­ment system. This is based on the prin­ci­ples and in turn es­tab­lish­es five different points that a system needs to comply with.

• In­te­gra­tion: Before a risk man­age­ment system can be suc­cess­ful­ly im­ple­ment­ed, the company’s exact structure must be un­der­stood. The man­age­ment then decides on a strategy and assigns re­spon­si­bil­i­ties.
• Struc­tur­ing: Internal and external factors are taken into con­sid­er­a­tion when struc­tur­ing an RMS. In a written statement, the or­ga­ni­za­tion­al man­age­ment pledges their com­mit­ment to risk man­age­ment and makes the strategy and role dis­tri­b­u­tion clear to all employees.
• Im­ple­men­ta­tion: In order to implement an RMS in a company, changes to the op­er­a­tional processes are required. The goal is to have the system accepted by all employees and become part of their work routine.
• As­sess­ment: In order to guarantee long-term ef­fec­tive­ness, the RMS must be regularly evaluated. Here, the defined goals are compared with the actual results.
• Im­prove­ment: The regular checks also enable constant im­prove­ments. The RMS should dy­nam­i­cal­ly adapt to company changes and in doing so become more and more effective with time.

If you have im­ple­ment­ed the framework within your company, it is then a matter of in­tro­duc­ing and executing risk man­age­ment processes. In contrast to the framework and the basic prin­ci­ples, the processes are specific actions that are tailored to the company. ISO 31000 should be generally ap­plic­a­ble to all companies in any industry, however, the standard here only provides initial sug­ges­tions. These have to be adapted to the company when im­ple­ment­ing the standard.

In doing so, two factors play the greatest roles: com­mu­ni­ca­tion and risk as­sess­ment. The stake­hold­ers (all in­di­vid­u­als affected by risk man­age­ment according to ISO 31000) must be informed about the im­ple­men­ta­tion steps. Through con­ver­sa­tions with all employees, the RMS can also always be better adjusted to the needs of the company over time.

Part of risk as­sess­ment is initially iden­ti­fy­ing potential risks. Once an overview of the risks has been created, they can be dis­trib­uted to the re­spon­si­ble parties. These in­di­vid­u­als sub­se­quent­ly analyze and assess the risks based on the analysis. The risk as­sess­ment in turn provides in­for­ma­tion for de­ter­min­ing to what extent and with what resources these potential events are to be faced.

If you have carried out the as­sess­ment, risk con­trol­ling can begin. Here it is possible to either com­plete­ly avoid certain risks, whose magnitude can only be reduced, or to accept the effects and do nothing about them. The company can also decide to hand over their man­age­ment to an external third party. The mon­i­tor­ing of risks as well as reporting about the findings conclude the process.

Other ISO standards related to business man­age­ment have the big advantage of enabling companies to strive toward cer­ti­fi­ca­tion. With a cer­tifi­cate, a company can prove at an in­ter­na­tion­al level that it has im­ple­ment­ed a stan­dard­ized system. ISO 31000 does not provide for this option, yet it is still worth im­ple­ment­ing the guide­lines.

Whether or not risk man­age­ment is suc­cess­ful can have con­se­quences that are critical for the business: If a company im­ple­ments an in­ad­e­quate RMS, the risks sometimes might not be iden­ti­fied at all or only too late. Without a sound risk man­age­ment system, there are also no suitable in­struc­tions for con­trol­ling risk. In contrast, in the ISO 31000 standard you can find tips and di­rec­tions for action that have been prepared by experts. Anyone who adheres to the guide­lines has therefore im­ple­ment­ed a very useful system within their company.

However, in­tro­duc­ing or switching to an RMS that complies with ISO 31000 also comes with a dis­ad­van­tage: The im­ple­men­ta­tion is time-intensive and sometimes also cost-intensive. The standard demands an in-depth analysis of the topic. Necessary changes cannot be planned in one meeting and then executed in a matter of days. Instead, you need to in­ten­sive­ly consider the cir­cum­stances of your company, the potential risks, as well as a system for dealing with these risks. Planning and im­ple­men­ta­tion can involve a lot of work. The re­spon­si­ble stake­hold­ers also need to make the necessary ca­pac­i­ties available to this end. This can lead to ad­di­tion­al costs.