ISO 31000 2009 

3. RISK MANAGEMENT PRINCIPLES

3(A) RISK MANAGEMENT SHOULD CREATE AND PROTECT VALUE

• Use risk management to create and protect value.

  • Create and protect value by using risk management to help achieve your organization’s objectives and improve its performance.              

3(B) RISK MANAGEMENT SHOULD BE PART OF ALL PROCESSES

• Make risk management part of every process at every level.

• Make risk management a responsibility of every manager.

3(C) RISK MANAGEMENT SHOULD BE PART OF YOUR DECISION MAKING

• Make risk management part of decision making at all levels.

  • Use risk management to make informed choices.

  • Use risk management to prioritize actions.

3(D) RISK MANAGEMENT SHOULD BE USED TO HANDLE UNCERTAINTY

• Use risk management to address the uncertainty that you face.

  • Use risk management to identify and define the nature and type of uncertainties that your organization must deal with.

  • Use risk management to figure out what you can do to address your organization’s uncertainties.

3(E) RISK MANAGEMENT SHOULD BE SYSTEMATIC AND TIMELY

• Make sure that your organization’s approach to risk management is systematic, structured, and timely.

  • Make sure that your approach contributes to efficiency.

  • Make sure that your approach generates reliable results.

3(F) RISK MANAGEMENT SHOULD BE BASED ON THE BEST DATA

• Make sure that the inputs you use to manage risk are based on the best available information sources.

• Make sure that decision makers understand and consider the limitations and shortcomings of the data they use to manage risk.

3(G) RISK MANAGEMENT SHOULD BE TAILORED TO YOUR ENVIRONMENT

• Make sure that your organization’s approach to risk management is aligned with its unique internal and external context.

• Make sure that your organization’s approach to risk management is aligned with its risk profile.

3(H) RISK MANAGEMENT SHOULD CONSIDER HUMAN FACTORS

• Make sure that your approach to risk management recognizes and considers the human and cultural factors that can influence the achievement of your organization’s objectives.

  • Consider how human capabilities can facilitate or hinder the achievement of your objectives.

  • Consider how human perceptions can facilitate or hinder the achievement of your objectives.

  • Consider how human intentions can facilitate or hinder the achievement of your objectives.

3(I) RISK MANAGEMENT SHOULD BE TRANSPARENT AND INCLUSIVE

• Make sure that your approach to risk management is transparent.

  • Make sure that your organization’s approach to risk management is open, visible, and accessible.

• Make sure that your approach to risk management is inclusive.

  • Involve your organization’s stakeholders.

  • Involve decision makers from all parts of your organization.

3(J) RISK MANAGEMENT SHOULD BE RESPONSIVE AND ITERATIVE

• Make sure that your organization’s approach to risk management is dynamic and responsive.

  • Make sure that your approach to risk management continually senses change and responds to it.

• Make sure that your approach to risk management is ongoing.

  • Repeat your risk management process whenever and wherever objectives need to be achieved.

3(K) RISK MANAGEMENT SHOULD SUPPORT CONTINUAL IMPROVEMENT

• Use risk management to improve all aspects of your organization.

• Develop strategies to improve your approach to risk management.

4. RISK MANAGEMENT FRAMEWORK

4.1 ESTABLISH A RISK MANAGEMENT FRAMEWORK

• Make risk management part of your management system.

  • Establish an effective risk management framework.

  • Use your framework to support risk management process.

4.2 MAKE A COMMITMENT TO RISK MANAGEMENT

• Define your organization’s risk management policy.

• Establish risk management performance indicators.

• Formulate risk management objectives.

• Assign risk management responsibilities.

• Allocate risk management resources.

• Communicate risk management benefits.

• Support your risk management framework.

4.3 DESIGN YOUR RISK MANAGEMENT FRAMEWORK

4.3.1 Understand your organization's context

• Evaluate and understand your organization’s external context and then use this knowledge to design your risk management framework.

  • Evaluate and understand your external environment.

  • Evaluate and understand your external stakeholders.

  • Evaluate and understand your external influences.

• Evaluate and understand your organization’s internal context and then use this knowledge to design your risk management framework.

  • Understand your organization’s internal stakeholders.

  • Understand your organization’s governance.

  • Understand your organization’s capabilities.

  • Understand your organization’s culture.

  • Understand your organization’s standards.

  • Understand your organization’s contracts.

4.3.2 Formulate your risk management policy

• Establish a risk management policy for your organization.

  • Make a clear commitment to risk management.

  • Define your risk management objectives.

  • Explain how your policy will be implemented.

• Communicate your risk management policy.

4.3.3 Make people accountable for managing risk

• Identify your organization’s risk owners.

• Give risk owners the authority to manage risk.

• Make risk owners accountable for managing risk.

• Establish risk management performance measurement methods.

• Develop risk management reporting and escalation processes.

4.3.4 Build risk management into your organization

• Make risk management a part of all processes and practices.

• Develop an organization-wide risk management plan.

4.3.5 Allocate resources for risk management

• Allocate appropriate resources to support your organization’s risk management activities.                    

  • Consider providing people who can support your organization’s risk management activities.                

  • Consider providing resources needed to support each step of the risk management process.               

  • Consider providing information and knowledge management systems to support risk management.                  

  • Consider providing risk management procedures and processes.                       

  • Consider providing appropriate risk management methods and tools.                         

4.3.6 Establish internal communication mechanisms

• Establish internal risk management communication and reporting processes and mechanisms.                               

4.3.7 Develop an external communication plan

• Develop a plan that describes how you intend to communicate with your external stakeholders.

• Implement your risk management communication plan.

4.4 IMPLEMENT YOUR APPROACH TO RISK MANAGEMENT

4.4.1 Implement your risk management framework

• Develop a strategy to implement your organization’s framework.

• Implement your organization’s risk management framework.

4.4.2 Implement your risk management process

• Develop a plan that explains how you intend to apply your organization’s risk management process (Part 5).

• Use your risk management plan to implement your organization’s risk management process (Part 5).

4.5 MONITOR YOUR RISK MANAGEMENT FRAMEWORK

• Evaluate the ongoing effectiveness of your organization’s risk management framework.         

• Prepare reports on the effectiveness of your organization’s risk management framework.            

4.6 IMPROVE YOUR RISK MANAGEMENT FRAMEWORK

• Study the results of your organization’s risk management monitoring and review activities (see Part 4.5, above).

• Figure out how you’re going to improve your organization’s risk management framework.          

5.1 APPLY YOUR RISK MANAGEMENT PROCESS

• Apply your risk management process (see Part 5.2 to 5.6).

  • Make your risk management process part of your organization’s management approach.

  • Make your risk management process part of your organization’s unique culture.