Whether you’re a seasoned risk professional or just getting to grips with risk, ISO 31000 is a great resource, now widely adopted around the world. It is blissfully concise and clear, offering a flexible way to implement common-sense risk management.
And here’s why…
1 - ISO 31000 has an accessible structure, including:
- Simple terminology definitions, with a separate ISO 31000 guide 73 reference document covering additional risk vocabulary. A Principles section describes the purpose and characteristics of risk management across the organisation. The focus is on risk management as a tool for creating and protecting value, recognising the influence of human and cultural values and the need for customisation to fit your business. It presents risk management as an integrated, structured, inclusive and dynamic discipline, using the best information and focussing on continuous improvement.
- The Framework section has strong links to governance and decision-making, with leadership and commitment at its core. As expected from a quality standard, it focusses on integrating, designing, implementing, evaluating and improving risk management across the organisation.
- The risk process, with its familiar central pillar of Context, Assessment and Treatment elements, is surrounded by Communication, Monitoring and Reporting activities.
The guide succinctly covers the “why” (Principles), the “how” (Framework) and the “what” (Process) of risk management.
2 - ISO 31000 supports risk engagement across the whole business:
- The International Standards Organisation describes ISO 31000 as “applicable to all organisations, regardless of type, size, activities and location, and covers all types of risk. It was developed by a range of stakeholders and is intended for use by anyone who manages risks, not just professional risk managers.”
- It balances the mechanics of risk (process steps) with the business imperative of raising risk to the level of strategy and objectives.
- It is non-partisan regarding risk techniques, which are instead covered – these are covered in the very useful IEC/ISO 31010 standard. Using IEC/ISO 31010 the inexperienced can learn, and the gurus can debate the pros and cons of different risk assessment methods, without complicating the core “Why”, “How”, “What” messages of ISO 31000.
In a fast-changing world, the guide points to having an integrated view of risk, providing a platform for informed decision making.
3 - ISO 31000 is easily adaptable to your business:
- Unlike other ISO standards, ISO 31000 provides guidance rather than being a certification platform. Since every business has different objectives, structures and competitive positioning, there can be no one size fits all approach to risk. ISO 31000 offers a single standard that can be applied to all parts of your business, regardless of industry sector, type or location.
- Despite being concise, the standard is not lightweight. Its value lies in being applicable to any part of a business, whether small or large. Projects, programmes, business units, departments and functions can apply ISO 31000 in their own way while conforming to overall business requirements for risk management.
- Every organisation has a unique risk profile, making the flexibility of ISO 31000 a significant reason for its widespread adoption across the globe.
4 - ISO 31000 is easy to implement.
As a leading Risk Software provider, we understand how important it is that our Risk Management and Analysis software (Predict!) embraces the ISO 31000 Standard’s Principles, Framework and Process steps. Predict! delivers this within a seamlessly integrated working environment that focuses on speed, simplicity and a great user experience that encourages engagement.
Predict! facilitates ISO 31000 Standard’s approach by:
- Providing an integrated toolset that works across the whole organisation.
- Delivering all ISO 31000 process steps, from context, assessment and analysis through treatment and integrated reporting.
- Enabling communication, consultation, monitoring and review in support of fast decision-making.
- Removing many of the barriers to successful risk management implementation: designed with ease of use at its core.
- Helping break down silos between different parts of your organisation and connecting risks to their organisational goals and objectives.
- Satisfying the needs of different user roles, programs, terminology and process with its flexible configuration.
- Bringing the most important information to the attention of programme leaders, business functions, and the executives, through comprehensive reporting capability.
- Enabling users to see at a glance whether treatment plans are going to deliver the target benefits and reduction in risk impact.
- Prompting risk and action owners to update and status their assigned actions to ensure that decision-makers have an accurate picture of your risk profile.
- Providing a dynamic view of risk to enable review of strategy as needs require, and before it becomes too late to make effective changes.
- Making it easy for risk and action owners to quickly update information to improve engagement, efficiency and productivity.
- Offering seamlessly integrated analysis techniques: Monte Carlo and what-if (cost and schedule analysis), scenario analysis, bow-tie, controls effectiveness, checklists, sensitivity analysis, consequence-probability matrix, cost-benefit analysis.
Risk Decisions has designed Predict! to fully support organisations applying all elements of the ISO 31000 standard. Leading to great outcomes for your business.
