Unit
- Risk defined: Risk is the effect of uncertainty on objectives. It encompasses both negative threats and positive opportunities, and every organization must decide its risk appetite, the amount of risk it is willing to accept in pursuit of value.
- Components of risk: Every risk event has three elements: a cause (trigger), an event (the occurrence), and a consequence (impact on objectives). Understanding this chain helps practitioners design targeted controls rather than generic responses.
- The risk management process: ISO 31000 outlines a structured cycle: establish context, identify risks, analyze risks, evaluate risks, treat risks, monitor and review. This process is iterative, not linear, as new risks emerge constantly.
- Risk appetite vs. risk tolerance: Risk appetite is the broad level of risk an organization is willing to take. Risk tolerance translates appetite into specific acceptable deviations for each objective. A mismatch between the two leads to either excessive caution or reckless exposure.
- Enterprise risk management (ERM): ERM is a holistic approach that integrates risk management across all business units, functions, and strategies. Unlike siloed methods, ERM considers the portfolio effect of risks and dependencies between them.
- Roles and responsibilities: The board sets risk appetite, senior management designs the framework, risk officers facilitate the process, and business line owners are the first line of defense. Clear accountability prevents gaps.
- Key standards: ISO 31000 provides generic principles, COSO ERM focuses on strategy and performance integration, and industry-specific frameworks like Basel III for banking add sector requirements. Practitioners should align with applicable standards.
- Risk culture: An organization's attitude toward risk shapes how rigorously the process is followed. A strong risk culture encourages open reporting, learning from failures, and balanced risk-taking aligned with strategic goals.
- Risk register: A risk register is a central repository that documents each identified risk, its cause, impact, probability, owner, and planned response. Maintaining a current risk register enables tracking, prioritization, and accountability across the organization, serving as the backbone of the risk management process.
- Key risk indicators (KRIs): KRIs are metrics that provide early warning signals of increasing risk exposure. By monitoring KRIs linked to specific risk appetite thresholds, organizations can detect emerging threats before they materialize and trigger timely mitigation actions.
- Emerging risk management: Emerging risks are novel, uncertain threats that may arise from technological shifts, geopolitical changes, or environmental factors. Proactive scanning and scenario analysis help organizations anticipate these risks and develop flexible strategies to adapt before they become critical.
Strategic Framework
Framework: ISO 31000 Risk Management Process
Purpose: To provide a universal, principles-based approach for managing any type of risk in any organization.
- Establish context: Define internal and external parameters, stakeholder expectations, and scope of risk management activities.
- Risk assessment: A three-step sub-process covering identification, analysis, and evaluation to prioritize risks for treatment.
- Risk treatment: Select and implement options to modify risk (avoid, reduce, transfer, share, accept). treatment plans must be documented and resourced.
- Monitoring and review: Continuous surveillance of risks and the effectiveness of controls, with periodic reassessment to capture changes.
- Communication and consultation: Ongoing engagement with stakeholders to ensure shared understanding and informed decision-making.
Quick Revision
- Risk is the effect of uncertainty on objectives, composed of cause, event, and consequence.
- The ISO 31000 process includes context, identification, analysis, evaluation, treatment, and monitoring.
- Risk appetite sets the acceptable level of risk; tolerance defines specific boundaries per objective.
- ERM integrates risk management across the entire organization for a portfolio view.