IEC 31010:2019 Risk management — Risk assessment techniques provides guidance on the selection and application of techniques for assessing risk in a wide range of situations. The techniques are used to assist in making decisions where there is uncertainty, and to provide information about individual risks as part of a risk management process.
The standard summarises a range of techniques, with references to other documents where the techniques are described in more detail.
What does it cover?
| Foreword |
| Introduction |
| 1 Scope |
| 2 Normative references |
| 3 Terms and definitions |
| 4 Core concepts |
| 4.1 Uncertainty |
| 4.2 Risk |
| 5 Uses of risk assessment techniques |
| 6 Implementing risk assessment |
| 6.1 Plan the assessment |
| 6.1.1 Define purpose and scope of the assessment |
| 6.1.2 Understand the context |
| 6.1.3 Engage with stakeholders |
| 6.1.4 Define objectives |
| 6.1.5 Consider human, organizational and social factors |
| 6.1.6 Review criteria for decisions |
| 6.2 Manage information and develop models |
| 6.2.1 General |
| 6.2.2 Collecting information |
| 6.2.3 Analysing data |
| 6.2.4 Developing and applying models |
| 6.3 Apply risk assessment techniques |
| 6.3.1 Overview |
| 6.3.2 Identifying risk |
| 6.3.3 Determining sources, causes and drivers of risk |
| 6.3.4 Investigating the effectiveness of existing controls |
| 6.3.5 Understanding consequences, and likelihood |
| 6.3.6 Analysing interactions and dependencies |
| 6.3.7 Understanding measures of risk |
| 6.4 Review the analysis |
| 6.4.1 Verifying and validating results |
| 6.4.2 Uncertainty and sensitivity analysis |
| 6.4.3 Monitoring and review |
| 6.5 Apply results to support decisions |
| 6.5.1 Overview |
| 6.5.2 Decisions about the significance of risk |
| 6.5.3 Decisions that involve selecting between options |
| 6.6 Record and report risk assessment process and outcomes |
| 7 Selecting risk assessment techniques |
| 7.1 General |
| 7.2 Selecting techniques |
| Annex A (informative) Categorization of techniques |
| A.1 Introduction to categorization of techniques |
| A.2 Application of categorization of techniques |
| Annex B (informative) Description of techniques |
| B.1 Techniques for eliciting views from stakeholders and experts |
| B.2 Techniques for identifying risk |
| B.3 Techniques for determining sources, causes and drivers of risk |
| B.4 Techniques for analysing controls |
| B.5 Techniques for understanding consequences and likelihood |
| B.6 Techniques for analysing dependencies and interactions |
| B.7 Techniques that provide a measure of risk |
| B.8 Techniques for evaluating the significance of risk |
| B.9 Techniques for selecting between options |
| Bibliography |
Implementation
Implementing risk management in an organization in accordance with ISO 31000 and IEC 31010 involves several key steps.
Establish the Context
- Define the external and internal context relevant to risk management.
- Consider the organizational objectives, stakeholders, and the risk management scope.
Define Risk Management Policy and Objectives
- Develop a risk management policy that aligns with the organization’s overall objectives.
- Set specific and measurable risk management objectives.
Integrate with Organizational Processes
- Ensure that the risk management process is integrated into the organization’s governance and management functions.
- Align risk management with other organizational processes and activities.
Assign Roles and Responsibilities
- Clearly define roles and responsibilities for individuals involved in the risk management process.
- Ensure that everyone understands their role in managing risks.
Communicate and Consult
- Establish effective communication channels for risk-related information.
- Consult with internal and external stakeholders to gather diverse perspectives on risks.
Establish the Risk Management Framework
- Develop a risk management framework that includes policies, processes, and tools.
- Define the criteria for risk assessment and decision-making.
Identify Risks
- Systematically identify risks that could affect the achievement of objectives.
- Consider both internal and external sources of risk.
Risk Assessment
- Evaluate the likelihood and impact of identified risks.
- Prioritize risks based on their significance to the organization.
Risk Treatment
- Develop and select appropriate risk treatment options.
- Prioritize actions to address and mitigate identified risks.
Monitor and Review
- Establish a monitoring and review process to track the effectiveness of risk treatments.
- Regularly review risk assessments and update risk information.
Record and Document
- Document the entire risk management process, including risk identification, assessment, and treatment.
- Maintain records of decisions, actions, and outcomes.
Continual Improvement
- Implement processes for continual improvement of the risk management framework.
- Learn from past experiences and adjust the risk management approach accordingly.
Training and Awareness
- Provide training to personnel involved in the risk management process.
- Raise awareness of the importance of risk management across the organization.
Review the Risk Management Framework
- Periodically review the risk management framework to ensure its relevance and effectiveness.
- Update the framework based on changes in the organization’s context.
Report and Communicate Results
- Develop a reporting mechanism for communicating risk-related information.
- Share relevant risk information with stakeholders, including successes and challenges.
Establish a Risk Culture
- Foster a risk-aware culture within the organization.
- Encourage open communication about risks and the importance of managing them effectively.
Review External and Internal Context
- Regularly review the external and internal context to identify emerging risks.
- Consider changes in the business environment, technology, regulations, and other factors.
Legal and Other Requirements
Identify and ensure compliance with relevant legal and regulatory requirements related to risk management.
Integration with Decision-Making
- Integrate risk considerations into the organization’s decision-making processes.
- Ensure that risk assessments inform strategic and operational decisions.
In conclusion…
Remember, the implementation of risk management is an ongoing process. Organizations should regularly review and update their risk management practices to ensure they remain effective in addressing the evolving challenges and opportunities in the business environment.
ISO 31010 can be purchased through the ISO.org website.
Comments (0)