ISO 31000 – Risk management

Benefits of ISO 31000 on risk management

Transparent, systematic and reliable risk management in any field or context:

  • It creates and protects the organisation’s value by ensuring that risk management is transparent and inclusive, explicitly addressing uncertainty.
  • It facilitates the organisation’s continuous improvement by ensuring that risk management is an integral part of decision-making.
  • Minimises risks by integrating risk management into all the organisation’s processes in a systematic, structured and timely manner, taking human and cultural factors into account.
  • Supports innovation. Risk management is dynamic, iterative and responsive to change, tailored to each organisation and based on the best available information.
  • Easy to integrate into an integrated management system. The ISO 31000 standard on risk management is compatible with ISO 9001 for quality, ISO 14001 for environmental management and ISO 45001 for occupational health and safety.

Strategic consultancy in management systems

  • An ISO certificate that incorporates the requirements of the ISO 31000 standard on risk management.
  • Strategic outsourcing to integrate the strategy into the ISO certificate and outsource the duties of the System Manager.
  • Internal ISO audit, taking into account the requirements of ISO 31000 on risk management.

ISO 31000 requirements for risk management

The ISO 31000 standard provides principles and guidelines on risk management and can be applied to any industry or sector. Among the standard’s requirements for risk management, we highlight the following:

  • Establishment of the internal and external context. Where appropriate, we emphasise that the following must be taken into account: integration with corporate governance; organisational culture, code of conduct, ethical principles and values; staff and supplier selection processes; and the level of risk assumed by the organisation.
  • Planning the fraud risk management system. We highlight that this involves:
    • Anti-fraud policy and directives from senior management
    • The anti-fraud strategy establishing a fraud risk management programme
    • Conducting a periodic assessment of the level of exposure to fraud
    • Implementing prevention techniques (prevention and impact mitigation)
    • Implementing a reporting process (investigation and corrective actions) or
    • Business ethics (which can be linked to ISO 26000)
    • Periodic review and updating
    • Procedures for prevention, detection and investigation.
  • Roles and responsibilities in fraud risk management, covering both internal and external stakeholders.
  • Risk identification. Once risks have been identified, their likelihood and impact must be analysed in order to prioritise those that require appropriate action and management.
  • Communication and consultation based on internal and external communication plans.
  • Review and monitoring of the Fraud Control Plan based on the results of indicators and objectives. It also requires an internal and external audit of the adequacy and effectiveness of anti-fraud controls.

The ISO 31000 standard is not certifiable, although it can be integrated into other ISO certificates.