Risk management standards

Since the early 2000s, several industry and government bodies have expanded regulatory compliance rules that scrutinize companies’ risk management plans, policies and procedures. In an increasing number of industries, boards of directors are required to review and report on the adequacy of enterprise risk management processes. As a result, risk analysis, internal audits and other means of risk assessment have become major components of business strategy.

Risk management standards have been developed by several organizations, including the National Institute of Standards and Technology and the ISO. These standards are designed to help organizations identify specific threats, assess unique vulnerabilities to determine their risk, identify ways to reduce these risks and then implement risk reduction efforts according to organizational strategy.

The ISO 31000 principles, for example, provide frameworks for risk management process improvements that can be used by companies, regardless of the organization’s size or target sector. The ISO 31000 is designed to “increase the likelihood of achieving objectives, improve the identification of opportunities and threats, and effectively allocate and use resources for risk treatment,” according to the ISO website.  Although ISO 31000 cannot be used for certification purposes, it can help provide guidance for internal or external risk audit, and it allows organizations to compare their risk management practices with the internationally recognized benchmarks.

The ISO recommended the following target areas, or principles, should be part of the overall risk management process:

• The process should create value for the organization.
• It should be an integral part of the overall organizational process.
• It should factor into the company’s overall decision-making process.
• It must explicitly address any uncertainty.
• It should be systematic and structured.
• It should be based on the best available information.
• It should be tailored to the project.
• It must take into account human factors, including potential errors.
• It should be transparent and all-inclusive.
• It should be adaptable to change.
• It should be continuously monitored and improved upon.

The ISO standards and others like it have been developed worldwide to help organizations systematically implement risk management best practices. The ultimate goal for these standards is to establish common frameworks and processes to effectively implement risk management strategies.

These standards are often recognized by international regulatory bodies, or by target industry groups. They are also regularly supplemented and updated to reflect rapidly changing sources of business risk. Although following these standards is usually voluntary, adherence may be required by industry regulators or through business contracts.

Risk management strategies and processes

All risk management plans follow the same steps that combine to make up the overall risk management process:

• Risk identification. The company identifies and defines potential risks that may negatively influence a specific company process or project.
• Risk analysis. Once specific types of risk are identified, the company then determines the odds of it occurring, as well as its consequences. The goal of the analysis is to further understand each specific instance of risk, and how it could influence the company’s projects and objectives.
• Risk assessment and evaluation. The risk is then further evaluated after determining the risk’s overall likelihood of occurrence combined with its overall consequence. The company can then make decisions on whether the risk is acceptable and whether the company is willing to take it on based on its risk appetite.
• Risk mitigation. During this step, companies assess their highest-ranked risks and develop a plan to alleviate them using specific risk controls. These plans include risk mitigation processes, risk prevention tactics and contingency plans in the event the risk comes to fruition.
• Risk monitoring. Part of the mitigation plan includes following up on both the risks and the overall plan to continuously monitor and track new and existing risks. The overall risk management process should also be reviewed and updated accordingly.

Risk management approaches

After the company’s specific risks are identified and the risk management process has been implemented, there are several different strategies companies can take in regard to different types of risk:

• Risk avoidance. While the complete elimination of all risk is rarely possible, a risk avoidance strategy is designed to deflect as many threats as possible in order to avoid the costly and disruptive consequences of a damaging event.
• Risk reduction. Companies are sometimes able to reduce the amount of effect certain risks can have on company processes. This is achieved by adjusting certain aspects of an overall project plan or company process, or by reducing its scope.
• Risk sharing. Sometimes, the consequences of a risk is shared, or distributed among several of the project’s participants or business departments. The risk could also be shared with a third party, such as a vendor or business partner.
• Risk retaining. Sometimes, companies decide a risk is worth it from a business standpoint, and decide to retain the risk and deal with any potential fallout. Companies will often retain a certain level of risk a project’s anticipated profit is greater than the costs of its potential risk.