1 / 25

ISO 31000

ISO 31000. Dorothy Gjerdrum, ARM-P, CIRM Chair, US ISO Technical Adv Group. Why We Need to Manage Risk.

ashanti
Download Presentation

ISO 31000

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. ISO 31000 Dorothy Gjerdrum, ARM-P, CIRM Chair, US ISO Technical Adv Group

  2. Why We Need to Manage Risk The purpose of managing risk is to increase the likelihood of an organization achieving its objectives by being in a position to manage threats and adverse situations and being ready to take advantage of opportunities that may arise. National Guidance on Implementing ISO 31000:2009 From NSAI in Ireland

  3. Global Corporate Governance Models INTERNATIONAL - Basel I & II; ISO 31000 • France • Vienot Com. • Mrini Report • Levy-Long Com. • UK • Cadbury • Turnbull • Greenbury Rpt • BS 31100 RM • All EU Countries • Directives on Governance • Germany • Bill on The Control and Transparency of organizations • Kon TraG Bill • Netherlands • Code Tabaksblatt • Italy • Draghi Commission • US • Business Round Table • NYSE listing Requirements • Blue Ribbon Commission • Sarbanes Oxley Act • COSO ERM Framework • Japan • Corporate Governance Forum of Japan • J-SOX • Australia/New Zeal • AS/NZS 4360:2004 • Stock Exchange Listing • New Accounting Standards • Best Practice Stmt Mgmt • Canada • Toronto Stock Exchange Committee • Canadian Securities Committee • Allen committee Report • COCO • South Africa • Code of Best Practice • King Report I, II, III • Stakeholder Communication • Public Finance Mgmt Act

  4. ISO (International Organization for Standardization) is the world's largest developer and publisher of International Standards. Established in 1947, ISO is a network of the national standards institutes of 159 countries, one member per country, with a Central Secretariat in Geneva, Switzerland, that coordinates the system.

  5. ISO 31000:2009 --> ANSI/ASSE/ISO 31000 • Australia, New Zealand & Japan initiated its creation – based on AS/NZ 4360 • 30+ countries participated • 6 meetings over several years • Adopted in November of 2009, now officially the first International Standard on Risk Management • Guide 73 & ISO 31010 quickly followed • The American Standard on RM – ANSI/ASSE/ISO 31000

  6. CombinedISO 31000 andImplementation Guidance for Canadian organizations: ‘Q31001-11’ • Canada • Placed a stronger emphasis on • senior management support of risk management • Linking risk management to organizational performance • Clarified • Sensitivities in managing risks to the public • Maturity model for risk management in organizations • Risk management process examples • Correct links between risk appetite, risk tolerance and risk rating concepts Available for purchase at www.csa.ca

  7. After Adoption… • BSI 31100 – updated Code of Practice • CSA – Canadian implementation guide • NSAI – Ireland’s implementation guide • Austria – three guidelines: embedding risk management, risk assessment & linking to business continuity processes • Australia & New Zealand – issued handbooks • Japan – created guidance (in Japanese)

  8. 2011: PC 262 formed to Create ISO 31004 • International work group re-engaged to create an implementation guide to ISO 31000 • Two meetings so far – expect two more each year until finalized • Publication date of 2015? – May coincide with the next update of ISO 31000

  9. Primary Audience • Those accountable for the governance of organizations • Those accountable for managing organizations • Practitioners providing advice and services to assist decision-makers • Those who provide assurance regarding the effectiveness of risk management

  10. Scope of ISO 31000 This international standard provides principles and generic guidelines on risk management… it can be used by any public, private or community enterprise, association, group or individual. Therefore, this standard is not specific to any industry or sector.

  11. What is “risk”?? • Risk is present in everything we do. • ISO 31000, the international standard on risk management, defines it this way: Risk = the affect of uncertainty on your objectives. • Risk can be a threat or an opportunity Anything that could harm, prevent, delay or enhance your ability to achieve your objectives = risk

  12. The principles provide the foundation and describe the qualities of effective risk management in an organization Critical Components of ISO 31000 The framework manages the overall process and its full integration into the organization The process for managing risk focuses on individual or groups of risks, their identification, analysis, evaluation and treatment Monitoring & review, continual improvement and communication occur throughout From ANSI/ASSE/ISO 31000

  13. Principles Framework RM Process Mandate & Commitment Establish the context • Creates value • Integral part of organizational processes • Part of decision making • Explicitly addresses uncertainty • Systematic, structured & timely • Based on best available info • Tailored • Takes human & cultural factors into account • Transparent & inclusive • Dynamic, iterative & responsive to change • Facilitates continual improvement & enhancement of the org Risk assessment Design framework for managing risk Risk identification Implement risk management Continually improve the framework Risk analysis Monitor and review Communicate and consult Risk evaluation Monitor and review the framework Risk treatment

  14. Components of the Framework • Understanding the organization & its context • Establishing RM policy • Accountability & Authority • Integration into organizational processes • Determining appropriate resources • Establishing internal communication & reporting mechanisms • Establishing external communication & reporting mechanisms ISO 31000:2009 Risk management – Principles and guidelines

  15. Framework Example: Context External Context • Social, cultural, political, legal, regulatory, financial, technological, economic, natural and competitive environment • Key drivers and trends that will have an impact on your organization • Relationships with and perceptions & values of external stakeholders Internal Context • Governance, organizational structure, roles & accountabilities • Policies, objectives & strategy • Capabilities & resources • Info systems • Organizational culture • Contractual relationships • Relationships with, perceptions & values of internal stakeholders ISO 31000:2009 Risk management – Principles and guidelines

  16. Framework Example: Benefits • Increase likelihood of achieving objectives • Encourage proactive management • Be aware of the need to identify and treat risk throughout the organization • Improve the identification of opportunities & threats • Effectively allocate and use resources • Comply with relevant legal and regulatory requirements and international norms • Improve mandatory and voluntary reporting • Improve operational effectivness & efficiency • Improve stakeholder confidence and trust • Establish a reliable basis for decision making & planning • Improve controls • Improve governance ISO 31000:2009 Risk management – Principles and guidelines

  17. What is Different about ISO 31000? Without risk, there is no reward or progress. Unless risk is managed effectively, organizations cannot maximize opportunities and minimize threats. Risk is all about uncertainty, or more importantly, the effect of uncertainty on the achievement of objectives. This is where ISO 31000 is clearly different from existing guidelines in that the emphasis is shifted from something happening – the event – to the effect on objectives. Kevin W. Knight, AM Chair of the ISO 31000 working group & Chair of ISO 31004 project committee ISO Focus, June 2009

  18. Global Survey on ISO 31000 • Conducted mid-October to mid-December, 2011 • LinkedIn website on ISO 31000, with >6,500 members since March of 2009 • Reached out to 100+ associations, members from 74 associations participated • 1,823 responses from 111 countries • Largest # of participants from US (20%), UK (10%) and Australia (10%) • Primary professions: risk management & IT

  19. Survey Participants

  20. Select Results • 65% - familiar with or knowledgeable about ISO 31000 • 93% of Australian respondents • 67% of UK respondents • 47% of US respondents • 35% - no knowledge • 7% of Australian respondents • 33% of UK respondents • 53% of US respondents

  21. Countries with Highest Level of Awareness of ISO 31000 • Australia (65%) • New Zealand (47%) • Canada (42%) • United Arab Emirates (37%) • Brazil (28%) • South Africa (26%) • Spain (21%) • Netherlands (21%) • United Kingdom (21%) • Finland (18%) • Italy (14%) • France (13%) • USA (11%) “Fully understand ISO 31000”

  22. How is Risk Management Used Within Your Organization? • All decisions (40%) • Auditing/compliance (21%) • Safety/security (18%) • Report performance (9%) • Insurance (7%) • Not used in our organization (5%)

  23. Which Standard Does Your Organization Utilize? • Our own version (40%) • ISO 31000 (36%) • ISO 27005 (20%) • COSO (18%) • PMBOK (17%) • Guide 73 (16%) • AUS/NZ 4360 (13%) • ISO 31010 (13%)

More Related