Taking a More Formal Approach to Your Risk Management

2 February 2016 by Philippe Wanson in Cyber Security, 0 comment(s)

We face risks all the time but we have learned to manage them by making smart decisions, both in our personal lives and in our professional environment. The question is, are we really making the smartest decisions to fully protect our companies?

Increase your performance

We know that risks can significantly impact a company’s financial prospects as well as damage its reputation. Analysing and managing risks effectively allows you to anticipate problems before they occur, so saving you time and money. In an uncertain world, risk analysis can increase the performance of your organization.

Pick the right process

There are many risk management options, so picking the right one may be difficult. The best option for ensuring that your company complies with the most recent legislation, sector regulations, customer and supplier contracts and any internal agreements is probably ISO 31000.

A generic standard

ISO 31000 is an international generic risk management standard that provides principles, a framework and a process for managing risk. Its approach can be adapted to develop guidelines tailored to your company to assess existing risk management methods. The standard also provides a foundation for implementing other ISO risk management standards and guidelines.

ISO 31000 is dynamic and responsive to change because it was designed to be applied to all sectors (banking, industrial, public, etc.), no matter what kind of organization you run, what type of services you sell or where you are located.

Easy enough

ISO 31000 was published in 2009 and remains the international standard for risk management. Its 34 pages include a terminology list (ISO Guide 73) that explicitly identifies all possible risks, making it accessible and easy to understand for everyone. It also has a guide on how to apply risk assessment techniques (ISO/IEC 31010), allowing your company to continuously protect and increase its value in a systematic and structured way.

ISO 27005 or ISO 31000?

An alternative standard is ISO 27005, which provides guidelines for managing risks that could threaten an organization’s information security. Although ISO 27005 and ISO 31000 are similar in structure and methodology, ISO 31000 is more general and provides guidelines that can be applied to any area of risk management in an organiszation.

ISO 31000 or COSO?

ISO 31000 defines risk as the “effect of uncertainty on objectives”, so it takes into account that risks can have positive effects as well as negative ones. COSO has also developed guidance for risk management, but it focuses on the analysis of events rather than the consequences of events for an organization. Comparing ISO 31000 with COSO’s guidance shows that ISO 31000 offers a range of benefits because …

It is more practical
It provides more details
It explicitly defines the terms
It is more clearly written and easier to understand for CXOs and risk professionals
It contains information that can be adapted to develop guidelines to assess existing risk management methodologies
It provides a foundation for implementing other ISO risk management standards and guidelines
It creates and protects value
It is an integral part of all organizational processes
It is part of the decision-making process
It explicitly addresses uncertainty
It is systematic, structured and timely
It is based on the best available information
It can be tailored to your needs
It takes human and cultural factors into account
It is transparent and inclusive
It is dynamic, iterative and responsive to change
It facilitates continual improvement of the organisation.