ISO 31000 and Risk Management - drj.com

ISO 31000 and Risk Management

Copyright 2010 Assura, Inc. All rights reserved.

August 19, 2010

What is risk?What is risk?

All management is risk management!


All management is risk management!

Ri k M tRisk Management “Boot camp”

Threat + Vulnerability = Risk

Risk Controls = Residual RiskRisk – Controls = Residual Risk

Residual Risk Probability + Residual Risk Impact = Risk Rating


Ri k TRisk Types

• Strategic Risks – Inherent risks of doing business, going after new markets, regulatory

• Finance Risks – Treasury risks, credit risks, trading risks

• Operations Risks –People, compliance, process

• Information Risks –Operational and


Technological risks

About controls…

Control Types Control CategoriesControl Types• Preventive• Detective

Control Categories• Administrative• TechnicalDetective

• CorrectiveTechnical

• Personnel• Physical


How do you manage and track risks?

• Enterprise Risk Management– What is it?

ERM is establishes the oversight, control and discipline to drive continuous improvement of an entity’s risk management capabilities in a changingentity s risk management capabilities in a changing operating environment.

– Who is involved?Everyone in the organization and the Board


And you should care becauseAnd you should care because…


Recent History of ERM• Cadbury Committee (UK) (1992)• Chief Risk Officer created at GE

(1992)• AS/NZS 4360:1995 (revised 1999,

2004) released – first ever ERM standard

• 9/11 and collapse of Enron• 9/11 and collapse of Enron resulting in Sarbanes-Oxley Act (2000)

• International Standards Organization (ISO) forms an international working group to write a global guideline of managing risk released 2009


managing risk – released 2009.

Global Corporate Governance Models

All EU Countries• Directives on

Governance

Netherlands• Code Tabaksblatt

UK• Cadbury• Turnbull

G b R t

France• Vienot Com.• Mrini Report

Italy• Draghi

Commission

Germany• Bill on The Control

and Transparency

INTERNATIONAL - Basel I & II; ISO 31000 & 31010

• Greenbury Rpt• BS 31100 RM

p• Levy-Long Com.

Canada• Toronto Stock

Japan• Corporate Governance

p yof organizations• Kon TraG Bill

Australia/New Zeal• AS/NZS

Toronto Stock Exchange Committee

• Canadian Securities Committee

• Allen committee Report

Governance Forum of Japan

• J-SOX

• AS/NZS 4360:2004

• Stock Exchange Listing

• New Accounting Standards

US• Business Round Table

• NYSE listing Requirements

• COCO

• Best Practice Stmt Mgmt

Requirements• Blue Ribbon

Commission• Sarbanes Oxley Act

• COSO ERM Framework

South Africa• Code of Best Practice• King Report I, II and III Source: RIMS org


King Report I, II and III • Stakeholder Communication

• Public Finance Mgmt Act

Source: RIMS.org

Risk Management Frameworksg

• Organizational • Information Technology Focused (supports

Which one is best for your organization?

– Committee of Sponsoring Organizations of the TreadwayCommission (COSO) Enterprise Risk Management Internal Framework (ERM IF)

Organizational)– Control Objectives for Information and

related Technology (COBIT from ISACA) G id t A t f IT Ri k (GAIT(ERM-IF)

– Risk and Insurance Management Society (RIMS) Risk Maturity Model (RMM) for Enterprise Risk Management

– Guide to Assessment of IT Risk (GAIT from IIA)

g– Australian/New Zealand Standard

(AZ/NZA 4360:2004)– ISO 31000:2009 (Replaced AZ/NZA

4360:2004)• Risk Management Publications

• BS 31100:2008 and ISO 31000:2009 • ISO guide 73 risk management – vocabulary • ISO 31010 risk assessment techniques


ISO 31000 Risk Management –gPrinciples and Guidelines• Provides a very general and

flexible framework for best practices in ERMI t COSO PMI• Incorporates COSO, PMI (Project Management Institute, and AS/NZS4360:2004

• Built on the premise that risk management is fully integrated into the

i ti d t f llorganization and part of all decisions

• Allows for management of negative and positive risk


negative and positive risk

ISO 31000 10 Basic PrinciplesISO 31000 10 Basic Principles

1. Creates value – not focused on loss

2. Integral part of the i ti i j torganization – in project

management, strategic planning, etc.

3 Decision making through3. Decision making through analysis and evaluation to understand risk

4. Explicitly addresses p yuncertainty and how it can be modified

5. Systematic, structured, timely repeatable


timely, repeatable

10 Basic Principles (Cont.)

6. Based on available information – historic data, expert opinion.

7 Big or small – tailored to the7. Big or small – tailored to the organization

8. Includes human, cultural as well as technical factors that impact likelihood ofimpact likelihood of consequences

9. Transparent and inclusive –communication and consultation with stakeholders

10. Incorporates continuous improvement and responds


p pto changing environment

ERM Framework

• 31000 focuses on the framework that supports the Risk Management Process(es) or RMPProcess(es) or RMP

• Does not specify components, but gives conceptual guidancep g

• Aggregates information on risks, risk management, and performance of risk controls

• Must be practical and part of existing processes


ERM Framework Components“Th L k 7”“The Lucky 7”

1. Mandate and commitment to the ERM framework

5. Communications and reporting

6 A t bilitERM framework2. Risk management

policy

6. Accountability7. Monitoring, review,

and continuouspolicy3. Integration of ERM

in the organization

and continuous improvement (Plan, Do Check Act)in the organization

4. Risk Management Process (RMP)

Do, Check, Act)


Process (RMP)


Source: RIMS.org

Risk Management ProcessE t bli hi th C t tE t bli hi th C t tEstablishing the ContextEstablishing the Context

Risk Management Risk Management environment definedenvironment definedRisk Management Risk Management

environment definedenvironment definedRisk Appetite/Tolerance Risk Appetite/Tolerance

Should Should Be DefinedBe DefinedRisk Appetite/Tolerance Risk Appetite/Tolerance

Should Should Be DefinedBe DefinedInternal and External Internal and External

ContextContextInternal and External Internal and External

ContextContext Risk Mgmt. ContextRisk Mgmt. ContextRisk Mgmt. ContextRisk Mgmt. Context

Risk AssessmentRisk AssessmentRisk IdentificationRisk IdentificationRisk IdentificationRisk Identification Risk AnalysisRisk AnalysisRisk AnalysisRisk Analysis Risk EvaluationRisk EvaluationRisk EvaluationRisk Evaluation

Treat RiskTreat RiskIdentify control optionIdentify control optionIdentify control optionIdentify control option Select control optionSelect control optionSelect control optionSelect control option Implementation of controlImplementation of controlImplementation of controlImplementation of control

Monitor and ReviewMonitor and Review

Communicate and ConsultationCommunicate and ConsultationOngoing Tracking and MonitoringOngoing Tracking and MonitoringOngoing Tracking and MonitoringOngoing Tracking and Monitoring


How To Leverage BC in an ERM ProcessERM Process

Enterprise Risk Managementp g

ning

ec.

TooToo Risk Management Risk Management

ProcessProcess

rg. P

lann

Con

trols

pera

tions

sast

er R

e

Sec

urity

ls to leverals to levera

ProcessProcess

Risk Mgmt. PolicyRisk Mgmt. Policy

OO

P/E

me

nanc

ial C

sine

ss O

p

curit

y/ D

is

hysi

cal S

age for inteage for inte

Business Impact Business Impact AnalysisAnalysis

BC

/CO Fi

n

Bus

IT S

ec Ph egration

egration Risk AssessmentRisk Assessment


Analyze Risk: Risk Mapping (a k a Heat Map)(a.k.a. Heat Map)

Secondary RisksSecondary Risks Key RisksKey RisksHigh

•• Lower likelihood, but could Lower likelihood, but could have significant adverse impact on have significant adverse impact on

business objectivesbusiness objectives

•• Critical risks that potentially threaten Critical risks that potentially threaten the achievement of business the achievement of business

objectivesobjectives

pact

)

Low Priority RisksLow Priority Risks Secondary RisksSecondary Risksance

(Im

•• Significant monitoring not necessary Significant monitoring not necessary unless change in classificationunless change in classification

•• Periodically reassessPeriodically reassess

•• Lesser significance, but more likely to Lesser significance, but more likely to occuroccur

•• Consider cost/benefit tradeConsider cost/benefit trade--offoff•• Reassess often to ensure changing Reassess often to ensure changing

diti ( t hi h i ifi )diti ( t hi h i ifi )

Sign

ifica

conditions (move to high significance)conditions (move to high significance)

Low Likelihood (Probability) High


Source: www.knowledgeleader.comLikelihood (Probability) g

Risk Ratings Other typesRisk Ratings – Other types

RISK IMPACT

FREQUENCY OF OCCURANCE/ PROBABILITY

RISK IMPACT

IV(Catastrophic or Emergency)

III(Critical or High)

II(Marginal or Medium)

I(Negligible or Low) Emergency) ) )

4 (Frequent) 8 7 6 5

3 (Probable) 7 6 5 4

2 (Occasional) 6 5 4 3

1 (Remote) 5 4 3 2

0 (Improbable) 4 3 2 1


Evaluate Risks:Types of Risk Decisions

• Avoidance - a decision not to become involved in, or to withdraw from, a risk situation.situation.

• Acceptance: acceptance of the burden of loss, or benefit of gain, from a particular risk.Reduction: actions taken to• Reduction: actions taken to lessen the likelihood, negative, or both, associated with a risk.S f• Sharing of risk: sharing with another party the burden of loss, or benefit of gain from a particular risk.


Monitor Risk: Tracking the Risk

• Risk Register (Keep It Simple!)

Id tifi d Ri k ith– Identified Risk with Description

– Risk Category (Type g y ( ypof Risk)

– Risk Score (Residual Risk Probability +Risk Probability Residual Risk Impact)

– Risk OwnerRi k D i i


– Risk Decision

Perceived Deficiencies with ISO 31000

Risk management policies, roles and responsibilities I ffi i t d t il f i k hit t t t t l• Insufficient detail of risk architecture, strategy, protocols

Risk management principles • Confusion between what risk management is and what it• Confusion between what risk management is and what it

delivers Risk management specialist areas no included • Project risk management and clinical risk management Risk governance • No mention of “risk appetite”• Lack of detail for risk reporting and auditing controls


Source: RIMS.org

Final Thoughts…g• Start Small – Document and

obtain agreement on theobtain agreement on the Risk Appetite –“Establishing the Context”

• There are no “right” and “wrong” answers to every risk. Make the best decision you can with the most available data!E ll t f th• Engage all parts of the organization!


K L C l CBCP SBCIKaren L. Cole, CBCP, SBCI Assura, Inc.,

804.672.8714K l @ [email protected]

www.assuraconsulting.com


g

Date post:	09-Jan-2022
Category:	Documents
Upload:	others
View:	7 times
Download:	0 times

ISO 31000 and Risk Management - drj.com

Documents