12.13: Risk Management Standards

There are a number of risk management standards designed to consolidate best practice principles and help to streamline and improve risk management implementations for businesses. Another factor driving the standardization of risk management frameworks has been the increased scrutiny that organizations must face with regard to their risk management systems. Risk management systems are often required to stand up to rigorous internal audits and assessments in order to prove that they are effective in their implementation and that they are in line with company goals and objectives.

The family of risk management standards defined by ISO 31000 is one such example of a leading international standardization of a risk management approach.^[1]

ISO refers to the International Organization for Standardization; the 31000 portion refers to a family of standards for risk management. As well as being an umbrella term for a bunch of different standards, ISO 31000 also refers to a singular standard, specifically known as ISO 31000:2018. This standard defines a set of guidelines for managing risk, designed to be used by organizations of any size, working in any area, to implement effective risk management systems. Unlike many other ISO standards, like 9001 for quality management or 14001 for environmental management, ISO 31000 is a set of guidelines. That means you can’t get an ISO 31000 certification in the same way you could for other standards with specific requirements. Nonetheless, ISO 31000 is a leading framework for organizations seeking to identify, assess, and manage risk with the intention of improving decision-making, governance, and performance.^[2]

There are several standards organizations and committees that have developed risk management frameworks, guidance, and approaches that business teams can leverage and adapt for their own company.^[3]

Some of the more popular risk management frameworks include:

• ISO 31000 Family: The International Standards Organization’s guidance on risk management is broad and adaptable to various sectors and industries.
• NIST Risk Management Framework (RMF): The National Institute of Standards and Technology has released risk management guidance compatible with their Cybersecurity Framework (CSF).
• COSO Enterprise Risk Management (ERM): The Committee of Sponsoring Organizations’ enterprise risk management guidance. COSO ERM is highly strategic and focuses on aligning risk with organizational objectives.
• PMBOK and RIMS are more suited for project and insurance-related risks, respectively.
• FERMA and BS 31100 are more region-specific but still provide valuable guidelines for broader risk management practices.
• The AIRMIC/IRM/ALARM Risk Management Standard is widely used in the UK to manage risks.

Each of these frameworks provides valuable insights and methods for organizations to manage risks effectively, but the choice of framework depends on the organization’s industry, structure, and specific risk management needs.