Beruflich Dokumente
Kultur Dokumente
CHAIRMAN
ISO WORKING GROUP - RISK MANAGEMENT STANDARD
MEMBER
STANDARDS AUSTRALIA / STANDARDS NEW ZEALAND
JOINT TECHNICAL COMMITTEE OB/7 - RISK MANAGEMENT
2. Type of deliverable
The standard to be developed is a
Guideline document, and is
NOT to be used for the
purpose of certification.
ISO Guide 73:2009 - Scope
• provides a basic vocabulary of the definitions
of generic terms related to risk management
Well-defined Poorly
outcomes defined
outcomes
KNOWLEDGE “INCERTITUDE”
ABOUT
LIKELIHOODS
risk attitude
organization's approach to assess and eventually pursue, retain, take
or turn away from risk
risk appetite
amount and type of risk that an organization is prepared to pursue,
retain or take
risk tolerance
organization's or stakeholder's readiness to bear the risk after
treatment in order to achieve its objectives
NOTE Risk tolerance can be influenced by legal or regulatory requirements.
risk aggregation
consideration of risks in combination
risk acceptance
informed decision to take a particular risk
NOTE 1 Risk acceptance can occur without risk treatment or during the
process of risk treatment.
NOTE 2 Accepted risks are subject to monitoring and review.
risk retention
acceptance of the potential benefit of gain, or burden of loss, from a
particular risk
NOTE 1 Risk retention includes the acceptance of residual risks
NOTE 2 The level of risk retained can depend on risk criteria.
resilience
adaptive capacity of an organization in a complex and changing
environment
risk profile
description of any set of risks
NOTE The set of risks can contain those that relate to the whole
organization, part of the organization, or as otherwise defined.
AS/NZS ISO 31000:2009 Figure 1 – Relationship between the principles, framework and process
Corporate Governance
The way in which an organisation is governed and controlled in order
to achieve its objectives. The control environment makes an
organisation reliable in achieving these objectives within a tolerable
degree of risk.
SAA HB 254-2005
Governance, risk management and control assurance
Standards Australia. ISBN 0 7337 6892 X
ACCOUNTABILITY
SUPERVISION
Potential greater GOVERNANCE
future role of risk
management
STRATEGIC
MANAGEMENT
Traditional and current MANAGEMENT
risk management EXECUTIVE
application MANAGEMENT
DECISION & CONTROL
OPERATIONAL MANAGEMENT
Act Do
Organise and Allocate
Measure and review Board RM Committee
Control assurance Exec RM Committee
RM Plan progress Manager, RM
Governance reporting RM Champions
Benchmarking
Performance criteria Check Risk, Control, Risk
owners
Assurance providers
Clause 4 (framework)
• The framework in Clause 4 of AS/NZS
ISO 31000:2009 is not intended to
describe a management system; but
rather, it is to assist the organization
to integrate risk management within
its overall management system.
AS/NZS ISO 31000:2009 Figure 2 — Relationship between the components of the framework for managing
risk
AS/NZS ISO 31000:2009 Risk
management process (Clause 5)
• should be an integral part of
management, be embedded in culture
and practices and tailored to the
business processes of the organization.
• includes five activities: communication
and consultation; establishing the
context; risk assessment; risk
treatment; and monitoring and review.
AS/NZS ISO 31000:2009
Process Overview
C
O ESTABLISHING THE CONTEXT
M
M M
U
O
N
I RISK IDENTIFICATION N
C I
A
T
T
I O
O RISK ANALYSIS R
N
&
RISK ASSESSMENT &
RISK EVALUATION R
C
O E
N V
S
I
U RISK TREATMENT
L E
T W
I
O
N
24
5.3 ESTABLISHING THE CONTEXT
5.3.2 External Context
5.3.3 Internal Context
5.3.4 Risk Management Process Context
5.2 5.3.5 Developing Risk Criteria
C 5.6
O
M 5.4.2 RISK IDENTIFICATION M
M What can happen, when, where, how & why
U A O
N S N
I 5.4.3 RISK ANALYSIS
5.4 S I
C Determine existing controls
T
A
R Determine Determine E
T Likelihood Consequences O
I I S R
O
S
Estimate Level of Risk S
N
K M &
&
E
C 5.4.4 RISK EVALUATION R
O N E
Compare against criteria.
N
Identify & assess options. T V
S
Decide on response.
U I
L Establish priorities.
E
T
A W
T
I
5.5 RISK TREATMENT
O 5.5.2 Selection of risk treatment options
N 5.5.3 Preparing and implementing risk
treatment plans
SURVIVAL IS NOT
COMPULSORY
The greatest risk of all
is to take no risk at all!
The Journey Continues
Opportunities Risks
O E
N W
S 7. Manage the Risk
U
Culture Communication
L
T