Better compliance with risk framework ISO 31000? Here’s how.

Part of doing business is accepting uncertainty. Organisations constantly face new economic developments, stricter environmental requirements, availability of goods or materials, personnel shortages, and so on. The better a company deals with these uncertainties, the greater its chance of success in the future. In other words, those who manage risks correctly perform best.

Do you want to do well as a company? Then not only do you manage risks, but you also turn them into opportunities.

Uncertainty in everyday business life can harm business objectives. Yet this is certainly not always the case. When also those risks are found that can have a positive influence, risks can be turned into opportunities. This is how organisations distinguish themselves from others and secure their results and reputation for the future.

So how can organisations approach this properly? For instance, by following the guidelines of the international ISO 31000 standard.

What is the ISO 31000 risk management standard?

With the international ISO 31000 standard, organisations are steering risk management in the right direction. It is the only internationally acknowledged ISO standard in risk management, and it defines risks that can affect financial results, reputation, social environment and safety within companies. Compliance with this standard effectively and positively contributes to the performance of organisations in uncertain environments.

ISO 31000 is an alternative to, for instance, the COSO and RISMAN management models. It provides organisations with a framework containing a set of principles and processes with which these organisations, regardless of sector, size, or business activity, can manage risks. This standard can be applied to many activities within organisations, such as project management, product management, or asset management.

No requirements but guidelines

Whereas other management standards often consist of a set of requirements, ISO 31000 consists of a set of generic guidelines. As a consequence, certification does not exist for entire organisations. Instead, professionals can obtain a personal certificate. This is an objective, written proof that they can work with the methodologies, guidelines, and approaches that fit this standard.

The first version of ISO 31000 dates back to 2007, and it officially came into force in 2009. The latest version was revised in 2018, resulting in the updated standard ISO 31000:2018. This updated guideline has been active since the middle of 2019.

Within the updated ISO 31000:2018 guidelines, the description of the risk management process in relation to the framework has been improved. It is now more clearly described which issues must be included within the scope of various processes:

• The scope at the organisation level is different from that of specific processes;
• While at a higher level, specific circumstances, stakeholders, legislation, and sub-goals are taken into account, at a deeper level, the details have to be filled in;
• The evaluation of risks is also provided with a framework;
• In addition, extra attention is paid to reporting on risk management, for instance, to stakeholders.

What are the 8 ISO 31000 principles?

When updating the old ISO 31000 guidelines began in 2018, a considerable amount of streamlining took place. As a result, directives that were no longer necessary for correct implementation were deleted or moved.

Prior to this streamlining, ISO 31000 consisted of 11 principles. Five principles were dropped during reformulation, after which eight principles remained:

• Integrated: risk management should be integrated into the entire business operation and all activities; 
• Structured and comprehensive: the approach should be well structured and comprehensive; 
• Personalised: the risk management framework should be adapted to the context and objectives within the organisation;  
• Inclusive: all relevant stakeholders are involved in risk management; 
• Dynamic: proactively acting, anticipating risk and properly addressing change is crucial; 
• Best available information: all limitations of available information are taken into account; 
• Human and cultural factors: this is essential and is addressed at every stage. 

What are the benefits of ISO 31000 for companies?

Good risk management according to the ISO 31000 standard has many advantages:

Focus on objectives

When companies can apply best practices around risk assessment, the probability of them achieving their objectives increases;

Cost reduction

When you have a clear, correct understanding of risks, it is easier to make targeted decisions for improvement;

Risk-conscious culture

When an organisation has a risk-aware culture, well-considered decisions are made at every level, for instance, in allocating resources.

Enhanced reputation

When an organisation implements ISO 31000, it indicates that it consciously deals with risks to the outside world. It signals that not only risks are being identified but also analysed and managed. It demonstrates that the organisation is continuously working to improve quality.

Turning risk into opportunity

The revised ISO 31000 standard highlights that risks should not necessarily be seen as negative. Risks can be converted into opportunities, which can positively influence the achievement of objectives.

Excellent scalability

This norm is suitable for all organisations, regardless of size, sector or business activity. Is the organisation growing? If so, there is no need to introduce a new risk analysis or control process, as the ISO 31000 also offers tools for this.

Aligns well with other standards

Consider, for instance, standards like ISO 9001 for quality management and ISO/IEC 27001 for information management.

How do companies implement the risk management standard ISO 31000?

• It provides an umbrella and integration framework for separate management systems for specific risks such as quality, environmental and occupational health and safety management;
• It can bridge the gap between financial and physical risk management. The former is often the domain of controllers and internal auditors, while the latter often lies within the domain of the QSHE manager. By connecting the two, risks are brought into more explicit focus throughout the organisation;
• It can serve as a tool for organisations that are at the beginning of implementing an organisation-wide risk management policy;
• Organisations already well-established concerning risk management can use it as a mirror. It can be used to examine what more can be learned or improved based on ISO 31000.

How does Zenya support compliance with an ISO 31000 risk management process?

If you want to improve compliance, risk management must be not only the responsibility of management or senior management. The entire organisation should be involved to obtain the broadest and most transparent possible overview, and all employees should be able to contribute.

As mentioned earlier, the essence is to identify and evaluate risks and actively deal with them. One way to do this is with control strategies, within which you implement a set of measures. A strategy is determined by management, and the people on the work floor ensure that this strategy is also translated into reality.

As simplistic as it may sound, good risk management depends on the degree of ownership throughout the organisation—a simple matter of getting everyone on the same page and collaboratively working on constant improvement.

The easy-to-use, straightforward interface of the Zenya software makes this possible. Even those without much technical knowledge or ability can work with Zenya, making taking ownership possible for everyone.

Following ISO 31000 guidelines with software

Is your organisation looking for software that will help it comply with the standards of ISO 31000? Zenya can be utilised in the following ways:

• Conduct an audit to check the current state of affairs. With Zenya CHECK you will know exactly how your organisation can learn or improve.
• Do audits lead to improvement actions? With a custom workflow in Zenya FLOW you can define workflows and inform the right people at the right time. This way, everyone knows exactly what is expected and when.
• Set up notifications to remind employees at the right time. This will simplify your life because it saves you from chasing after people.
• Is it unclear which protocols and work instructions belong to a certain workflow? Store it in Zenya DOC so employees can quickly and efficiently look up the information themselves.
• Do you want to see which improvement actions have been implemented and what the impact was on the risks? Use the transparent reports and real-time dashboards within Zenya RISK.