Pass the GAQM GAQM: ISO ISO-31000-CLA Questions and answers with CertsForce

ISO 31000:2018 risk management process is descriptive6. This means that it provides guidance on what should be done for effective risk management, but not how it should be done. The process can be customized to any organization and its context.

According to ISO/IEC Guide73 (2009), clause B., causes are “elements which alone or in combination have potential to give rise to risk”. Health, safety, environment, finance andchemical breakdown are examples of causes that can create risks for an organization or an individual 1. Insurance is not a cause but a method of transferring or mitigating some types of risks 1.

Communication with stakeholders, customers, and interested parties is an essential element for maintaining the relevance of enhanced risk management within the structure of a changing context3. Communication helps to establish trust, transparency, accountability, and feedback mechanisms for risk management.

According to 1, OCEG GRC model is “a framework for integrating governance, risk management, compliance and ethics/culture into a single capability”. It defines risk management as “the capability that enables an organization to understand how uncertainty affects its ability to achieve objectives” 2.

According to page 9-10 of source 2, risk management professionals organize internal and external information about the organization into categories such as stakeholders, strategic objectives, policies and procedures, risk appetite and tolerance, and risk culture. This categorization process facilitates the analysis and reporting of the risk information at a later stage, making it easier to understand and use.

According to page 12 of the source, risk management professionals conduct supply chain analysis to identify potential vulnerabilities to the organization. These vulnerabilities can arise due to supplier dependency, breakdowns or disruptions in the supply chain, natural or human-made disasters, political or social instability, cyberattacks or other threats. Identifying such risks is crucial to prevent adverse impacts on the organization's operations, reputation or financial position.

There are nine risk management principles in ISO 31000:2018. These principles are:

Integrated

Structured and comprehensive

Customized

Inclusive

Dynamic

Best available information

Human and cultural factors

Continual improvement

According to , page 7-8, one of the roles of risk management in the strategic planning process is to identify threats and opportunities that could affect the organization’s objectives and performance.

Records and reports provide a continuing account of the risk management system2. They help to monitor and review the performance and effectiveness of risk management.

According to , page 4, a holistic approach to risk management is “one that considers all sources and types of risks across all organizational units and activities”. It aims to integrate governance, strategy, performance, culture and ethics into a coherent framework for managing uncertainty 2.