Risk, Risk and More Risk

Can you hear it?Can you hear it? That buzzing sound!

Can you hear it? That buzzing sound!

The buzz I’ve been hearing is about ISO 31000, the new Risk Management Standard from the International Standards Organization. Then again, my wife continues to remind me that I’m hard of hearing.

Search for the phrase “risk assessment” with Google and you’ll get over 11.5 million hits. And if you’re a risk manager trying to choose a risk methodology, you have many to pick from (this is not a complete list):

With all of these risk assessment methodologies available, why was it such a big deal when ISO introduced a new standard earlier this year?  ISO 31000 was adapted from the very successful and widely accepted AS/NZS 4360 Standard, but it has been refined and consolidated making ISO 31000 even more effective than the existing AS/NZS standard.

The new standard has been widely praised by industry analysts and experts:

  • One of the big draws for Arnold H. Schanfield is that it’s short and to the point. ISO 31000 is only 34 pages long, as compared to COSO ERM which has over 125 pages and 116 pages for AS/NZS 4360.

  • One of the things Michael Rasmussen likes is the simple but effective risk definition “effect of uncertainty on objectives.”

  • Dan Markiewicz writes that people are excited because it “brings together a global consensus on risk management.” That includes all forms of risk management, such as financial, security, safety, health and environment.

After reading numerous articles on this topic, the common thread that authors seem to agree on is that ISO 31000 is simple and adaptable. From what I’ve read, it’s possible that ISO 31000 will be the risk management framework that harmonizes risk management processes in existing and future standards.

Michael Rasmussen summarizes that point very well:

“ISO 31000 provides a risk management approach that can be used across the silos/domains of risk scattered across the organization. It is just as relevant to areas such as legal risk management as it is to information security, quality, or environmental, health & safety.”

This reminds me of a famous quote by Albert Einstein:

“Any fool can make things bigger, more complex…  It takes a touch of genius – and a lot of courage to move in the opposite direction.”

What do you think about the new ISO 31000 standard?  Will you be considering it for your organization?  Feel free to share your reactions in comments to this post.

Written by

Mike Hoefgen

Mike Hoefgen has been helping clients solve business problems for over 20 years. Mike is…

Published in

View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!

  • http://www.sheistocktips.com/ SHRISTOCKTIPS

    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website. http://goo.gl/sMgZ7n



  • king lear

    testing comment functionality, please do not publish this

  • http://www.rachelmacik.com Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • http://www.linkedin.com/in/michelehudnall Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.

    Nice Post and Timely!


    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.