Executive's Guide to Cyber Risk

Appendix B: Risk Management: ISO 31000¹

WE LIVE IN AN ever-changing world where we are forced to deal with uncertainty every day. But how an organization tackles that uncertainty can be a key predictor of its success.

Risk is a necessary part of doing business, and in a world where enormous amounts of data are being processed at increasingly rapid rates, identifying and mitigating risks is a challenge for any company. It is no wonder then that many contracts and insurance agreements require solid evidence of good risk management practice. ISO 31000 provides direction on how companies can integrate risk-based decision making into an organization's governance, planning, management, reporting, policies, values and culture. It is an open, principles-based system, meaning it enables organizations to apply the principles in the standard to the organizational context.

WHO IS ISO 31000 FOR?

ISO 31000 is applicable to all organizations, regardless of type, size, activities and location, and covers all types of risk. It was developed by a range of stakeholders and is intended for use by anyone who manages risks, not just professional risk managers.

WHAT ARE THE BENEFITS FOR MY BUSINESS?

ISO 31000 helps organizations develop a risk management strategy to effectively identify and mitigate risks, thereby enhancing the likelihood of achieving their objectives and increasing the protection of their assets. Its overarching goal is to develop a risk management culture where employees and ...