What was ISO 31000 originally designed to achieve, and how did the international risk management standard develop?
In this RiskMasters — The Download extract, Grant Purdy, who was directly involved in the development of ISO 31000, explains the origins of the standard and its relationship with organisational decision-making.
Grant traces ISO 31000 back to the Australian and New Zealand standard AS/NZS 4360, first published in 1995 and subsequently updated in 1999 and 2004. The objective was to bring greater consistency to different approaches to risk assessment and risk treatment while producing information that decision-makers could understand and use.
As other countries began adopting AS/NZS 4360, Grant and his colleagues approached the International Organization for Standardization (ISO) about developing an international standard. What followed was a four-year process of discussion and compromise as different countries brought their own perspectives on risk management.
Grant explains why the resulting ISO 31000 framework sought to integrate risk management and decision-making, but also why he believes this contributed to a distinction that continues to shape the profession.
In his view, different philosophies of risk management have subsequently developed. He characterises the ISO 31000 approach as increasingly focused on decision support, while describing COSO and IRM approaches as placing greater emphasis on risk identification, governance and reporting.
That distinction leads to a fundamental question for risk leaders: is risk management primarily a process for identifying and reporting risk, or should its ultimate purpose be to improve organisational decisions?
- The origins and history of ISO 31000
- How ISO 31000 evolved from AS/NZS 4360
- The original purpose of risk assessment and risk treatment
- Why risk information should support organisational decision-making
- How the international risk management standard was developed
- The role of compromise in international standards
- Grant Purdy's perspective on different philosophies of modern risk management
This extract is taken from the full CPD-accredited RiskMasters conversation with Grant Purdy exploring ISO 31000, risk management, uncertainty, risk matrices, governance and better decision-making.
Listen to the full conversation on Apple Podcasts, Spotify or at aevitium.com.
