AS ISO 31000:2018 pdf download – Risk management – Guidelines
5.3 Integration
Integrating risk management relies on an understanding of organizational structures and context. Structures differ depending on the organization’s purpose, goals and complexity. Risk is managed in every part of the organization’s structure. Everyone in an organization has responsibility for managing risk. . Governance guides the course of the organization, its external and internal relationships, and the rules, processes and practices needed to achieve its purpose. Management structures translate governance direction into the strategy and associated objectives required to achieve desired levels of sustainable performance and long-term viability. Determining risk management accountability and oversight roles within an organization are integral parts of the organization’s governance. Integrating risk management into an organization is a dynamic and iterative process, and should be customized to the organization’s needs and culture. Risk management should be a part of, and not separate from, the organizational purpose, governance, leadership and commitment, strategy, objectives and operations.
5.4.1  Understanding the organization and its context
When designing the framework for managing risk, the organization should examine and understand its external and internal context.
Examining the organization’s external context may include, but is not limited to:
— the social, cultural, political, legal, regulatory, financial, technological, economic and environmental factors, whether international, national, regional or local;
— key drivers and trends affecting the objectives of the organization;
— external stakeholders’ relationships, perceptions, values, needs and expectations;
— contractual relationships and commitments;
— the complexity of networks and dependencies.
Examining the organization’s internal context may include, but is not limited to:
— vision, mission and values;
— governance, organizational structure, roles and accountabilities;
— strategy, objectives and policies;
— the organization’s culture;
— standards, guidelines and models adopted by the organization;
— capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, intellectual property, processes, systems and technologies);
— data, information systems and information flows;
— relationships with internal stakeholders, taking into account their perceptions and values;
— contractual relationships and commitments;
— interdependencies and interconnections.
5.4.2  Articulating risk management commitment
Top management and oversight bodies, where applicable, should demonstrate and articulate their continual commitment to risk management through a policy, a statement or other forms that clearly convey an organization’s objectives and commitment to risk management. The commitment should include, but is not limited to:
— the organization’s purpose for managing risk and links to its objectives and other policies;
— reinforcing the need to integrate risk management into the overall culture of the organization;
— leading the integration of risk management into core business activities and decision-making;
— authorities, responsibilities and accountabilities;
— making the necessary resources available;
— the way in which conflicting objectives are dealt with;
— measurement and reporting within the organization’s performance indicators;
— review and improvement.
The risk management commitment should be communicated within an organization and to stakeholders,as appropriate.