BS 31010:2010 pdf download – Risk management Risk assessment techniques
• providing information for decision makers;
• contributing to the understanding of risks, in order to assist in selection of treatment options;
• identifying the important contributors to risks and weak links in systems and organizations;
• comparing of risks in alternative systems, technologies or approaches;
• communicating risks and uncertainties;
• assisting with establishing priorities;
• contributing towards incident prevention based upon post-incident investigation;
• selecting different forms of risk treatment;
• meeting regulatory requirements;
• providing information that will help evaluate whether the risk should be accepted when compared with pre-defined criteria;
• assessing risks for end-of-life disposal.
4.2 Risk assessment and the risk management framework
This standard assumes that the risk assessment is performed within the framework and process of risk management described in ISO 31 000.
A risk management framework provides the policies, procedures and organizational
arrangements that will embed risk management throughout the organization at all levels.
As part of this framework, the organization should have a policy or strategy for deciding when and how risks should be assessed.
In particular, those carrying out risk assessments should be clear about
• the context and objectives of the organization,
• the extent and type of risks that are tolerable, and how unacceptable risks are to be treated,
• how risk assessment integrates into organizational processes,
• methods and techniques to be used for risk assessment, and their contribution to the risk management process,
• accountability, responsibility and authority for performing risk assessment,
• resources available to carry out risk assessment,
• how the risk assessment will be reported and reviewed.
4.3 Risk assessment and the risk management process
4.3.1 General
Risk assessment comprises the core elements of the risk management process which are
defined in ISO 31 000 and contain the following elements:
• communication and consultation;
• establishing the context;
• risk assessment (comprising risk identification, risk analysis and risk evaluation);
• risk treatment;
• monitoring and review.
Risk assessment is not a stand-alone activity and should be fully integrated into the other components in the risk management process.
4.3.2 Communication and consultation
Successful risk assessment is dependent on effective communication and consultation with stakeholders.
Involving stakeholders in the risk management process will assist in
• developing a communication plan,
• defining the context appropriately,
• ensuring that the interests of stakeholders are understood and considered,
• bringing together different areas of expertise for identifying and analysing risk,
• ensuring that different views are appropriately considered in evaluating risks,
• ensuring that risks are adequately identified,
• securing endorsement and support for a treatment plan.
Stakeholders should contribute to the interfacing of the risk assessment process with other management disciplines, including change management, project and programme management, and also financial management.
4.3.3 Establishing the context Establishing the context defines the basic parameters for managing risk and sets the scope and criteria for the rest of the process. Establishing the context includes considering internal and external parameters relevant to the organization as a whole, as well as the background to the particular risks being assessed. In establishing the context, the risk assessment objectives, risk criteria, and risk assessment programme are determined and agreed.
For a specific risk assessment, establishing the context should include the definition of the external, internal and risk management context and classification of risk criteria:
a) Establishing the external context involves familiarization with the environment in which the organization and the system operates including :
• cultural, political, legal, regulatory, financial, economic and competitive environment factors, whether international, national, regional or local;
• key drivers and trends having impact on the objectives of the organization; and
• perceptions and values of external stakeholders.
b) Establishing the internal context involves understanding
• capabilities of the organization in terms of resources and knowledge,
• information flows and decision-making processes,
• internal stakeholders,
• objectives and the strategies that are in place to achieve them,
• perceptions, values and culture,
• policies and processes,
• standards and reference models adopted by the organization, and
• structures (e.g. governance, roles and accountabilities).
c) Establishing the context of the risk management process includes
• defining accountabilities and responsibilities,