Introduction
ISO 31000 provides guidance for managing risk across an organization. Its value is not a prescribed checklist or a single scoring model. Instead, it connects principles for effective risk management with an organizational framework and a process that can be adapted to different decisions and circumstances.
For an insurer, the same approach can inform decisions about claims operations, underwriting, investments, technology, and strategy. The method begins with objectives and context: ISO 31000 defines risk as the effect of uncertainty on objectives. An event or condition that might cause an effect is a scenario or source of risk; it is not, by itself, the definition of risk.
The Principles: Qualities of Effective Risk Management
ISO 31000:2018 identifies eight principles. They describe qualities that risk management should exhibit, rather than eight stages to complete in order. A sound process and framework should reflect these principles in the organization’s actual decisions and operations.
- Integrated: Risk management is part of organizational activities and decision-making, not a separate exercise performed only by a specialist function.
- Structured and comprehensive: A consistent approach supports comparable and complete consideration of risks, while remaining appropriate to the decision.
- Customized: Risk management is designed for the organization’s external and internal context, objectives, and risk profile.
- Inclusive: Appropriate involvement of stakeholders brings relevant knowledge, perspectives, and perceptions into the process.
- Dynamic: Risks can emerge, change, or disappear as internal and external conditions change. The approach should respond in a timely way.
- Best available information: Risk management uses historical and current information, expectations, and limitations in knowledge. Information should be timely, clear, and accessible to relevant stakeholders.
- Human and cultural factors: People’s behavior and organizational culture influence every part of risk management.
- Continual improvement: Risk management is improved over time through learning and experience.
These principles are mutually reinforcing. For example, involving claims staff in a technology-risk discussion supports inclusion, but it also improves the information available and can reveal cultural or behavioral factors that a centralized analysis would miss. Customization does not mean abandoning structure; it means applying a coherent method that fits the particular organization and decision.
The Framework: Embedding Risk Management
The framework concerns how the organization integrates, designs, implements, evaluates, and improves risk management. It creates the conditions for the process to operate consistently. It is not the same as an individual risk assessment: the framework addresses organizational arrangements, while the process applies to particular scopes, decisions, or activities.
Top management and oversight bodies demonstrate commitment, set expectations, assign responsibility, and support integration of risk management into organizational activities.
The organization considers its context and structures, articulates its commitment, assigns roles and authority, provides resources, and establishes communication and consultation arrangements.
Arrangements are put into practice. Risk management is incorporated into relevant decisions, activities, and processes rather than left as a written policy.
The organization assesses whether the framework is suitable and effective, then adapts it in response to changes, performance, and lessons learned.
The framework is iterative. Evaluation may show that responsibilities are unclear or that staff lack access to useful information; improvement then changes the organizational arrangements. That adjustment can make future risk assessments more effective. The framework supports the process, and experience from the process helps refine the framework.
The Process: From Context to Action and Review
ISO 31000’s process applies across levels and activities, from enterprise-wide decisions to a defined operational change. Its core elements are scope, context, and criteria; risk assessment; and risk treatment. Communication and consultation, monitoring and review, and recording and reporting support the process throughout. They are not merely final steps.
Before assessing risk, define the scope (what decision, activity, or objectives are being considered), establish relevant context (internal and external circumstances and stakeholders), and set criteria for judging significance and deciding whether action is required. Criteria may reflect objectives, obligations, risk appetite, and the decision’s consequences. They should be clear enough to guide evaluation and treatment.
Risk identification describes how uncertainty could affect objectives. Analysis considers relevant causes, events or circumstances, consequences, likelihood, controls, and limitations in available knowledge. The methods and detail depend on the scope and information available; ISO 31000 does not require every risk to be assigned a numerical probability. Evaluation compares the analysis with the criteria, identifies priorities, and informs whether to proceed, modify a decision, or consider treatment.
Treatment selects and implements options for addressing risk. Depending on context, options can include avoiding the risk by not starting or continuing an activity; taking or increasing risk to pursue an opportunity; removing a risk source; changing likelihood or consequences; sharing risk, such as through a contract or insurance; or retaining risk by informed decision. Options may be combined, and treatment can create new risks or change existing ones. The decision-maker should consider whether the treatment is appropriate, feasible, and consistent with objectives, and then assess any remaining risk against the criteria.
Communication and consultation help relevant parties understand the risk, the basis for decisions, and the actions expected. Monitoring and review check changing conditions, assumptions, controls, and treatment effectiveness. Recording and reporting preserve the information needed for accountability, decisions, and learning. The process therefore loops: a change in context, new information, or an ineffective treatment may prompt reassessment.
Worked Applications
Worked Example: Assessing a Claims-Platform Transition
A hypothetical insurer plans to move claims intake to a new platform. It wants to maintain timely and accurate intake during the transition. Show how ISO 31000’s process frames the issue. Model assumptions: this is a qualitative operational assessment; no interest rate, mortality assumption, or probability distribution and parameters are specified or used.
1. Set scope, context, and criteria. The scope is the transition period and the objective is timely, accurate claims intake. Relevant context includes dependencies on the new platform, staff readiness, and the continuity arrangements available. For this assessment, the insurer’s stated criteria are that intake delays or errors requiring material operational intervention need treatment. These are hypothetical internal criteria, not an ISO-prescribed threshold.
2. Identify the risk correctly. A plausible scenario is a platform outage or transition defect. The risk is the effect of uncertainty about the transition or outage on timely and accurate claims intake. For example, uncertainty could lead to delayed or incomplete intake, which could impair the objective. The outage is a scenario, not the ISO definition of risk.
3. Analyze and evaluate. The assessment considers the possible effects, their operational significance, and the controls that could reduce them. Staff testing and a temporary fallback intake method are relevant controls, but their presence does not establish that disruption is impossible. Under the stated criteria, a plausible material delay or error meets the threshold for further action.
4. Treat, communicate, and monitor. The insurer could test the fallback process, assign staff to monitor transition-period intake, and define escalation responsibilities. It should communicate the process to affected teams, record the decision and assumptions, and monitor delays, errors, and system availability. If results reveal a new failure mode, the assessment and treatment should be revisited. This method avoids labeling the risk merely “technology risk,” which does not specify the uncertain effect on the objective.
Worked Example: Using Criteria to Prioritize Two Scenarios
A hypothetical insurer’s operations committee uses a simple internal screening score to decide which scenarios need detailed review. It assigns a likelihood rating \(L\) and consequence rating \(C\), each from 1 to 5, and defines the score as \(R=L\times C\). Scores of 12 or higher require detailed review. For this example, likelihood and consequence are ordinal judgments, not measured probabilities or dollar amounts. Model assumptions: no interest rate, mortality assumption, or probability distribution and parameters are used.
The first scenario is a temporary interruption of a policy-administration data feed, rated \(L=3\) and \(C=4\). Its score is \(3\times4=12\), so it meets the detailed-review criterion.
The second scenario is a short delay in a routine internal report, rated \(L=4\) and \(C=2\). Its score is \(4\times2=8\), below the threshold, so it does not automatically require detailed review under this screening rule.
The multiplication follows the committee’s defined scoring convention: each scenario receives the product of its two ratings, and that product is compared with the specified threshold. The arithmetic is \(3\times4=12\) and \(4\times2=8\). It does not establish that the first scenario has a particular probability of loss or is exactly 1.5 times as risky as the second. ISO 31000 does not prescribe this score; evaluation must use the organization’s context and criteria. The method avoids treating an ordinal score as a quantitative loss estimate.
Worked Example: Revising Treatment After Conditions Change
A hypothetical insurer retains a manual procedure for recording urgent customer requests during a planned system change. After implementation, a staffing change means fewer trained employees are available for that procedure. Explain how the process should respond. Model assumptions: this is a qualitative review; no interest rate, mortality assumption, or probability distribution and parameters are specified or used.
1. Revisit context and assessment. The objective remains accurate handling of urgent requests, but staffing is a changed internal condition. The old assessment and its assumptions should not be carried forward without review.
2. Reconsider the risk and criteria. The risk is the effect of uncertainty about staff capacity and system availability on accurate handling of urgent requests. The possible consequences and likelihood should be reconsidered using available information and the organization’s established criteria.
3. Adjust treatment and responsibilities. Options might include cross-training additional staff, assigning an on-call role, or changing the temporary procedure. The organization should evaluate feasibility and any new risks, such as an unclear handoff between teams.
4. Communicate, record, and monitor. Update instructions and responsibilities, communicate the change to affected employees, record the rationale and remaining concerns, and monitor whether requests are handled accurately. This example illustrates the dynamic principle: changed conditions can require renewed assessment rather than simply continued reliance on a previously selected treatment.
Deriving the Logic of the Assessment Sequence
The sequence from identification to analysis to evaluation follows from the questions each stage must answer. Identification establishes what uncertain effects on objectives are under consideration. Without that description, analysis has no defined subject. Analysis then develops information about those risks. Without that information, evaluation cannot make a reasoned comparison with criteria. In compact form:
This is a logical dependency, not a claim that practice is strictly one-way. New analysis can reveal a previously unrecognized risk, and monitoring can change the context or evidence. The sequence clarifies what each activity contributes while the overall process remains iterative.
Common Exam Traps and Practical Significance
A frequent error is to call an event or condition itself “the risk.” For example, “a platform outage is the risk” describes a scenario but not the effect of uncertainty on an objective. A more precise statement is: “Uncertainty about a platform outage could affect timely and accurate claims intake.” The outage is the scenario; the possible effect on the objective is the risk as ISO 31000 defines it.
Another trap is to confuse framework and process. Assigning organizational responsibilities and resources belongs to designing the framework; identifying and evaluating a particular scenario belongs to the process. Nor should a candidate present a numerical matrix as an ISO requirement. A score can support an organization’s criteria if clearly defined, but it cannot replace context, judgment, or appropriate analysis.
The method matters because decisions are made under uncertainty and affect objectives. Applying the principles keeps risk management integrated and responsive; the framework establishes organizational support; and the process turns a defined decision into assessment, treatment, communication, and review. A well-documented decision makes its criteria and assumptions visible, but documentation alone does not make the decision sound.
Check Your Understanding
For each problem, distinguish the scenario from the risk and apply the ISO 31000 concepts in context.
- A hypothetical insurer is considering a new broker portal. State one suitable objective, one scenario, and a precise description of the associated risk. (Answer: For example, the objective is timely and accurate submission of applications; the scenario is a portal outage or data-transfer defect; the risk is the effect of uncertainty about that scenario on timely and accurate submission.)
- A risk committee assigns likelihood rating 2 and consequence rating 5 under its own rule \(R=L\times C\), with a review threshold of 10. What score results, and does it meet the threshold? (Answer: \(2\times5=10\); yes, it meets the threshold.)
- During assessment of a hypothetical claims vendor, staff who use the vendor’s service are not consulted. Which ISO 31000 principle is most directly weakened, and name one related benefit of consultation. (Answer: The inclusive principle; consultation can bring operational knowledge or perspectives into identification and analysis.)
- A treatment plan relies on a manual reconciliation procedure. A new system change alters the data fields that staff must reconcile. What process activities should follow? (Answer: Monitor and review the changed conditions, revisit context and assessment, evaluate whether treatment remains suitable, then revise and communicate treatment as needed and record the decision.)
- A manager says, “The risk is that a key employee may leave,” without connecting it to an objective. Correct the statement in ISO 31000 terms. (Answer: The employee’s departure is a scenario; the risk is the effect of uncertainty about that departure on a stated objective, such as timely completion of a defined control or service.)