Free Resource Library www.goodelearning.com © Good e-Learning 2015. ITIL® is a Registered Trademark of AXELOS Ltd Diagram: Copyright © AXELOS Limited 2010. All rights reserved. Material is reproduced under licence from AXELOS.. @goodelearning /goodelearning /company/good-e-learning Good e-Learning Resources :: www.goodelearning.com/downloads ITIL ® Poster Series #23 Risk Management Process ISO 31000 was published in November 2009 and is the first set of international guidelines for risk management, intended to be applicable and adaptable for ‘any public, private or community enterprise, association, group or individual.’ ISO 31000 is a process-oriented rather than a control-oriented approach to risk management, and provides guidance on a broader, more conceptual basis, rather than specifying all aspects of an organization’s risk assessment and management approach. ISO 31000 was published as a standard without certification. Risk management is an important part of many of the processes in the service lifecycle, but is not identified as one of the ITIL processes. However, it is explained and referenced in the framework, using ISO 31000 as the benchmark. Risk assessment consists of three steps: • Risk Identification • Creation of a list of risks based on events impacting the organization’s objectives • Risk Analysis • Understanding the risks as an input to evaluation and plan for treating the risks • Risk Evaluation • Make decisions about which risks require treatment and relative prioritization Risk treatment involves the modification of risks using one or more approaches including: • Avoiding the risk by not carrying out the actions creating the risk • Taking or increasing the risk in order to pursue an opportunity • Removing the risk source • Changing the likelihood • Changing the consequences • Sharing the risk with another party or parties • Retaining the risk by informed decision. COMMUNICATION AND CONSULTATION MONITORING AND REVIEW RISK TREATMENT ISO: 31000 - RISK MANAGEMENT PROCESS FLOW RISK ASSESSMENT RISK IDENTIFICATION RISK ANALYSIS RISK EVALUATION ESTABLISH THE CONTEXT ISO 31000 defines risk as ‘the effect of uncertainty on objectives’ and identifies the necessary components of a risk framework as: • Mandate and commitment • Design of framework for managing risk • Understanding the organization and its context • Establishing risk management policy • Accountability • Integration into organizational processes • Resources • Establishing internal communication and reporting mechanisms • Establishing external communication and reporting mechanisms • Implementing risk management • Monitoring and review of the framework • Continual improvement of the framework.

ISO: 31000 - RISK MANAGEMENT PROCESS FLOW · PDF fileree esore Lirr gooeearningcom oo eearning is a Registere raemark o t iagram origt imite rigts resere Materia is reroce ner icence

Download PDF Report

Upload
phamkien
View
217
Download
1

Embed Size (px)

Citation preview

Page 1: ISO: 31000 - RISK MANAGEMENT PROCESS FLOW · PDF fileree esore Lirr gooeearningcom oo eearning is a Registere raemark o t iagram origt imite rigts resere Materia is reroce ner icence

Free Resource Library www.goodelearning.com

@goodelearning /goodelearning /company/good-e-learning

Good e-Learning Resources : : www.goodelearning.com/downloads

ITIL® Poster Series #23Risk Management Process

ISO 31000 was published in November 2009 and is the first set of international guidelines for risk management, intended to be applicable and adaptable for ‘any public, private or community enterprise, association, group or individual.’

ISO 31000 is a process-oriented rather than a control-oriented approach to risk management, and provides guidance on a broader, more conceptual basis, rather than specifying all aspects of an organization’s risk assessment and management approach. ISO 31000 was published as a standard without certification.

Risk management is an important part of many of the processes in the service lifecycle, but is not identified as one of the ITIL processes.However, it is explained and referenced in the framework, using ISO 31000 as the benchmark.

Risk assessment consists of three steps: • Risk Identification

• Creation of a list of risks based on events impacting the organization’s objectives

• Risk Analysis • Understanding the risks as an input to evaluation and plan for treating the risks

• Risk Evaluation• Make decisions about which risks require treatment and relative prioritization

Risk treatment involves the modification of risks using one or more approaches including:

• Avoiding the risk by not carrying out the actions creating the risk• Taking or increasing the risk in order to pursue an opportunity• Removing the risk source• Changing the likelihood• Changing the consequences• Sharing the risk with another party or parties • Retaining the risk by informed decision.

COM

NIC

ATI

D C

SULT

ATI

NIT

ORI

D R

EVIE

RISK TREATMENT

ISO: 31000 - RISK MANAGEMENT PROCESS FLOW

RISK ASSESSMENT

RISK IDENTIFICATION

RISK ANALYSIS

RISK EVALUATION

ESTABLISH THE CONTEXT

ISO 31000 defines risk as ‘the effect of uncertainty on objectives’ and identifies the necessary components of a risk framework as:

• Mandate and commitment• Design of framework for managing risk• Understanding the organization and its context• Establishing risk management policy• Accountability• Integration into organizational processes• Resources• Establishing internal communication and reporting mechanisms• Establishing external communication and reporting mechanisms• Implementing risk management• Monitoring and review of the framework• Continual improvement of the framework.

https://www.goodelearning.com/Member_Area/Register/#/preview