ISO 31000:2018 Risk Management Checklist

About the ISO 31000:2018 risk management checklist

Risk management is the set of activities you use to understand the risks your organization faces and to make decisions that account for them. ISO 31000:2018 sets out guidance for managing risk, and this readiness checklist helps you find gaps in your current practices and build a risk management system that is at par with that guidance. It contains 106 items covering the establishment of a risk management framework, the leadership commitment behind it, the responsibilities of your personnel, and the design of a framework suited to your organization. Each item is answered on a three-point scale — Done, To Do, or Not Applicable — so you can see what is already in place and what still needs to be done.

Why a risk management framework matters

A framework gives your organization a consistent way to handle risk rather than leaving it to individual judgement. The checklist asks you to evaluate your existing risk management practices and processes and to identify gaps in them, then to establish a framework that meets your organization's unique needs and fills those gaps. It also asks you to consider how you will make risk management part of your organization and how you will integrate it into all significant activities, decision making activities, functions, and governance. Without that structure, risk management tends to sit apart from day-to-day work; with it, risk becomes something your organization evaluates when setting objectives and manages when achieving them.

What a good framework covers

The checklist works through several layers of the framework: - **Planning.** Consider how you intend to develop your framework, how you will design it, how you will fill gaps in existing practices and procedures, and how you will implement, evaluate, and improve it. - **Leadership commitment.** Ask your leaders, oversight bodies, and top management to support the framework and to make a commitment to risk management. - **Alignment.** Ask oversight bodies and top management to align risk management with the organization's strategy, culture, objectives, obligations, and voluntary commitments. - **Accountability and oversight.** Ask them to be accountable for overseeing risk management, to ensure risks are understood and communicated throughout the organization, to ensure risk management methods are communicated, and to ensure risk management systems are implemented and operating effectively. - **Criteria.** Ask top management to ensure that appropriate risk criteria are developed and communicated throughout the organization and to all relevant stakeholders. - **Communication and monitoring.** Ask them to communicate the value of risk management to the organization and to stakeholders, to monitor the unique risks facing the organization, and to encourage personnel to systematically monitor risks. - **Policy.** Ask your leaders to prepare a general risk management policy statement and define their general approach to risk management.

Working through the checklist

Start with the preparation items: the date the checklist was conducted, who prepared it, and the location. Then follow the sections in order, beginning with the framework section, which asks you to evaluate existing practices, identify gaps, and set out how you will develop, design, implement, evaluate, and improve the framework. The leadership and responsibility sections prompt the conversations you need to have with stakeholders, leaders, oversight bodies, top management, and managers, including how risk management is integrated into all activities and how risk is properly evaluated when setting objectives and managed when achieving them. The design section closes the loop by asking your leaders to prepare the policy statement and define their general approach. Record each answer as Done, To Do, or Not Applicable, and use the Completion section to confirm the work has been addressed.

Frequently Asked Questions

The checklist is built around the activities of ISO 31000:2018: you evaluate your existing risk management practices and processes, identify gaps in them, and establish a framework that meets your organization's unique needs and fills those gaps. It also covers planning how you will develop, design, implement, evaluate, and improve the framework, and how you will integrate risk management into significant activities, decision making, functions, and governance. Leadership items complement this by asking oversight bodies and top management to align risk management with strategy, culture, objectives, obligations, and voluntary commitments, and to ensure risks are understood and communicated across the organization.

You begin by evaluating your existing risk management practices and processes and identifying their gaps. Then you establish a framework that meets your organization's unique needs and addresses those gaps, considering how you will develop, design, implement, evaluate, and improve it. You also plan how to make risk management part of your organization and how to integrate it into all significant activities, decision making activities, functions, and governance. Finally, you ask stakeholders, leaders, oversight bodies, and top management to support the establishment of the framework, make a commitment to risk management, and prepare a general risk management policy statement that defines their general approach.

Leadership commitment is needed at several levels. You ask oversight bodies and top management to be accountable for overseeing and managing risk management, to align it with the organization's strategy, culture, objectives, obligations, and voluntary commitments, and to ensure that appropriate risk criteria are developed and communicated to the organization and to all relevant stakeholders. You ask them to ensure risks are understood and communicated throughout the organization and that risk management systems are implemented and operating effectively, and that risk is properly evaluated when setting objectives and managed when achieving them. You also ask top management to monitor the unique risks facing the organization and to encourage personnel to systematically monitor risks.

You start with the preparation items — recording the date, who prepared the checklist, and the location — and then follow the sections in order. The framework planning section asks you to evaluate practices, identify gaps, and consider how you will develop, design, implement, evaluate, and improve the framework. The leadership and responsibility sections set out what to ask from stakeholders, leaders, oversight bodies, top management, and managers. The design section asks your leaders to prepare a general risk management policy statement and define their general approach. Work through each item, record whether it is Done, To Do, or Not Applicable, and use the Completion section to confirm the framework has been addressed.

The readiness checklist can help you find gaps and build your organization's risk management system toward the ISO 31000:2018 standard. Each item is answered on a three-point scale — Done, To Do, or Not Applicable — so you can see at a glance what is already in place, what remains to be done, and what does not apply to your organization. Use it to drive the conversations with oversight bodies, top management, and managers that the checklist sets out, and to prepare the policy statement and approach that underpin the framework.

Written by

Arne Reis

Founder

Process optimizer with 25 years of expertise, focused on operational excellence in quality, maintenance, EHS, and commissioning. Emphasizes innovative solutions and top-quality standards.

View LinkedIn profile