In 2022, Odyssey International was found to have fraudulently gained a $99 million contract with the U.S. Government. The company’s employees gave false information about who worked for the business and where. They also put citizens on the payroll who didn’t work for them and hid other employees’ payments via a shell company to secure the contract. Risk management tactics and frameworks such as completing full due diligence could have brought all of this to light. One of these frameworks is ISO 31000, an international standard that will help you get a handle on risks in your organization. Details in this article.
Trustpair helps you with third-party and supplier risk management by continuously auditing vendor data, as well as spotting any anomaly or suspicious activity or transaction. Download our latest white paper about supplier risks to learn more.
What is ISO 31000?
ISO 31000 is an international standard that offers guidelines on risk management within an organization.
It was first brought about in 2009 and the most recent update was in 2018.
The standard works for both companies and non-profit organizations to minimize risks such as different types of fraud, operational efficiency, financial risk, and reputational risk.
Learn more about examples of fraud in business here.
Using the ISO 31000 framework, you can:
- Spot the risks in your organization
- Assess how likely an event is to occur that is linked to a risk
- Work out how extreme the impacts of the event would be
What are the benefits of ISO 31000?
Looks at risks in a standardized manner
Because the process is standardized, all organizations that operate ISO 31000 are on the same page as to what constitutes a risk under ISO 31000 and how to manage them. Therefore, if you switch companies and operate in a risk role, it will be the same standard that is applied.
Generates a risk reducing culture
If everyone on the team gets on board with managing risks, an active culture can be generated towards reducing risks. This spreads to new and old team members and can help shape the industry bit by bit.
Companies operating the guidelines are being proactive towards risks, rather than reactive which is a bonus.
It is worth noting that 73% of risk professionals believe that risk culture needs to be improved in a financial setting.
By operating in a risk-reducing culture, you can limit the chances of your organization being caught out by fraud.
For example, by training and educating staff about phishing fraud and the use of social engineering tactics, you can manage the risk of fraud in a proactive manner.
Reduces potential damages
By limiting the risk of potential damages, you are less likely to suffer financial and reputational damage to your business.
For example, as part of social media guidelines, staff may be encouraged not to post controversial thoughts on social media that could leave the company in hot water. Otherwise, the posts could impact their reputation or relationships with investors if they were a representative of the organization.
Company becomes more appealing to investors
This is a byproduct of having a better risk management strategy and risk treatment. Your organization is likely to be seen as sensible, risk-averse, and therefore more appealing to investors and banks who may be keeping an eye on your company.
What are the frameworks of ISO 31000?
There are six areas of focus for the frameworks and principles of ISO 31000:
Leadership and commitment
Senior figures must apply the risk management principles and set the standards. Leading by example comes from the top and filters down through the company. They must also ensure that the application of the guidelines is continued and consistent.
Integration
The standard must be fully integrated across the organization into different sectors involving the company’s goals and strategies.
Design
How the framework is designed involves allocating certain employees’ roles, distributing the funding that will be used to apply the standard, and being mindful of how the policy fits into how the organization is currently structured.
Implementation
As for the implementation, there must be organizational clarity on a few aspects.
That involves:
- Committing individuals to their roles in the risk management process
- Putting agreed processes into practice
- Ensuring that the practices are communicated and can be undertaken by all staff members
Evaluation
It is important to take a regular step back when you are implementing ISO 31000 to assess and review how it is working, what is going well, and what can be improved.
Compare your evaluation to your goals and objectives with the risk management process to see if you’re on track or not, and where you can step up.
Improvement
Building on from your evaluation, you will need to look at how you can improve and how that potential improvement aligns with your goals.
It may be a case of changing some of the old processes and adapting to the times.
For example, in your organization, you may have worked with one trusted supplier of printers for a very long time. Let’s say the supplier is folding at the end of the year.
In your risk management guidelines, you may not have completed due diligence on a supplier before as they were a trusted friend and you didn’t need to.
However, before appointing your next merchants or suppliers, you could assess the situation and come to the conclusion that an effective risk management strategy would be to undertake due diligence on all potential new suppliers and ensure you Know Your Supplier.
What are the ISO 31000 principles?
The principles that are central to ISO 31000 are:
- Inclusive – includes all senior figures
- Integrated – applied in all sectors of an organization
- Dynamic – adaptable to change
- Best and most available information – decisions should be based on the latest information
- Human and cultural factors – assess how the people in your business and the culture impact risk management
- Continued improvement – keep wanting to get better with your risk management
- Comprehensive risk management strategy – it must be detailed and able to take effect
- Personalized – focused on your organization and its needs
How to be ISO 31000 compliant
Your organization can use ISO 31000 to compare against your current standards and use it as a benchmark.
Checklists can lead you in the right direction to putting together the risk management framework.
Inside the framework, there is a process for a risk assessment. This looks like:
- Risk identification – recognize the risk, where it came from, work out whether it is internal or external
- Risk analysis – assess the potential consequences of the risk coming to light and what can impact these consequences. Also explore how likely it is to occur, the level of the risk, and what controls are there currently to mitigate the risk
- Risk evaluation – decide your organization’s action whether to accept the risk or use risk treatment to minimize the risk and improve security. Consider your actions from a legal and regulation perspective as well
Following this, your risk treatment occurs which involves choosing the methods that you will use to mitigate risk.
While your organization goes through the risk assessment process, there are a few things that you must be aware of and be consistent with. They are:
- Being aware of the scope, context, and criteria – make the process specific to your company
- Communication and consultation – help stakeholders to understand the risks and why decisions need to be made and actions need to be taken. They can offer their assessment for you to take on board
- Monitoring and review – be aware of how the risk treatment is going and assess how effective it is compared to its objectives
- Recording and reporting – the risk management efforts need to be registered including the findings
Following a training course, staff members can take an exam and apply to get the credential as a PECB Certified ISO 31000 Risk Manager.
Overall, it is more of a framework for solid risk management procedures rather than something that you can be compliant with. There is no certified risk management standard you can gain as a company.
Recap
ISO 31000 is a standard used internationally and it provides guidelines and best practices for risk management and helps to minimize risk in an organization. Trustpair supports you with third-party and supplier risk management by continuously auditing vendor data and spotting any anomaly, suspicious activity, or unusual transactions. Request a demo to learn more!
