The Importance of Risk Management: What is Missing in ISO Standards?

Abstract

The overall aim of this article is to contribute to the further development of the area of risk analysis and risk management in the International Organization for for Standardization (ISO) standards by strengthening its scientific basis. Industrial standards, especially ISO standards, are the tools organizations use to manage their risk, through following their guidance and complying with their requirements. Organizations confirm their compliance with these standards through certification, which means that they heavily depend upon the quality of the ISO standards to enable them to effectively manage their risk. The purpose of this study is to investigate what guidance is given on key elements of risk management and how well ISO standards are aligned with state-of-the-art risk management literature. Eighteen ISO standards, all addressing risk management, were reviewed in this study with regard to risk terminology and guidance. The results of the study confirm the increasing importance of risk management for business. However, the study also shows a lack of guidance on doing risk analysis in the industrial standards examined. The ISO management system standards and guidelines are not aligned with the scientific literature on risk and are not appropriate for the management of risk arising from complex interactions and emergent behavior that is inherent in present-day sociotechnical systems.

Benchmarking ISO Risk Management Systems to Assess Efficacy and Help Identify Hidden Organizational Risk

“…Certification audits aim at verifying that the quality is as defined by an organization, whatever it may be. Now that risk management has become an important part of all ISO management systems standards (since 2015) [8,14], the question arises as to whether risk should be treated in a similar way. That is, if the willingness to take risk and the risk taken in ISO certified organizations is entirely the decision of the organizations' managers, and if not, how to evaluate the quality of the risk management.…”

“…Section 2.2 reviews the risk management guidelines in ISO 31000, the structure, and use of the standard. Section 2.3 reviews selected scientific literature on risk issues in risk management systems, selection based on findings in recent article on risk management guidelines [8]. Section 3 describes the development of a benchmarking model used in this article for reviewing and evaluating the six real-life ISO risk management systems in this study.…”

“…According to the authors' experience, the application of ISO standards and ISO certifications are no assurance of the efficacy of a risk management system. The risk terminology in ISO standards is not aligned with risk science and the ISO standards give limited guidance on how to analyze, assess, and manage risk [8]. Therefore, the aim of this study was twofold:…”

“…They were interested in finding ways to evaluate the efficacy of their risk management systems in terms of finding hidden organizational risks through the risk assessment process used by the organizations, and to improve their risk analysis technique. Based on a previous study [8], it is hypothesized that certain risk issues will be evident in practice, provided a benchmarking tool (model) can be applied. Examples of such issues are the ability to capture risk in complex systems and that risk criteria can be unclear in ISO risk management systems.…”

Similarities and differences between COSO ERM and ISO 31000 - descriptive and content analyzes

“…The development of the proposed structure encompasses integration, design, implementation, evaluation and ultimately the improvement of the risk management process, thus supporting the institution in governance and significant activities (ISO, 2018). This structure allows current practices to be assessed and any gaps, which prevent the optimization of risk management, to be filled (BJÖRNSDÓTTIR et al, 2021).…”