RISK5002 Chap.2 Planning and Running a Risk Assessment
Planning and Running a Risk Assessment
IEC 31010:2019 is the toolbox that sits behind ISO 31000. Published jointly by the IEC and ISO, it explains how to implement a risk assessment, how to select techniques, how the techniques are categorised in Annex A, and how each technique works under five headings in Annex B.
This chapter follows the assessment in order: the six planning steps of Section 6.1, identification and its difficulties, analysis of consequence, likelihood and interactions, evaluation against criteria with its five possible outcomes, and reporting suited to each audience. It closes with the comparison between COSO 2017 and ISO 31000:2018 that the lecture draws, so you can explain when each framework suits an organisation.
The planning steps matter because they fix what the assessment is for before any data appear, which protects the result from being steered afterwards. The chapter shows each step with a council e-scooter decision, explains why identification is hard and how analysts guard against blind spots, and maps the technique families onto the stages so you can justify a choice of tool.
The comparison with COSO then gives you the vocabulary to discuss which framework suits a listed company, a council or a hospital.
What this chapter covers
- 01
IEC 31010 sections and annexes
- 02
Six planning steps before assessment
- 03
Technique families in Table A.3
- 04
Analysis of consequence and likelihood
- 05
Five evaluation outcomes
- 06
COSO 2017 compared with ISO 31000
Worked example · free
Match four techniques to their assessment stage
- +1HAZOP: identification, family B2 techniques for identifying risk.
- +1Monte Carlo simulation: analysis, family B5 techniques for consequence and likelihood.
- +1F-N diagram: evaluation, family B8 techniques for the significance of risk.
- +1Cost/benefit analysis: evaluation and treatment choice, family B9 techniques for selecting between options.
Key terms
- IEC 31010
- The joint IEC and ISO standard that guides the selection and use of risk assessment techniques.
- Risk evaluation
- Comparison of analysed risk with criteria to decide whether further action is needed.
- COSO ERM
- The US framework linking enterprise risk management with strategy and performance.
- Societal risk
- The risk of multiple injuries or fatalities from a single event.
- Risk report
- The document that sets out an assessment's scope, methods, uncertainties, criteria and outcomes.
Planning and Running a Risk Assessment FAQ
What are the six steps for planning a risk assessment?
IEC 31010 Section 6.1 asks you to define the purpose and scope, understand the context, engage stakeholders, define the objectives of the system assessed, consider human, organisational and social factors, and review the criteria for decisions before the assessment begins.
What outcomes can risk evaluation lead to?
Evaluation can conclude that nothing further is needed, that treatment options should be considered, that more analysis is required, that existing controls should be maintained, or that objectives should be reconsidered. The result should then be recorded, communicated and validated.
How does COSO 2017 differ from ISO 31000?
COSO runs over 100 pages, is US focused and leans towards financial reporting and audit, with stronger guidance on risk appetite. ISO 31000 is 16 pages, international, high level and sector neutral. Both offer a common language and embed risk management in decisions.
Why is risk identification considered the hardest stage?
People struggle to imagine events they have never experienced, uncertainty grows with long time frames, and nobody can list an issue they are unaware of. The lecture's response is to identify systematically, involve stakeholders with different knowledge, and build a way to capture emerging risks, because a risk that is never identified cannot be managed at all.
Exam move
Draw the stage map and hang one technique from each family beneath it until you can do it in two minutes. Then take any proposal in the news, such as a new transport scheme, and write the six planning steps for it with one concrete example each. Finish by writing a five-row COSO versus ISO table from memory and one sentence on when you would recommend each framework.
When you revise reporting, list the items a risk assessment report should contain, from scope and assumptions to criteria and outcomes, and practise adjusting the language for a board, a regulator and an operations team.
Working through Planning and Running a Risk Assessment in RISK5002? Sia is AskSia’s AI Finance tutor — ask any RISK5002 Planning and Running a Risk Assessment question and get a clear, step-by-step explanation grounded in how RISK5002 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
