RISK5002 Chap.1 Risk and the ISO 31000 Framework
Risk and the ISO 31000 Framework
ISO 31000:2018 offers a shared method for handling every kind of risk, which any organisation can tailor and apply to decisions at every level. It is a set of guidelines, so no organisation can be certified to it; instead it serves as a starting point for designing a framework or a benchmark for reviewing one.
The chapter unpacks the six-word definition of risk, the effect of uncertainty on objectives, including why effects can be positive, why uncertainty is the root source of risk, and why likelihood is broader than probability.
It then lays out the eight principles, the framework built around leadership and commitment, and the process in which risk assessment sits between setting scope, context and criteria and choosing a treatment. A hospital dispensing project shows how to state the objective, the uncertainties and the effects. Exam questions on this material rarely stop at recall.
A typical item gives a short case and asks you to name the objective, the sources of uncertainty and the possible effects, or hands you a real framework and asks which principles it shows.
The chapter therefore pairs every definition with an application, explains how the standard came to be written from the Australian and New Zealand standard, and shows how ISO 31073 supports it with a shared vocabulary that later chapters rely on for terms such as likelihood, consequence and control.
What this chapter covers
- 01
The effect of uncertainty on objectives
- 02
Likelihood versus probability
- 03
Why certification is not possible
- 04
Eight principles of effective risk management
- 05
Framework, leadership and commitment
- 06
The iterative risk management process
Worked example · free
Locate four council activities in the ISO 31000 architecture
- +1(a) Framework: leadership and commitment, because accountability sits with top management.
- +1(b) Process: risk evaluation, the third stage of risk assessment, because analysis is compared with criteria.
- +1(c) Process: monitoring and review, which runs alongside every step.
- +1(d) Principle: customised, proportionate to the external and internal context and objectives.
Key terms
- Uncertainty
- A state, even partial, of deficiency of information about an event, its consequence or likelihood.
- Stakeholder
- Anyone, individual or organisation, who can influence a decision, is affected by it, or believes they are.
- Risk management
- Coordinated activity that steers and controls an organisation with respect to risk.
- ISO 31073
- The companion standard that defines the vocabulary used across risk management.
Risk and the ISO 31000 Framework FAQ
Can an organisation be certified to ISO 31000?
No. ISO 31000 offers guidelines rather than requirements, so there is nothing to audit against for certification. Organisations use it as a starting point when they design a risk framework, or as a benchmark when they review the one they already run.
Why does ISO 31000 say risk can be positive?
The definition calls the effect a deviation from the expected, and that deviation can be favourable, unfavourable or both. A product launch can fall short of its user target or overshoot it and strain capacity, so opportunities belong in the analysis alongside threats.
What is the difference between risk assessment and risk management?
Risk assessment is identification, analysis and evaluation. Risk management is wider: principles, a framework and a process that also includes communication, context setting, treatment, monitoring, review, recording and reporting. Assessment is therefore one component inside the process.
How should I answer a question that asks me to apply the definition of risk to a case?
Start by writing the objective as a measurable result with a time frame. Then list the uncertainties that could move it, such as competitors, regulation or demand. Finish with both negative and positive effects, and a sentence stating that the risk is the effect of those uncertainties on that objective. The structure earns marks even when the case is unfamiliar.
Exam move
Write the definition of risk at the top of a page and annotate each word with its note from the standard. Then list the eight principles from memory and, for each, find a sentence in any public risk policy that shows it.
Practise the certification question until your answer always offers the alternative uses of the standard, and practise stating an objective, its uncertainties and both positive and negative effects for a case of your own choosing.
Before the exam, rehearse two contrasting cases, one commercial and one public sector, so you can show the definition working in different settings, and write a one-line answer to the certification question that you can reuse word for word.
Working through Risk and the ISO 31000 Framework in RISK5002? Sia is AskSia’s AI Finance tutor — ask any RISK5002 Risk and the ISO 31000 Framework question and get a clear, step-by-step explanation grounded in how RISK5002 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
