PMGT5891 Chap.3 ISO 31000 Principles, Framework and Process
ISO 31000 Principles, Framework and Process
ISO 31000:2018 is the international guideline this unit leans on most, and it is built from three linked parts. The principles describe what effective risk management looks like, with the creation and protection of value as their purpose. The framework sets up the organisational arrangements, centred on leadership and commitment.
The process is the working cycle of scope, context and criteria, assessment, treatment, monitoring and review, communication and consultation, and recording and reporting. This chapter maps all three, shows how the 2018 edition differs from the 2009 one, and compares the ISO process with the PMI approach and with the nine standards reviewed by Raz and Hillson.
What this chapter covers
- 01
Purpose of risk management: creating and protecting value
- 02
The eight principles of the 2018 edition and the PACED shorthand
- 03
Framework components around leadership and commitment
- 04
Scope, context and risk criteria
- 05
Risk assessment: identification, analysis, evaluation
- 06
Treatment as an iterative cycle
- 07
Rails that run throughout: consultation, monitoring, recording
- 08
ISO 31000 beside PMI terminology and older standards
Worked example · free
Applying ISO 31000 evaluation to a hospital records cut-over
- +1The 4 hour limit is a risk criterion, set under scope, context and criteria (clause 6.3.4), because it states how much risk the hospital may take relative to its objective of keeping clinical systems available.
- +1Before treatment: 6 hours exceeds the 4 hour criterion by 6 minus 4 = 2 hours, which is 2 divided by 4 = 50% over the limit. Evaluation (clause 6.4.4) therefore points to the decision to consider risk treatment.
- +1After treatment: 2.5 hours sits inside the criterion with 4 minus 2.5 = 1.5 hours of margin. The remaining risk is acceptable, so it is recorded and kept under monitoring rather than treated again.
- +1Monitoring and review (clause 6.6) tracks the migration hour by hour, and communication and consultation (clause 6.2) keeps clinicians informed; recording and reporting (clause 6.7) would also be a correct answer.
Key terms
- Risk
- Risk is the effect of uncertainty on objectives, in the wording of ISO 31000:2018. A note to the definition adds that the effect can be positive, negative or both.
- Risk management
- Risk management is the coordinated effort an organisation makes to steer and control itself where risk is concerned.
- Risk criteria
- Risk criteria are the yardsticks used to judge how significant a risk is, including how much risk, and of what kind, an organisation is prepared to carry while chasing its objectives.
- Risk assessment
- Risk assessment is the umbrella stage that bundles three steps together: identifying risks, analysing them and then evaluating them against criteria.
- Control
- A control is a measure that maintains or modifies risk, such as a process, policy, device or practice; ISO notes that controls may not always have the intended effect.
ISO 31000 Principles, Framework and Process FAQ
What are the eight principles of ISO 31000:2018?
They are integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, and continual improvement. All eight serve one purpose, the creation and protection of value. An IRM guide treats the first five as design principles and the last three as operating principles.
What is the difference between the ISO 31000 framework and the process?
The framework is the organisational set-up: leadership and commitment at the centre, surrounded by integration, design, implementation, evaluation and improvement. The process is the cycle applied to a particular decision, project or activity, running from scope, context and criteria through assessment and treatment, with consultation, monitoring and recording alongside.
How did ISO 31000 change from 2009 to 2018?
The 2018 edition reviewed the principles, cutting them from eleven to eight, highlighted leadership by top management and integration starting with governance, placed more weight on iteration, and streamlined the text. The framework element once called mandate and commitment became leadership and commitment, and the title changed from Principles and guidelines to Guidelines.
Why is the ISO 31000 process drawn as a loop?
Because the standard says that although the process is often shown as sequential, in practice it is iterative. Treatment sends risks back for reassessment, criteria are reviewed as conditions change, and consultation, monitoring and recording happen during every step rather than at the end of the cycle.
Exam move
Start by drawing the three-part map from memory: a ring of eight principles around value, a ring of five components around leadership and commitment, and the process column with its two rails and base bar. Check the drawing against the 2018 text, not the 2009 one, because the clause numbers differ.
Next, write one sentence for each process clause in your own words and attach one verb to it, such as identify, analyse, evaluate or treat. Then take a short case from class, for example the Denver Fire Department or a project from your workplace, and walk it through scope, assessment, treatment and the rails, naming the clause each time.
Finish by listing three PMI or PMBOK Guide names beside their ISO equivalents, and practise explaining in two sentences why Raz and Hillson saw more agreement than difference between standards.
Working through ISO 31000 Principles, Framework and Process in PMGT5891? Sia is AskSia’s AI Project Management tutor — ask any PMGT5891 ISO 31000 Principles, Framework and Process question and get a clear, step-by-step explanation grounded in how PMGT5891 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
