Strategic Risk-Management Framework

Patrick McConnell

This chapter covers the topic of developing a risk-management framework for managing strategic risks, in particular concentrating on the most up-to-date international standard created by the International Standards Organisation (ISO). After discussing the new ISO 31000 standard, the chapter describes its recommended risk-management framework, concentrating on the governance at board level and the organisation of strategic risk management activities.

ISO 31000 RISK-MANAGEMENT STANDARD

There are a number of so-called risk-management frameworks (RMFs) that have been created by industry bodies for specific purposes, such as the “Practice Standard for Project Risk Management” (PRM).¹¹Developed by the Project Management Institute (PMI 2009), which also develops the widely used Project Management – Body of Knowledge (PMBOK). See http://www.pmi.org/. There are also a number of generic RMFs that are not industry- or discipline-specific, most notably COSO²²The COSO framework was developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), a privately funded body of peak US accounting and auditing organisations (see COSO 2004). and OCEG.³³The nonprofit think