NTC-ISO 31000

NTC-ISO 31000

1. The ISO 31000 standard is a tool that establishes a series of principles for the implementation of a Risk Management System in companies. As said before, it can be applied to any type of organization independent of its size, company name, market, source of capital, commercial spectrum. or form of financing. It does not specify any specific area or sector.

   • Parts of the ISO 31000 standard: For a better understanding of its principles and guidelines, ISO 31000: 2009 divides its content into three basic areas:
     • Principles and guidelines: The ISO 31000 standard serves as a reference for other standards on Management Risk. In addition, it complements the information of various regulations in the local, regional, national or even continental level. In this first section, explains not only the scope of it, but also details the basic practices that should be taken into account by any organization willing to implement a Risk Management System. The 11 principles exposed are: • Management creates value for the organization. • It must be integrated into the processes. • It is part of the decision making in the company. • Explicitly address uncertainty. • It must be systematic, structured and adequate. • It needs to be based on the best information available. • It must be adapted to the measure of each case.
     • Risk management: The ISO 31000 standard defines Risk Management as all those actions coordinated to direct and control the risks to which they may be doomed the organizations. In this second section, the objective is to draw a framework of action to know what aspects to manage and how to do it. Management has to see, above all, with the quantification of risks, for which it is essential define two elements within this process: - Consequence: The standard defines the consequence as the effects or those elements that are they derive directly or indirectly from others. In this case, it is a question of evaluating the risks that meet the cause-effect premise. - Probability: This second term speaks of the possibility of an event occurring. For Risk Management, it is essential that companies contemplate the irruption of facts that may or may not be derived from the decisions of the company.
     • Management vocabulary: Finally, in this last part, the ISO 31000 standard proposes a set of conclusions on the implementation of a Risk Management System. In In this sense, it complements the information in the two previous sections with a glossary specialized in this matter. If the process is carried out following the basic principles, the results to be obtained will be the following: • Improve the identification of opportunities and threats. • Optimize business management. • Increase trust in interest groups (stakeholders). • Establish a basis for decision making. • Improve controls and monitoring and follow-up methods. • Optimize prevention and incident management
   • Risk analysis methodologies
     • Since the risks do not have the same origin and the same nature, there are various strategies for its management. However, other factors that have a significant impact are the size of the companies, their number of members, their structure, production activity and the sector in which they operate
       • Risk management methodologies: They are those that are oriented to the identification, evaluation and subsequent treatment of the risks derived from an activity. Among them is, Obviously, the ISO 31000 standard. There are also other standards, such as the AS / NZS 4360 standard, which proposes a model of analysis focused on the principles of the ISO 9000 family of standards.
       • Quantification methodologies: In this case, these are those tools that focus exclusively on the quantification of risks. That is, they apply a series of indicators (almost always numerical) to measure the impact that have the risks in organizations and, based on that calculation, elaborate coordinated actions for its management, treatment or even elimination. - Magerit: it is a risk analysis and management methodology that it has been prepared by the Superior Council of Administration. It is specifically designed for companies that work with digital information and computer-type services Delphi: it is a method aimed at knowing the opinion of experts. In At first, a group of anonymous specialists responds to a questionnaire developed by an organization on a specific topic, in in this case Risk Management
   • Qualitative Methods
     • It is the risk analysis method most used in decision-making in business projects, entrepreneurs rely on their judgment, experience and intuition for decision making. They can be used when the level of risk is low and does not justify the time and resources needed to do a complete analysis.
       • Semi-quantitative methods
         • Word classifications such as high, medium or low are used, or descriptions more detailed probability and consequence. These classifications are demonstrated in relation to a scale appropriate to calculate the level of risk. Attention should be paid to the scale used in order to avoid misunderstandings or misinterpretations of the calculation results.
           • Quantitative methods
             • Quantitative methods are considered to be those that allow assigning values of occurrence to the different risks identified, that is, calculate the level of project risk. Quantitative methods include: • Probability analysis • Consequence analysis • Computational simulation
   • Risk management process
     • The ISO 31000 standard has a process approach. The implementation of a Risk Management System, therefore, must follow a series of steps to that is effective and meets the objectives set at the beginning. The basic steps are
       • 1. Definition of objectives: In this first stage the objectives of the process are defined. That is, it is made clear what is being sought with the implementation of the Risk Management System and what should be its scope.
       • 2. Appointment of managers: Next, the management must delegate the coordination of Risk Management tasks to one or more managers. This will depend on the size of each organization and the number of its employees. Be that as it may, the only certain thing is that the strategy should involve different people in the process
       • 3. Identification of risks: Through meetings between the various managers, the company must define what are the factors that influence the processes. And of all those, it is necessary prioritize them based on the impact they have. Let us remember that in a process not all actions have the same degree of importance. A good way to measure the impact of a risk is through the following table of values: a) What area of ​​the company does it affect? b) How does it affect you? c) What effects does it have on that area? d) What effects does it have on the organization as a whole? e) What margin of maneuver does it grant? f) What reaction time does the management allow? g) What degree of complexity do your solutions require? h) What are the consequences of not facing it?
       • 4. Risk analysis The objective is to establish an assessment and prioritization of risks in order to classify them. The analysis will depend on the information available on the risk and its origin. To advance it, it is necessary to design scales that can be qualitative or quantitative.
       • 5 . Definition of responses to risks: The definition will obey the three previous steps, especially the identification of the risks and their effects on the processes. The idea is to propose the solutions more suitable to put a face to those elements that hinder the achievement of the strategic objectives of the companies.

Images and files in the map