Fundamentals of Risk Management

Standard
Description
reference
ISO 31000
Standard published by the International 
Standards Organization (2009)
Figure 6.4
Institute of Risk
Management (IRM)
Standard produced jointly by
Airmic, Alarm and the IRM (2002)
Figure 6.1
COSO ERM
Framework produced by the Committee of
Sponsoring Organizations of the Treadway 
Committee (2004)
Figure 6.3
CoCo (Criteria of 
Control)
Framework produced by the Canadian
Institute of Chartered Accountants
(1995)
Figure 33.1

---

Risk management standards
73
FIgURE 
6.1
IRM risk management process
The Risk Management Process
Modification
Formal Audit
The Organization’s
Strategic Objectives
Risk Reporting
Threats and Opportunities
Risk Analysis
Risk Identification
Risk Description
Risk Estimation
Risk Assessment
Risk Evaluation
Decision
Risk Treatment
Residual Risk Reporting
Monitoring
soURCe: IrM/airmic/alarm (2002).
Apart from the British, ISO and COSO standards, a number of others are also
well regarded and in widespread use. The UK’s risk guidance from the Financial 
Reporting Council (FRC) was updated in 2014 and is considered by the Securities 
and Exchange Commission (SEC) in the United States to be an acceptable alternative 
to the COSO Internal Control framework for Sarbanes–Oxley compliance. The
updated risk guidance can be found as a free download from the website of
the UK-based FRC.
As well as the established standards and frameworks, a considerable amount of 
guidance on risk management has been published by various government depart-
ments. HM Treasury in the UK has published the highly respected Orange Book, which 

---