Fundamentals of Risk Management

stakeholders and core processes
Core processes deliver stakeholder expectations and are related to the internal
and external context of the organization. Therefore, a risk can be defined as an
event with the potential to impact the fulfilment of a stakeholder expectation. This
approach has the advantage that both internal and external stakeholders can be 
identified, together with their short-term, medium-term and long-term expect ations. 
Figure 29.1 provides a graphical illustration of the relationship between stakeholder 
expect ations and the core processes of the organization. The figure illustrates that 
the core processes of an organization can be strategic, tactical, operational or com-
pliance (STOC). Figure 29.1 shows compliance core processes as separate processes, 
although compliance core processes should also underpin and support the other 
types of core processes.

---

stakeholder expectations
355
This classification of core processes as strategic, tactical and operational is 
acknowledged in British Standard BS 31100 when it discusses risk management
perspectives. Strategic perspectives set the future direction of the business; tactical 
perspectives are concerned with turning strategy into action by achieving change; 
and operational perspectives are related to the day-to-day operations of the organ-
ization, including people, information security, health and safety, and business
continuity. Again, compliance processes are assumed to underpin the other types of 
core processes.
FIgURE 
29.1
Importance of core processes
Core processes
Internal
evaluation
Strategic or
business plan
(and annual budget)
External
evaluation
Corporate objectives
Stakeholder expectations
Strategic
Compliance
Tactical
Processes to deliver
and enhance the
business model
Influence