Fundamentals of Risk Management

70

---

06
Risk management 
standards
scope of risk management standards
There are a number of established risk management standards and frameworks.
The first was developed by the standards body in Australia in 1995, and has been 
followed by those being developed in Canada, Japan, the UK and the United States. 
Standards have also been developed by other national standards bodies, as well as by 
government departments across the world.
The overall approach of each of these standards is similar. The standard that had 
the widest recognition was the Australian Standard AS 4360 (2004), but this was 
withdrawn in 2009 in favour of ISO 31000. The ERM version of the COSO standard 
is also widely applied in many organizations. British Standard BS 31100:2011 ‘Risk 
Management: Code of Practice and Guidance for the Implementation of BS ISO 
31000’ was published in 2011. Further guidance to the ISO standard was published 
in 2013 as ISO/TR 31004:2013 ‘Risk Management – Guidance for the Implementa-
tion of ISO 31000’.
The international standard ISO 31000 (2009), ‘Risk Management: Principles and 
Guidelines’, was published in the latter part of 2009. Although some standards are 
better recognized than others, organizations should select the approach that is most 
relevant to their particular circumstances.
It is important to distinguish between a risk management standard and a risk 
management framework. A risk management standard sets out the overall approach 
to the successful management of risk, including a description of the risk management 
process, together with the suggested framework that supports that process.
In simple terms, a risk management standard is the combination of a description 
of the risk management process, together with the recommended framework. The 
key features of a risk management framework are described later in this chapter. 
Table 6.1 provides a summary of the most widely used risk management standards 
and frameworks.
One of the best-established and most widely used risk management standards 
was produced by the IRM in 2002 in co-operation with Airmic and Alarm. The IRM 
Standard is a high-level approach aimed at non-risk-management specialists and it