Global standards related to risk management are documents that provide the principles, guidelines, and best practices for managing risk in a consistent, effective, and efficient manner across different organizations, sectors, and regions12.
The primary reason for a risk practitioner to use global standards related to risk management is to continuously improve risk management processes, which are the activities and tasks that enable the organization to identify, analyze, evaluate, treat, monitor, and communicate the risks that may affect its objectives, performance, and value creation34.
Continuously improving risk management processes is the primary reason because it helps the organization to enhance its risk management capabilities and maturity, and to adapt to the changing risk environment and stakeholder expectations34.
Continuously improving risk management processes is also the primary reason because it supports the achievement of the organization’s goals and the delivery of value to the stakeholders, which are the ultimate purpose and outcome of risk management34.
The other options are not the primary reason, but rather possible benefits or objectives that may result from using global standards related to risk management. For example:
Building an organizational risk-aware culture is a benefit of using global standards related to risk management that involves creating and maintaining a shared understanding, attitude, and behavior towards risk among the organization’s employees and leaders, and fostering a culture of accountability, transparency, and learning34. However, this benefit is not the primary reason because it is an enabler and a consequence of continuously improving risk management processes, rather than a driver or a goal34.
Complying with legal and regulatory requirements is an objective of using global standards related to risk management that involves meeting and exceeding the expectations and obligations of the external authorities or bodies that govern or oversee the organization’s activities and operations, such as laws, regulations, standards, or contracts34. However, thisobjective is not theprimary reason because it is a constraint and a challenge of continuously improving risk management processes, rather than a motivation or a benefit34.
Identifying gaps in risk management practices is an objective of using global standards related to risk management that involves assessing and comparing the current and desiredstate of the organization’s risk management processes, and identifying the areas or aspects that need to be improved or addressed34. However, this objective is not the primary reason because it is a step and a tool of continuously improving risk management processes, rather than a reason or a result34. References =
1: ISO - ISO 31000 — Risk management1
2: Risk Management Standards2
3: Risk IT Framework, ISACA, 2009
4: IT Risk Management Framework, University of Toronto, 2017
