05 ISO 31000 Risk Management

ISO 31000 provides internationally recognized guidance for establishing an effective enterprise risk management approach.

Unlike frameworks focused specifically on cybersecurity controls or compliance requirements, ISO 31000 provides a broader methodology that can be applied to almost any type of organizational risk.

Examples include:

Cybersecurity Risk

Technology Risk

Operational Risk

Third-Party Risk

Privacy Risk

Compliance Risk

Financial Risk

Strategic Risk

Project Risk

Supply Chain Risk

Business Continuity Risk

ISO 31000 helps organizations answer:

What Could Happen?

Why Could It Happen?

How Likely Is It?

What Would the Impact Be?

How Much Risk Are We Willing to Accept?

What Controls Already Exist?

What Should We Do About the Risk?

Who Owns the Risk?

How Will We Monitor It?

When Should Leadership Be Involved?

At a high level:

Business Objectives
        ↓
Risk Identification
        ↓
Risk Analysis
        ↓
Risk Evaluation
        ↓
Risk Treatment
        ↓
Monitoring
        ↓
Continuous Improvement

Learning Objectives

By the end of this lesson, you will be able to:

• Explain the purpose of ISO 31000.

• understand enterprise risk management.

• understand the ISO 31000 principles.

• understand the ISO 31000 framework.

• understand the ISO 31000 risk-management process.

• establish risk context.

• identify enterprise risks.

• distinguish threats, vulnerabilities, events, consequences, and risks.

• perform qualitative risk analysis.

• understand quantitative risk analysis.

• evaluate likelihood and impact.

• calculate inherent and residual risk.

• understand risk criteria.

• understand risk appetite.

• understand risk tolerance.

• understand risk capacity.

• understand risk ownership.

• select risk-treatment strategies.

• develop risk-treatment plans.

• build enterprise risk registers.

• define KRIs.

• monitor risk continuously.

• communicate risk to leadership.

• integrate ISO 31000 with cybersecurity and GRC frameworks.

1. What Is Risk?

Risk is fundamentally associated with uncertainty and objectives.

Organizations establish objectives such as:

Protect Customer Data

Maintain Service Availability

Meet Regulatory Requirements

Grow Revenue

Launch New Products

Protect Reputation

Uncertainty may affect achievement of those objectives.

Conceptually:

Objective
      ↓
Uncertainty
      ↓
Potential Effect
      ↓
Risk

Risk is therefore not simply:

Something Bad
Might Happen

It must be understood in relation to organizational objectives.

2. Risk Can Have Different Effects

Risk discussions often focus on negative outcomes.

Examples:

Data Breach

System Outage

Fraud

Regulatory Penalty

Vendor Failure

However, uncertainty may also create opportunities.

Example:

Cloud Migration

may introduce:

Security Risk

Vendor Dependency

Cost Risk

while also creating:

Scalability

Innovation

Faster Deployment

Reduced Infrastructure Cost

Risk management therefore supports informed decision-making rather than simply eliminating uncertainty.

3. What Is ISO 31000?

ISO 31000 provides:

Principles
      +
Framework
      +
Process

for managing risk.

Conceptually:

ISO 31000

Principles
      ↓
Framework
      ↓
Risk Management Process

4. ISO 31000 Is Not a Control Checklist

ISO 31000 does not tell an organization:

Deploy MFA

Configure Firewall

Enable EDR

Instead, it helps determine:

What Risks Exist?

How Significant Are They?

What Treatment Is Appropriate?

Who Should Own Them?

How Should They Be Monitored?

Specific controls may then come from frameworks such as:

ISO 27001

NIST CSF

NIST 800-53

CIS Controls

PCI DSS

5. ISO 31000 Is Broadly Applicable

The methodology can support:

Enterprise Risk Management

Cybersecurity

Cloud Security

Privacy

Compliance

Third-Party Risk

Projects

Business Continuity

AI Governance

Supply Chain

Financial Risk

6. Enterprise Risk Management

Enterprise Risk Management connects risks across the organization.

Without ERM:

Cyber Team
Maintains Cyber Risks

IT Team
Maintains IT Risks

Finance
Maintains Financial Risks

Compliance
Maintains Compliance Risks

Leadership may never receive a consolidated view.

With ERM:

Cyber Risk
       \
Technology Risk
        \
Operational Risk
          ↓
Enterprise Risk View
          ↑
Compliance Risk
        /
Third-Party Risk
      /
Strategic Risk

7. Why Enterprise Risk Management Matters

Executives need to understand:

Which Risks
Could Prevent
Business Objectives?

not merely:

How Many
Security Findings
Exist?

8. ISO 31000 Principles

ISO 31000 establishes principles intended to make risk management effective.

The principles emphasize that risk management should be:

Integrated

Structured & Comprehensive

Customized

Inclusive

Dynamic

Based on Best
Available Information

Sensitive to Human
and Cultural Factors

Continuously Improved

9. Integrated

Risk management should be part of organizational activities.

Avoid:

Business Decision
      ↓
Project Starts
      ↓
Risk Team Involved
at the End

Prefer:

Business Decision
      ↓
Risk Consideration
      ↓
Project Planning
      ↓
Implementation

10. Structured and Comprehensive

Risk management should follow a consistent approach.

Without structure:

Team A
High Risk

Team B
Medium Risk

Team C
Critical Risk

may all describe the same exposure differently.

A common methodology improves consistency.

11. Customized

Risk management should reflect the organization’s:

Business Model

Industry

Objectives

Risk Profile

Regulations

Technology

Culture

A bank and a small software startup should not necessarily use identical risk-management models.

12. Inclusive

Relevant stakeholders should participate in risk decisions.

Examples:

Business Owners

Technology Teams

Security

Legal

Privacy

Compliance

Finance

Executive Leadership

13. Dynamic

Risk changes.

Example:

Internal Application
      ↓
Low External Exposure

Later:

Application
Moved to Internet
      ↓
Exposure Changes
      ↓
Risk Changes

Risk assessments therefore cannot remain static.

14. Best Available Information

Risk decisions may use:

Historical Incidents

Threat Intelligence

Audit Findings

Vulnerability Data

Industry Reports

Expert Judgment

Business Forecasts

Risk information may still contain uncertainty.

That uncertainty should be acknowledged.

15. Human and Cultural Factors

People influence risk.

Examples:

Risk Awareness

Decision-Making

Behavior

Incentives

Leadership Culture

Skills

A strong policy may still fail when organizational culture encourages employees to bypass it.

16. Continual Improvement

Risk management should improve based on:

Incidents

Audits

Metrics

Lessons Learned

Technology Changes

Regulatory Changes

Business Changes

17. ISO 31000 Framework

The framework integrates risk management into organizational governance.

A simplified model:

Leadership
& Commitment
      ↓
Integration
      ↓
Design
      ↓
Implementation
      ↓
Evaluation
      ↓
Improvement

18. Leadership and Commitment

Effective risk management requires leadership support.

Leadership should establish:

Direction

Accountability

Resources

Risk Culture

Oversight

19. Integration

Risk management should integrate into:

Strategy

Projects

Technology

Procurement

Operations

Security

Compliance

Change Management

20. Design

Organizations design a risk-management framework based on:

Internal Context

External Context

Objectives

Governance

Responsibilities

Resources

21. Implementation

The organization puts the framework into operation.

This may include:

Risk Policy

Risk Methodology

Risk Register

Risk Committees

Assessment Process

Reporting

Escalation

22. Evaluation

Organizations evaluate whether risk management is working.

Ask:

Are Risks Identified?

Are Owners Assigned?

Are Treatments Completed?

Are High Risks Escalated?

Are Decisions Improving?

23. Improvement

Weaknesses identified through evaluation should drive improvement.

Evaluate
      ↓
Identify Weakness
      ↓
Improve
      ↓
Evaluate Again

24. ISO 31000 Risk Management Process

The process includes interconnected activities around:

Communication
& Consultation

and:

Monitoring
& Review

with the core assessment and treatment process:

Scope, Context
& Criteria
      ↓
Risk Assessment
      ↓
Risk Identification
      ↓
Risk Analysis
      ↓
Risk Evaluation
      ↓
Risk Treatment

Recording and reporting support the entire process.

25. Communication and Consultation

Risk management requires communication throughout the lifecycle.

Stakeholders may include:

Risk Owners

Business Owners

Security

Technology

Legal

Compliance

Executives

26. Scope

Define what is being assessed.

Examples:

Enterprise

Business Unit

AWS Environment

Payment Platform

Critical Vendor

AI Application

Customer Portal

27. Context

Understand the environment surrounding the risk.

Internal Context

Business Objectives

Technology

Processes

People

Policies

Risk Appetite

External Context

Threat Landscape

Regulations

Market Conditions

Suppliers

Customers

Geopolitical Factors

28. Risk Criteria

Organizations need criteria for determining risk significance.

Examples:

Likelihood Scale

Impact Scale

Risk Matrix

Risk Appetite

Escalation Threshold

29. Risk Assessment

Risk assessment consists primarily of:

Risk Identification
      ↓
Risk Analysis
      ↓
Risk Evaluation

These stages should not be confused.

30. Risk Identification

Risk identification asks:

What Could Happen?

Identify:

Risk Sources

Events

Causes

Consequences

Affected Objectives

31. Risk Identification Example

Business objective:

Maintain
Online Banking
Availability

Potential event:

DDoS Attack

Potential consequence:

Customer Service
Unavailable

Risk:

DDoS attack could disrupt
online banking services,
resulting in customer impact,
financial loss and
reputational damage.

32. Good Risk Statements

A useful structure is:

Cause
      ↓
Risk Event
      ↓
Business Impact

Example:

Weak privileged
access controls
      ↓
Administrator account
compromise
      ↓
Unauthorized access
to production systems
and sensitive data

33. Weak Risk Statements

Avoid entries such as:

Cybersecurity Risk

Cloud Risk

Ransomware

Vendor Risk

These are categories or threats rather than sufficiently descriptive risk statements.

34. Better Risk Statement

Instead of:

Ransomware

write:

A ransomware attack could
encrypt critical production
systems and backups,
resulting in prolonged
service disruption,
financial loss and
customer impact.

35. Threat vs Vulnerability vs Risk

These concepts are different.

Threat

Something capable of causing harm.

Ransomware Actor

Vulnerability

A weakness.

Unpatched
Internet-Facing Server

Risk

Potential effect on objectives.

Threat
      +
Vulnerability
      ↓
Potential Business Impact

36. Risk Analysis

Risk analysis asks:

How Significant
Is the Risk?

Consider:

Likelihood

Impact

Existing Controls

Uncertainty

37. Likelihood

Likelihood represents the possibility of an event occurring.

Example qualitative scale:

Score	Rating	Description
1	Rare	Highly unlikely
2	Unlikely	Could occur
3	Possible	May occur
4	Likely	Expected to occur
5	Almost Certain	Expected frequently

38. Impact

Impact represents the consequences if the risk materializes.

Example:

Score	Rating	Description
1	Insignificant	Minimal business impact
2	Minor	Limited impact
3	Moderate	Material operational impact
4	Major	Significant business impact
5	Severe	Enterprise-level impact

39. Impact Categories

Organizations may evaluate impact across:

Financial

Operational

Regulatory

Legal

Customer

Reputation

Safety

40. Financial Impact

Examples:

Revenue Loss

Recovery Cost

Regulatory Penalties

Contractual Penalties

41. Operational Impact

Examples:

Service Downtime

Production Failure

Employee Productivity Loss

Supply Chain Disruption

42. Regulatory Impact

Examples:

Compliance Breach

Regulatory Investigation

License Restrictions

Fines

43. Reputation Impact

Examples:

Customer Trust Loss

Negative Media

Investor Concern

Partner Concern

44. Risk Scoring

A simple qualitative model may use:

Risk Score =
Likelihood × Impact

Example:

Likelihood = 4

Impact = 5

Risk Score = 20

45. Example Risk Matrix

Likelihood \ Impact	1	2	3	4	5
5	5	10	15	20	25
4	4	8	12	16	20
3	3	6	9	12	15
2	2	4	6	8	10
1	1	2	3	4	5

Organizations define their own interpretation of scores.

46. Example Risk Ratings

1–4
Low

5–9
Medium

10–16
High

17–25
Critical

These thresholds are examples, not universal ISO requirements.

47. Risk Matrix Limitations

Risk matrices provide consistency but can create false precision.

For example:

Likelihood = 4
Impact = 4

does not mean risk is scientifically proven to equal:

16

The number supports prioritization and communication.

48. Inherent Risk

Inherent risk represents risk before considering existing controls.

Conceptually:

Risk Scenario
      ↓
No Existing Controls
      ↓
Inherent Risk

49. Residual Risk

Residual risk represents risk remaining after considering controls.

Inherent Risk
      ↓
Controls
      ↓
Residual Risk

50. Example

Risk:

Administrator
Account Compromise

Inherent:

Likelihood: 4
Impact: 5

Score: 20
Critical

Controls:

MFA

PAM

Conditional Access

Monitoring

Residual:

Likelihood: 2
Impact: 5

Score: 10
High

The impact may remain severe even though controls reduce likelihood.

51. Control Effectiveness

Controls should not automatically reduce risk merely because they exist.

Assess whether controls are:

Designed Effectively

Implemented

Operating Effectively

52. Control Example

Control:

MFA Required
for Administrators

Policy exists.

But evidence shows:

12 Admin Accounts

9 MFA Enabled

3 MFA Disabled

The control is not fully effective.

53. Risk Evaluation

Risk evaluation asks:

Is the Risk
Acceptable?

Compare analyzed risk against:

Risk Criteria

Risk Appetite

Tolerance

Business Priorities

54. Risk Appetite

Risk appetite describes the amount and type of risk an organization is willing to pursue or retain.

Examples:

Innovation Risk
Moderate Appetite

Cybersecurity Risk
Low Appetite

Regulatory Risk
Very Low Appetite

55. Risk Tolerance

Tolerance defines acceptable variation around objectives or risk limits.

Example:

Risk Appetite:
Low Service Disruption

Tolerance:

Maximum Critical
Service Downtime:
2 Hours

56. Risk Capacity

Risk capacity represents the maximum risk the organization can absorb before threatening its viability or objectives.

Conceptually:

Risk Appetite
      <
Risk Capacity

57. Risk Appetite Example

An organization may state:

We have very low appetite
for unauthorized disclosure
of customer financial data.

This should influence:

Security Controls

Investment

Monitoring

Escalation

58. Risk Treatment

When risk requires action, organizations select an appropriate treatment.

Common strategies include:

Avoid

Reduce

Share / Transfer

Accept

59. Risk Avoidance

Avoid the activity creating the risk.

Example:

High-Risk
Unsupported Platform
      ↓
Retire Platform

60. Risk Reduction

Implement controls that reduce likelihood or impact.

Example:

Account Compromise Risk
      ↓
MFA
PAM
Monitoring

61. Risk Sharing or Transfer

Risk may be shared or transferred through:

Insurance

Contracts

Outsourcing

Indemnification

But:

Financial Exposure
May Transfer

while:

Accountability
May Remain

62. Risk Acceptance

Management may accept risk when:

Risk Within Appetite

Treatment Cost
Exceeds Benefit

Business Requirement
Requires Acceptance

Acceptance should be authorized.

63. Risk Acceptance Example

Risk:
Legacy Application
Uses Unsupported Component

Business Need:
Application Retires
in 60 Days

Compensating Controls:
Network Isolation
Monitoring

Decision:
Accept for 60 Days

64. Risk Treatment Plan

Document:

Risk

Treatment

Action

Owner

Due Date

Resources

Target Residual Risk

Status

65. Risk Owner

Every material risk should have an owner.

The risk owner should have sufficient authority to:

Understand Risk

Make Decisions

Approve Treatment

Accept Residual Risk

66. Risk Owner vs Control Owner

These roles are different.

Risk Owner
      ↓
Owns Business Risk

Control Owner
      ↓
Operates Specific Control

67. Example

Risk:

Customer Platform
Unavailable

Risk owner:

Head of Digital Banking

Control owners:

Infrastructure Team

Cloud Team

Security Team

BCP Team

68. Risk Register

The risk register is a central GRC artifact.

Typical fields include:

Risk ID

Risk Title

Risk Statement

Category

Business Objective

Asset / Process

Threat

Vulnerability

Likelihood

Impact

Inherent Risk

Controls

Control Effectiveness

Residual Risk

Risk Owner

Treatment

Due Date

Status

69. Example Risk Register

ID	Risk	Likelihood	Impact	Residual	Owner
R-001	Ransomware disruption	4	5	High	CIO
R-002	Privileged compromise	3	5	High	CISO
R-003	Critical vendor outage	3	4	Medium	Business Owner

70. Risk Categories

An enterprise taxonomy may include:

Strategic

Operational

Technology

Cybersecurity

Privacy

Compliance

Third-Party

Financial

Business Continuity

71. Risk Taxonomy

A taxonomy creates consistent classification.

Example:

Enterprise Risk
      ↓
Technology
      ↓
Cybersecurity
      ↓
Identity
      ↓
Privileged Access

72. Risk Aggregation

Individual risks may combine into enterprise exposure.

Example:

Vendor A Risk
Vendor B Risk
Vendor C Risk
      ↓
Cloud Concentration Risk

73. Concentration Risk

Example:

80% of Critical
Applications
Depend on
One Cloud Provider

Even individually secure applications may create strategic dependency.

74. Risk Interdependency

Risks may influence one another.

Example:

Cloud Outage
      ↓
Customer Service Failure
      ↓
Revenue Loss
      ↓
Reputation Damage

75. Risk Velocity

Risk velocity considers:

How Quickly
Will the Impact
Materialize?

Example:

Ransomware
Minutes / Hours

versus:

Skills Shortage
Months / Years

76. Risk Horizon

Risk horizon considers when a risk may become significant.

Example:

Immediate

Short Term

Medium Term

Long Term

77. Emerging Risks

Examples may include:

AI Governance

Quantum Computing

Geopolitical Supply Chain Risk

New Privacy Regulation

New Attack Techniques

Emerging risks may have high uncertainty.

78. Risk Indicators

Organizations use Key Risk Indicators (KRIs) to monitor changes in exposure.

Examples:

Critical Vulnerabilities

Privileged Accounts
Without MFA

Vendor SLA Breaches

Backup Failures

Security Incidents

Overdue Risk Treatments

79. KRI Example

Risk:

Ransomware

KRIs:

Critical Vulnerabilities
Past SLA

Endpoints Without EDR

Backup Failures

Phishing Failure Rate

80. KRI Thresholds

Example:

Green
0–2 Critical
Vulnerabilities

Amber
3–5

Red
>5

Thresholds should align with risk appetite and context.

81. KRI vs KPI

A KPI measures performance.

Example:

Patch SLA
Compliance

A KRI indicates changing risk exposure.

Example:

Internet-Facing
Critical Vulnerabilities
Past SLA

82. KRI vs KCI

A KCI measures control performance.

Example:

MFA Coverage
99%

A KRI may measure:

Privileged Accounts
Without MFA

83. Risk Monitoring

Risks should be reviewed according to:

Criticality

Change

Threat Environment

Business Events

Treatment Status

84. Event-Driven Risk Review

Reassess risk after:

Major Incident

Acquisition

Cloud Migration

New Regulation

New Vendor

Architecture Change

Major Vulnerability

Business Expansion

85. Periodic Risk Review

Organizations may establish:

Monthly

Quarterly

Semiannual

Annual

reviews depending on risk.

86. Recording and Reporting

Risk-management activities should be documented.

Records provide:

Traceability

Accountability

Decision History

Audit Evidence

87. Executive Risk Reporting

Executives generally need:

Top Risks

Risk Trends

Appetite Breaches

Overdue Treatments

Emerging Risks

Decisions Required

88. Example Executive Dashboard

ENTERPRISE RISK DASHBOARD

Critical Risks               4

High Risks                  12

Risks Above Appetite         5

Overdue Treatments           7

Emerging Risks               3

89. Risk Trend

Useful reporting includes:

Increasing ↑

Stable →

Decreasing ↓

90. Example

R-001 Ransomware

Current:
High

Previous:
Medium

Trend:
Increasing ↑

Reason:
Increase in actively
exploited vulnerabilities

91. Heat Maps

Risk heat maps provide visual prioritization using:

Likelihood
      ×
Impact

But heat maps should not replace contextual analysis.

92. Executive Risk Questions

Good reporting should answer:

What Changed?

Why Did It Change?

Which Objectives
Are Threatened?

Are We Above Appetite?

Who Owns the Risk?

What Is Being Done?

When Will It Improve?

What Decision
Is Required?

93. Risk Escalation

Define thresholds for escalation.

Example:

Low
Business Owner

Medium
Department Management

High
Risk Committee

Critical
Executive Committee

94. Risk Committees

Organizations may use:

Enterprise Risk Committee

Technology Risk Committee

Cybersecurity Committee

Third-Party Risk Committee

95. Risk Acceptance Authority

Acceptance authority should correspond to risk significance.

Example:

Residual Risk	Acceptance Authority
Low	Manager
Medium	Director
High	Executive
Critical	Executive Committee / Board

Exact authority depends on organizational governance.

96. Quantitative Risk Analysis

Some organizations estimate risk financially.

Conceptually:

Expected Financial Loss

may consider:

Event Frequency

Loss Magnitude

97. Example

Suppose:

Estimated Incident Loss:
₹10,000,000

Estimated Frequency:
0.2 per year

Simplified annualized exposure:

₹10,000,000 × 0.2

= ₹2,000,000
per year

This is a simplified illustration rather than a complete quantitative model.

98. Why Quantification Helps

It allows comparison between:

Risk Exposure

and:

Control Investment

Example:

Expected Annual Loss:
₹20 Million

Control Cost:
₹3 Million

Expected Reduction:
70%

This supports investment decisions.

99. Uncertainty in Quantification

Financial estimates should not be presented as certainty.

Prefer:

Potential Loss Range

rather than:

Exact Loss

when evidence is limited.

100. Scenario Analysis

Example scenarios:

Best Case

Expected Case

Worst Case

for a major cloud outage.

101. Risk Treatment Effectiveness

After treatment:

Original Risk
      ↓
Treatment
      ↓
Reassess
      ↓
Residual Risk

102. Treatment Does Not Automatically Close Risk

Example:

Action:
Deploy MFA

After implementation verify:

Coverage

Exceptions

Effectiveness

Monitoring

103. Risk Closure

Risk may be closed when:

Risk No Longer Exists

Activity Ends

Asset Retired

Exposure Removed

A treated risk may instead remain open with a lower residual rating.

104. Risk Exceptions

Exceptions should document:

Requirement

Reason

Risk

Compensating Controls

Approver

Expiration Date

105. Exceptions Need Expiration

Avoid:

Permanent
Exception

Prefer:

Exception
      ↓
Expiry
      ↓
Review
      ↓
Renew or Remediate

106. ISO 31000 and Cybersecurity

Cybersecurity risk can use the same enterprise methodology.

Example:

Business Objective:
Protect Customer Data
      ↓
Threat:
Credential Theft
      ↓
Weakness:
Weak Authentication
      ↓
Risk:
Unauthorized Data Access
      ↓
Treatment:
MFA + Monitoring

107. ISO 31000 and NIST CSF

ISO 31000 provides enterprise risk principles and methodology.

NIST CSF provides cybersecurity risk outcomes.

Conceptually:

ISO 31000
Enterprise Risk
      ↓
NIST CSF
Cybersecurity Outcomes

108. ISO 31000 and ISO 27001

ISO 31000 can support the broader organizational risk methodology.

ISO 27001 applies risk-based thinking within an information security management system.

Enterprise Risk
ISO 31000
      ↓
Information Security Risk
ISO 27001

109. ISO 31000 and COBIT

COBIT provides governance of enterprise information and technology.

ISO 31000 provides general risk-management guidance.

Together:

COBIT
Technology Governance
      ↓
Risk Governance
      ↓
ISO 31000
Risk Management

110. ISO 31000 and CIS Controls

Risk assessment may identify:

Ransomware Risk

CIS Controls can provide practical safeguards to help reduce that exposure.

Risk
      ↓
Treatment Requirement
      ↓
CIS Safeguards

111. ISO 31000 and Third-Party Risk

Vendor risk example:

Critical SaaS Provider
      ↓
Provider Outage
      ↓
Business Service
Unavailable

Analyze:

Likelihood

Impact

Existing Resilience

Alternative Providers

Recovery

112. ISO 31000 and Privacy

Privacy risk example:

Excessive Personal
Data Collection
      ↓
Unauthorized Exposure
      ↓
Privacy Harm
+
Regulatory Impact

113. ISO 31000 and Business Continuity

Risk analysis helps identify:

Critical Processes

Disruption Scenarios

Dependencies

Consequences

which can support business continuity planning.

114. ISO 31000 and Cloud Risk

Example:

Public Cloud Storage
Misconfiguration
      ↓
Sensitive Data Exposure

Treatments:

Configuration Policies

CSPM

Encryption

Access Control

Monitoring

115. ISO 31000 and AI Risk

Example:

Generative AI
Application
      ↓
Sensitive Data
Entered into Model
      ↓
Information Exposure

Risk management can evaluate:

Business Value

Data Risk

Privacy

Security

Compliance

Third Parties

116. Risk Assessment Workflow

A practical GRC workflow:

Define Scope
      ↓
Understand Objectives
      ↓
Identify Risks
      ↓
Identify Controls
      ↓
Assess Inherent Risk
      ↓
Evaluate Controls
      ↓
Assess Residual Risk
      ↓
Compare with Appetite
      ↓
Treat / Accept
      ↓
Monitor

117. Step 1 — Understand Objectives

Before identifying risk, ask:

What Are We
Trying to Achieve?

Example:

Process:
Online Payment Platform

Objective:
Process Payments
Securely and Reliably

118. Step 2 — Identify Critical Assets

Examples:

Payment Application

Customer Data

Database

Cloud Infrastructure

Identity Platform

119. Step 3 — Identify Risk Scenarios

Examples:

Credential Compromise

Application Exploitation

Cloud Misconfiguration

Ransomware

DDoS

Vendor Outage

120. Step 4 — Assess Inherent Risk

Example:

Credential Compromise

Likelihood:
4

Impact:
5

Inherent:
Critical

121. Step 5 — Identify Existing Controls

MFA

PAM

EDR

SIEM

Network Segmentation

Security Awareness

122. Step 6 — Assess Control Effectiveness

Possible ratings:

Effective

Partially Effective

Ineffective

123. Step 7 — Determine Residual Risk

Example:

Inherent:
Critical

Controls:
Strong

Residual:
Medium

124. Step 8 — Compare with Appetite

Residual Risk:
Medium

Appetite:
Low

Therefore:

Additional Treatment
Required

125. Step 9 — Develop Treatment

Example:

Deploy PAM

Remove Shared Admin Accounts

Implement JIT Access

126. Step 10 — Monitor

Track:

Privileged Accounts

MFA Coverage

PAM Coverage

Privileged Incidents

127. Risk Assessment Deliverable

A professional assessment should explain:

What the Risk Is

Why It Matters

How It Was Rated

Which Controls Exist

How Effective They Are

What Residual Risk Remains

What Management Should Do

128. Common Mistake — Risk Equals Vulnerability

Weak:

Critical CVE

Better:

Exploitation of the
internet-facing vulnerability
could allow unauthorized access
to the payment environment,
resulting in service disruption
and potential data exposure.

129. Common Mistake — Risk Equals Finding

MFA Missing

is generally a control gap.

The risk might be:

Unauthorized access
through compromised
credentials.

130. Common Mistake — Risk Register Becomes Finding Register

Avoid filling enterprise risk registers with thousands of:

Vulnerabilities

Configuration Findings

Audit Observations

Aggregate them into meaningful business risk scenarios where appropriate.

131. Common Mistake — Every Risk Is Critical

If everything is:

Critical

then nothing is effectively prioritized.

132. Common Mistake — Ignore Existing Controls

Inherent risk and residual risk should be distinguished.

133. Common Mistake — Assume Controls Are Effective

Control documentation alone does not prove effectiveness.

134. Common Mistake — No Risk Owner

A risk without ownership often becomes:

Everyone's Problem
      ↓
Nobody's Responsibility

135. Common Mistake — Security Owns Business Risk

Security may identify and advise on risk.

The accountable risk owner should normally be associated with the business objective or process affected.

136. Common Mistake — Acceptance Without Authority

A technical administrator should not accept material enterprise risk without appropriate authority.

137. Common Mistake — Permanent Exceptions

Exceptions should have:

Owner

Risk

Approval

Expiration

Review

138. Common Mistake — Risk Assessment Once a Year

Risk is dynamic.

Use both:

Periodic Review
+
Event-Driven Review

139. Common Mistake — Heat Map Is the Risk Program

A heat map is only a visualization.

Effective risk management requires:

Ownership

Treatment

Monitoring

Decisions

140. Common Mistake — Report Scores Without Context

Weak:

Risk Score:
20

Better:

Critical customer service
is exposed to ransomware.

Residual risk remains above
appetite because backup
recovery testing is failing.

Executive funding approval
is required.

141. End-to-End Example — Ransomware Risk

Objective:

Maintain Critical
Business Operations

Risk statement:

A ransomware attack could
encrypt critical systems
and disrupt business
operations for an extended
period.

142. Inherent Assessment

Likelihood:
4

Impact:
5

Score:
20

Rating:
Critical

143. Existing Controls

EDR

Email Security

MFA

Vulnerability Management

Network Segmentation

Backups

Incident Response

144. Control Assessment

Findings:

EDR Coverage:
98%

Critical Patches:
92% Within SLA

Backup Success:
99%

Recovery Testing:
60%

Recovery testing is a material weakness.

145. Residual Risk

Likelihood:
3

Impact:
5

Score:
15

Rating:
High

146. Appetite Comparison

Residual:
High

Appetite:
Low

Result:

Risk Above Appetite

147. Treatment Plan

Improve Recovery Testing

Deploy Immutable Backups

Close EDR Coverage Gap

Remediate Critical
Vulnerabilities

Perform Ransomware Exercise

148. KRIs

Monitor:

Critical Vulnerabilities
Past SLA

EDR Coverage

Backup Failures

Recovery Test Success

Ransomware Detections

149. Executive Reporting

RISK:
Ransomware

RESIDUAL:
High

APPETITE:
Low

TREND:
Increasing

OWNER:
COO

ACTION:
Recovery resilience
improvement

DECISION:
Funding approval required

150. End-to-End Example — Critical Vendor

Objective:

Maintain Customer
Service Availability

Risk:

Failure of a critical
SaaS provider could
prevent customer service
operations.

Controls:

SLA

BCP

Vendor Monitoring

Contract

Exit Plan

Residual risk may remain high because:

No Alternative
Provider Exists

This is a strategic risk decision rather than simply a vendor-security finding.

151. End-to-End Example — Cloud Misconfiguration

Objective:

Protect
Customer Data

Risk scenario:

Cloud storage could be
misconfigured and expose
sensitive customer data.

Controls:

IaC

Policy-as-Code

CSPM

Encryption

Access Control

Logging

KRIs:

Public Storage Resources

Critical CSPM Findings

Policy Exceptions

152. End-to-End Example — Regulatory Risk

Objective:

Maintain Regulatory
Compliance

Scenario:

Failure to implement
required privacy controls
could result in regulatory
enforcement and loss
of customer trust.

Treatment may involve:

Policy

Process

Technology

Training

Monitoring

Assurance

153. Enterprise Risk Operating Model

Board
      ↓
Risk Appetite
      ↓
Executive Management
      ↓
Enterprise Risk Committee
      ↓
Risk Management
      ↓
Business Risk Owners
      ↓
Control Owners
      ↓
Risk Monitoring
      ↓
Assurance

154. Three Lines and Risk Management

Simplified:

First Line
Business / Operations
      ↓
Own and Manage Risk

Second Line
Risk / Compliance
      ↓
Framework & Oversight

Third Line
Internal Audit
      ↓
Independent Assurance

155. Risk Governance Lifecycle

Objectives
      ↓
Risk Appetite
      ↓
Risk Identification
      ↓
Assessment
      ↓
Treatment
      ↓
Monitoring
      ↓
Reporting
      ↓
Governance Decision

156. Risk Management Checklist

Governance

• risk policy established.

• risk methodology defined.

• risk appetite approved.

• escalation thresholds defined.

• acceptance authorities established.

• risk committees established where appropriate.

Identification

• business objectives understood.

• scope defined.

• internal context understood.

• external context understood.

• risk scenarios documented.

• business consequences identified.

Analysis

• likelihood assessed.

• impact assessed.

• inherent risk determined.

• existing controls identified.

• control effectiveness assessed.

• residual risk determined.

Evaluation

• residual risk compared with appetite.

• treatment priority established.

• escalation requirements determined.

Treatment

• treatment strategy selected.

• actions documented.

• owners assigned.

• target dates established.

• target residual risk defined.

Monitoring

• KRIs defined.

• thresholds established.

• periodic reviews scheduled.

• event-driven reassessment established.

• overdue treatments monitored.

Reporting

• top risks reported.

• trends reported.

• appetite breaches highlighted.

• emerging risks identified.

• decisions required clearly communicated.

ISO 31000 Deliverables

After completing this lesson, you should be able to create:

01 Enterprise Risk Policy

02 Risk Management Framework

03 Risk Assessment Methodology

04 Risk Taxonomy

05 Risk Criteria

06 Likelihood Matrix

07 Impact Matrix

08 Risk Heat Map

09 Risk Appetite Statement

10 Risk Tolerance Register

11 Enterprise Risk Register

12 Cyber Risk Register

13 Technology Risk Register

14 Third-Party Risk Register

15 Risk Treatment Plan

16 Risk Acceptance Form

17 Risk Exception Register

18 KRI Register

19 Risk Monitoring Dashboard

20 Executive Risk Report

21 Emerging Risk Register

22 Risk Committee Pack

Practical Activity — Write Professional Risk Statements

Convert these findings:

MFA Missing

Critical CVE

Backup Failure

Vendor Has No SOC 2

Cloud Bucket Public

into professional risk statements using:

Cause
      ↓
Risk Event
      ↓
Business Impact

Practical Activity — Build a Risk Register

Scenario:

Company:
Online Retailer

Environment:
AWS
Microsoft 365
SaaS

Critical Assets:
Customer Database
Payment Platform
E-Commerce Website

Identify at least five risks covering:

Cybersecurity

Cloud

Third Party

Availability

Privacy

For each record:

Risk Statement

Likelihood

Impact

Inherent Risk

Controls

Residual Risk

Owner

Treatment

Practical Activity — Assess Risk Appetite

Management defines:

Cybersecurity Risk:
Low Appetite

Innovation Risk:
Moderate Appetite

Regulatory Risk:
Very Low Appetite

Evaluate:

Ransomware Risk:
High

New AI Pilot Risk:
Medium

Privacy Compliance Risk:
Medium

Determine which risks require:

Treatment

Escalation

Acceptance

and explain why.

Practical Activity — Design KRIs

Create KRIs for:

Ransomware

Privileged Access

Cloud Security

Third-Party Risk

Business Continuity

For each KRI define:

Metric

Green Threshold

Amber Threshold

Red Threshold

Owner

Review Frequency

ISO 31000 GRC Mindset

When managing enterprise risk, ask:

What Are We
Trying to Achieve?

What Could
Prevent It?

What Could
Create Opportunity?

What Could
Go Wrong?

Why Could
It Happen?

What Would
the Consequence Be?

Who or What
Could Cause It?

Which Assets
Are Affected?

How Likely
Is It?

How Severe
Would It Be?

What Is
the Inherent Risk?

Which Controls
Already Exist?

Are Those Controls
Actually Effective?

What Is
the Residual Risk?

What Is Our
Risk Appetite?

Are We
Within Appetite?

What Is Our
Tolerance?

Who Owns
the Risk?

Should We
Avoid It?

Reduce It?

Share It?

Accept It?

Who Has Authority
to Accept It?

What Treatment
Is Required?

When Must
It Be Completed?

How Will
We Know the
Risk Is Increasing?

Which KRIs
Should We Monitor?

What Changed?

Does the Risk
Need Reassessment?

Is the Risk
Connected to
Other Risks?

Could Several
Small Risks Create
One Major Exposure?

What Does
Leadership Need
to Know?

What Decision
Is Required?

Are We
Managing Scores?

Or Are We
Managing Risk?

That is the mindset of a GRC professional applying ISO 31000 Risk Management.

Key Takeaways

• ISO 31000 provides principles, a framework, and a process for enterprise risk management.

• Risk should be understood in relation to organizational objectives and uncertainty.

• ISO 31000 is applicable beyond cybersecurity.

• Risk management should be integrated into organizational decision-making.

• Effective risk management should be structured, customized, inclusive, dynamic, and continuously improved.

• Leadership commitment is fundamental.

• Risk assessment includes identification, analysis, and evaluation.

• Good risk statements connect causes, events, and business consequences.

• Threats, vulnerabilities, findings, and risks are not interchangeable.

• Likelihood and impact can support qualitative risk assessment.

• Risk matrices aid prioritization but should not create false precision.

• Inherent risk represents exposure before existing controls are considered.

• Residual risk represents remaining exposure after controls are considered.

• Control existence does not automatically prove control effectiveness.

• Risk evaluation compares exposure against organizational criteria and appetite.

• Risk appetite, tolerance, and capacity are related but distinct concepts.

• Common treatment approaches include avoidance, reduction, sharing or transfer, and acceptance.

• Material risk should have clearly assigned ownership.

• Risk owners and control owners perform different roles.

• Risk registers are foundational enterprise GRC artifacts.

• KRIs help identify changes in risk exposure.

• Risk monitoring should combine periodic and event-driven reviews.

• Executive reporting should highlight trends, appetite breaches, ownership, treatment, and decisions required.

• Risk aggregation and concentration risk should be considered.

• Quantification can help compare risk exposure with control investment.

• ISO 31000 can support cybersecurity, cloud, privacy, third-party, compliance, business continuity, and AI risk programs.

• Risk management should drive informed business decisions rather than simply generate risk scores.

Knowledge Check

Before continuing, make sure you can answer:

1. What is risk?

2. What is ISO 31000?

3. What are the three major elements of ISO 31000?

4. Why is ISO 31000 broader than cybersecurity?

5. What is enterprise risk management?

6. What are the ISO 31000 risk-management principles?

7. Why should risk management be integrated?

8. Why should risk management be dynamic?

9. What role does leadership play?

10. What is the ISO 31000 framework?

11. What is the ISO 31000 risk-management process?

12. What is scope and context?

13. What are risk criteria?

14. What is risk identification?

15. What is risk analysis?

16. What is risk evaluation?

17. How should a professional risk statement be written?

18. What is the difference between a threat and vulnerability?

19. What is the difference between a vulnerability and risk?

20. What is likelihood?

21. What is impact?

22. What is inherent risk?

23. What is residual risk?

24. Why should control effectiveness be assessed?

25. What is risk appetite?

26. What is risk tolerance?

27. What is risk capacity?

28. What are the common risk-treatment approaches?

29. What is risk avoidance?

30. What is risk reduction?

31. What is risk transfer or sharing?

32. What is risk acceptance?

33. Who should accept material risk?

34. What is the difference between a risk owner and control owner?

35. What information belongs in a risk register?

36. What is a risk taxonomy?

37. What is concentration risk?

38. What is risk velocity?

39. What is a KRI?

40. How does a KRI differ from a KPI and KCI?

41. When should risks be reassessed?

42. What should executive risk reporting contain?

43. What is risk escalation?

44. Why can heat maps be misleading?

45. How can quantitative risk analysis support decisions?

46. How does ISO 31000 support cybersecurity?

47. How can ISO 31000 work with ISO 27001?

48. How can ISO 31000 work with COBIT?

49. How can ISO 31000 support third-party risk management?

50. What makes an enterprise risk-management program effective?

What’s Next?

➡️ Next: 06 — ISO 22301 Business Continuity

In the next lesson, you will move from enterprise risk management into business continuity and organizational resilience.

You will learn how organizations prepare for major disruptions by connecting:

Business Objectives
      ↓
Critical Processes
      ↓
Business Impact Analysis
      ↓
Dependencies
      ↓
Recovery Requirements
      ↓
Continuity Strategies
      ↓
Business Continuity Plans
      ↓
Exercises & Testing
      ↓
Continuous Improvement

You will explore important concepts such as:

Business Impact Analysis

Maximum Tolerable
Period of Disruption

Recovery Time Objective

Recovery Point Objective

Continuity Strategies

Crisis Management

Business Continuity Plans

Exercises

Recovery Testing

Lessons Learned

and understand how GRC professionals help organizations ensure that critical business services can continue or recover following cyberattacks, cloud outages, technology failures, supplier disruptions, natural disasters, facility loss, workforce disruption, and other major incidents.

➡️ Next: 06 — ISO 22301 Business Continuity