Corporate objectives are not the “bulls eye” of strategic planning they're just the dartboard. Boards are assessed by the quality of their Results not the quality of their Objectives.
Enterprise Compliance Today
With the recent release of a new British standard BS 65000 on Organisational Resilience, and COSO’s announcement of a review of its 2001 COSO ERM framework, I believe that business is moving ahead of ISO 31000 as a necessary response the evolving business environment and accelerating rate of technical change; therefore there is a strong case for a taking a fresh look at ISO 31000.
In the last decade we have seen the evolution of Risk Management from an administrative practice to ERM for corporate governance. But the realization that results come out of action not protection, has started people pursuing a more proactive role for risk management.
It is customary at this time of year for most risk professionals to step back and take a broader look at the risk landscape ahead for the coming year. The normal starting point is the “think-tank” assessments of Global Risks such as Zurich Risk Landscape 2007-2015 and the WEF’s 2015 Global Risk Report. And Global Warming is at the top of most experts’ lists.
COSO has announced its intention to review its 2004 ERM Framework and has already started soliciting feedback. Broadly panned by the Risk fraternity, I believe it can provide a valuable contribution to the GRC landscape. Although I expect critics from both sides (COSO & ISO 31000), here are my recommendations.
There is a gaggle of Management Consultants pushing the 20th century mantra of Good Management Practice as a panacea to all the ill of today’s business environment. The key plank in most of these methodologies is that old chestnut “the PDCA cycle” for Continuous Improvement. If your consultant wears this as a badge, run a mile!
We need to discard the continuing archaic attitude to Risk Appetite as a compliance policing action and develop it as a tool of improving management and system performance. In the brave new world of the 21st century volatile business environment not only are the goal posts moving, but the ground is moving under our feet.
In part 2 of my analysis of the ISO 31000 forum on “Does anyone really understand Emerging Risks?” I look at the 3rd question: How do you manage the unknown?
I recently opened an ISO 31000 Forum discussion on “Does anyone really understand Emerging Risks?” The discussion proved illuminating so in this week’s post I thought I would share a summary of the forum discussion.