Business

Monday November 23, 2009

ISO 31000 will be more helpful in supporting corporate governance

By EDY SARIF


KUALA LUMPUR: The new global standard for risk management, ISO 31000, will be more helpful in supporting corporate governance for risk management among companies and enterprises, most of which have adopted the current standard of risk management, AS/NZS 4360: 2004 (Standards Australia/New Zealand approach).

Risk management standards expert Kevin Knight said ISO 31000 was a more concise, clear and flexible set of guidelines developed for risk management.

Ideas to conceptualise it started in 2004 when six meetings were held among 30 countries of ISO Meeting Group to come out with better standard of guidelines.

ISO 31000 is more focus on the process of risk management: RISK MANAGEMENT STANDARDS EXPERT KEVIN KNIGHT

“ISO 31000 is more focused on the process of risk management in companies and enterprises.

“By this, it gives more direction to the organisation on managing the uncertainty or risks that may happen,” he told StarBiz.

Knight chairs the World ISO working group developing the new ISO 31000 risk management standards.

Knight said one of the shift points of the new ISO 31000 to the existing standards was the way the organisation conceptualised the risk and it addressed the entire management system that supported the designs, implementation, maintenance and improvement of risk management process.

“By this, the whole process will involve every single person in the organisation, from the board of directors down to the lower levels. When the whole organisation understands how to manage risk, it will help achieve the organisation’s objectives in the business,” he said, saying that with ISO 31000, risk was now defined as “effect of uncertainty on objectives”.

He added that ISO 31000 would fit into the existing risk management requirements among companies and enterprises, as they now needed only to enhance the existing standards to develop their new risk management plans.

“Companies or organisations that follow the ISO 31000 standards will not get special certificates as we believe organisations should not waste their efforts in seeking to gain a certificate. Instead, the focus should be more on efforts in improving corporate governance on risk management matters,” he said.

He also said the time taken to adapt to the new approach would vary between companies and organisations.

“I would say that it may take three to five years for bigger organisations to fully change their risk management standards as it will involve culture change in the organisation. We are talking about the complexity of certain big organisations here that may make it difficult for them to change their way of managing risk,” he said.

Knight said companies and enterprises could purchase a copy of the new ISO 31000 guidelines on the International Standards Organisation website (www.iso.org) or from consulting firms.

ISO 31000 was published as a standard on Nov 15 and Malaysia was among the first to be exposed to this new standard at The Q-Radar Trail Blazer Alumni Conference here last Thursday.

  • E-mail this story
  • Print this story