Closing the loop on risk management

DNV’s latest ViewPoint survey suggests that many organizations already have a foundation for risk-based decision-making through their management systems. ISO management system standards include requirements to address risks and opportunities, and seven in ten respondents say these requirements make a significant or fundamental contribution to the company’s risk-management culture.

At the same time, just 18% say risk management is fully incorporated into both strategic and operational decision-making. This points to an opportunity for many to use risk information more consistently throughout the entire management cycle.

The foundation may already be in place

Risk-based thinking is not a separate activity within ISO management system standards. Organizations are expected to consider their context, identify relevant risks and opportunities, translate them into action and use the results to support continual improvement.

In ISO management system standards such as ISO 9001 (quality), ISO 14001 (environmental) and ISO 45001 (occupational health and safety), Clause 6.1 addresses actions to manage risks and opportunities. It sets forth requirements for organizations to identify relevant risks and opportunities and plan how to address them. The intention is not simply to maintain a risk register but to integrate risk considerations into planning and operations, implement actions and evaluate their effectiveness.

ISO 31000, the international standard providing guidelines for risk management, can complement specific management system standards with a more explicit framework for identifying, managing, mitigating and monitoring risk.

What audit findings tell us

Audit findings from DNV’s Lumina benchmarking database show where organizations most often encounter difficulties when putting these requirements into practice. The most common findings differ by standard.

• For ISO 9001, insufficient plans or actions to address risks and opportunities account for around one-third of the Clause 6.1 non-conformities analysed.
• For ISO 14001, the most common findings relate to compliance obligations and the identification of environmental aspects and impacts.
• For ISO 45001, more than one-quarter relate to hazard identification and risk assessment processes that do not sufficiently cover relevant activities, functions or locations.

The underlying causes are more consistent. Across all three standards, around four in ten non-conformities are associated with weak understanding or awareness of requirements, while around one in five are linked to difficulties understanding or following procedures.

The corrective actions point in a similar direction: strengthen the processes used to identify and address risks, improve hazard or environmental risk identification where relevant, and ensure that the people responsible understand both the requirements and the procedures they are expected to follow.

This suggests that the priority should not simply be on more documentation. Organizations need to understand the requirements, identify the relevant risks and opportunities, translate them into appropriate actions and follow through on whether those actions work.

Closing the loop in practice

The Plan-Do-Check-Act (PDCA) cycle provides a practical way to connect the different stages of risk management.

• In the Plan phase, organizations identify risks and opportunities and determine appropriate actions.
• In Do, those actions are implemented and responsibilities are put into practice.
• Check is where organizations monitor results, reassess risks and evaluate whether the actions taken have been effective.
• Act uses that learning to adjust controls, address gaps and improve the approach.

This is particularly relevant in light of the ViewPoint findings. Organizations report stronger structure in identification and analysis than in reassessment, monitoring and reporting, where evaluating effectiveness and learning from results become critical.

Closing the loop therefore does not necessarily require another framework or more documentation. The opportunity is to make better use of existing management-system processes, ensuring that risks and opportunities move from planning into action, that effectiveness is evaluated and that the results feed into continual improvement and better business decisions.

What a more structured approach looks like

Leaders – organizations in the survey reporting a very well-structured approach throughout the process – are considerably more likely to integrate risk management into decision-making. They also report benefits such as improved compliance, better decision-making and enhanced resilience and continuity to a much higher degree. Companies with a higher risk management maturity seem to rely on several elements to be effective:

• Management systems provide structure and a common language.
• Competent people apply risk-based thinking in practice.
• Assurance activities provide independent insight into implementation and effectiveness.
• Digital tools can support responsibilities, traceability, monitoring and follow-up.

When these elements work together, organizations are better positioned to connect compliance requirements with more informed business decisions.