ISO 31000 gets nod of approval but requires customisation–Asia

Franck Baron, Group General Manager, Risk Management and Insurance, International SOS and Chairman of Parima, the Pan Asian Risk and Insurance Management Association, is a fan of ISO 31000 and believes it should be the go to global risk management standard. “I am quite appreciative of ISO 31000 because it comes from the Australian/NZ standard which is closer to real risk management in my view,” he said. “If I had to compare with COSO II I feel ISO 31000 is closer to the reality of what risk management should deliver.” However, Mr Baron feels that ISO 31000 is not sufficiently understood or implemented in Asia. “It is a standard to be benchmarked against but for the time being in Asia the problem is the low maturity of risk management. This doesn’t help to develop the standard in the region,” he said.hideHe is also clear that ISO 31000, or any other internationally-recognised standard, needs to be adapted to suit each locality and organisation. “I don’t see it as a one-size-fits-all type of approach. If I take my risk management framework in my company and export it directly to another it is not going to work. If you compare Asia with Europe we are not that homogenous in comparison. We have very different cultures and even the religions and the way societies are structured are extremely varied here. If you apply this to the different corporations coming from Vietnam, Philippines, Indonesia, Japan and China then you have to find your own way to deliver the risk management framework. The international ISO standard is good because it can set the scene, but you need to develop your own version,” he said. Keith Xia, Regional Head of Risk Management for Intercontinental Hotel Group and Parima board member in charge of its Chinese chapter, believes that global risk management standards are especially beneficial in areas of the world where risk management is developing, such as Asia. “I think it is great to have a global standard that can advise you what a version of best practice looks like. It provides the developing risk community with a guide on where they should be going and how. It advises you on what the car should look like but how to run and drive the car is different for each organisation and regional culture. So risk managers need to know the global standards, such as ISO 31000, but you need to understand your environment when putting it into use,” he said. Roland Teo, a member of the risk management working group that developed and maintains ISO 31000, is, unsurprisingly, supportive of the standard. He stressed that IS0 31000 is not something to be scared of and its beauty lies in its simplicity. “It is simple and I would say to people don’t get worried by 31000. It is only 24 pages long and is not rocket science. Many companies have already implemented much of it but just not labelled that work as ISO 31000,” he said. He explained that ISO 31000’s definition of risk really brings home the whole concept of enterprise risk management. “Risk is not just about hazards and safety or financial losses, it is, as ISO aptly puts it, the ‘effect of uncertainty on objectives’. It is very simple but powerful. Once you overlay that on your business objectives and department objectives you find everything is aligned,” said Mr Teo, who is deputy director of the risk management office at a Singapore regional healthcare system, board member of Parima and governing council member of the Risk and Insurance Management Association of Singapore (Rimas). He pointed out that at the end of the day ISO 31000 is just a compilation of good risk management practices developed by over 300 risk managers around the world. “Before ISO 31000 came about these practices were in place but just not in a structured way and with common terminologies at the international level. ISO 31000 and other standards try to develop a common language,” he added. Like any other guide or standard ISO 31000 is constantly changing and developing, driven by the needs of risk managers over time. Currently there is a lot of discussion about adapting it to the language of SMEs or other groups such as large multinationals, said Mr Teo. “I think for this purpose we can develop some supplementary documents of ISO 31000 aimed at specific groups or countries, and are thinking of doing so for Singapore,” he added. Danny Lin, Associated Vice Present, Risk Management and Auditing Office at Qisda Corporation and Parima board member in charge of its Taiwan chapter, agreed with fellow Asian risk managers that ISO 31000 needs to be adapted by risk managers to fit their organisation. “It provides some basic methods on how to manage risk. But more important is how companies implement all of these ideas in every department. So it very much needs to be adapted to your company and is just a starting point on the risk management journey,” he said. Patrick Abdullah, Vice President, Enterprise Risk Management at Astro Overseas Ltd and Parima board member overseeing its Malaysian chapter, said that ISO 31000 can serve as a framework for good risk management governance practices. As would the COSO framework and the Australian/New Zealand standard 4360 (2004), he added. Thu Xuan Ly, Director of Risk & Compliance at Vina Capital and board member of Parima in charge of its Vietnam chapter, believes that ISO 31000 is of little use as a global risk management standard for financial services firms. Furthermore she said that risk managers should ‘select the most appropriate ERM framework for their organisation that is aligned with their corporate culture and risk culture. “There is no one-size-fits-all,” she said.

ISO 31000 gets nod of approval but requires customisation–Asia

Want to read this article?

Read Next

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

New Africa-focused syndicate launched at Lloyd’s

AM Best upgrades outlook for UK market and expects further rate hardening

Marsh extends Cyber ECHO facility to $125m of excess capacity

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

New Africa-focused syndicate launched at Lloyd’s

AM Best upgrades outlook for UK market and expects further rate hardening

Marsh extends Cyber ECHO facility to $125m of excess capacity

Want to read this article?

Read Next

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

New Africa-focused syndicate launched at Lloyd’s

AM Best upgrades outlook for UK market and expects further rate hardening

Marsh extends Cyber ECHO facility to $125m of excess capacity

Related Articles