C0.1 Purpose and principles

ISO 31000:2018 clause 4 [1]

The component requires a written statement, approved by the governing body, that risk management exists to create and protect value, and it requires that the risk management system itself be evaluated, at least annually and with evidence, against the eight principles the standard sets out: integrated, structured and comprehensive, customized, inclusive, dynamic, based on the best available information, attentive to human and cultural factors, and continually improving (C0.1) [1]. The evaluation is of the system, not of the risks. It asks whether risk management is in fact integrated into decisions, in fact inclusive of the people who bear the consequences, in fact changed when the world changes.

It comes from the standard's fourth clause, which puts value creation and protection at the center and the seven other principles around it, and from the Part II observation that this clause is the least used part of the most cited risk document in the world. Organizations quote the process and ignore the principles because the principles are evaluative rather than operational. The component gives them the one job they can do, which is to be the criteria by which the board judges the risk function rather than the risks. What it replaces is the mission statement of the typical risk function, which describes activities, and the maturity self-assessment scored against a consultant's model. Here the model is the standard's own.