C1.1 Scope, context and criteria

ISO 31000:2018 clause 6.3 [1]

The component requires that scope, context and criteria be written and versioned before any assessment; that the criteria state how likelihood is to be judged, how consequence is to be judged, how the two are to be combined and what level of risk is acceptable; that every register row carry the version of the criteria it was scored under; and that no score be accepted into the register without one (C1.1) [1]. The version is the enforcement. A criteria document that can be edited silently will be edited after the argument about a score, and a register whose rows do not say which criteria they were scored under cannot be compared with itself a year later.

It comes from the standard's clause on the process, and from what the Part II reading called its second great contribution: the insistence that criteria come before assessment. The standard asks the organization to decide, in advance and in writing, how it will judge likelihood and consequence, how it will combine them and what it will find acceptable, before anyone estimates anything. Most registers do the reverse; they score first and discover the criteria afterwards, in the argument about the score. The component adds the version because the standard does not, and because the project tradition's versioned numeric bands (C3.2) [12] showed that the fix is a field rather than an exhortation. What it reconciles is the standard's phrase, risk criteria, with the governance sources' appetite and tolerance: the criteria are the scales and the combination rule that let an appetite position be compared with a measured exposure, and chapter 11 kept criteria for exactly that.