Closing the loop on risk management

DNV’s latest ViewPoint survey suggests that many organisations already have a foundation for risk-based decision-making through their management systems. ISO management system standards include requirements to address risks and opportunities, and seven in ten respondents say these requirements make a significant or fundamental contribution to their organisation’s risk management culture.

At the same time, only 18% say risk management is fully integrated into both strategic and operational decision-making. This highlights an opportunity for many organisations to apply risk information more consistently throughout the entire management cycle.

The foundation may already be in place

Risk-based thinking is not a standalone activity within ISO management system standards. Organisations are expected to consider their context, identify relevant risks and opportunities, translate these into action, and use the results to drive continual improvement.

In ISO management system standards such as ISO 9001 (quality), ISO 14001 (environmental) and ISO 45001 (occupational health and safety), Clause 6.1 addresses actions to manage risks and opportunities. It outlines requirements for organisations to identify relevant risks and opportunities and plan how to address them. The objective is not simply to maintain a risk register, but to integrate risk considerations into planning and operational activities, implement appropriate actions, and evaluate their effectiveness. 

ISO 31000, the international standard providing guidance on risk management, can complement individual management system standards by offering a more explicit framework for identifying, managing, mitigating and monitoring risk.

What audit findings tell us

Audit findings from DNV’s Lumina benchmarking database provide insight into where organisations most frequently encounter challenges when putting these requirements into practice. The most common findings vary by standard.

• For ISO 9001, insufficient plans or actions to address risks and opportunities account for around one-third of the Clause 6.1 non-conformities analysed.
• For ISO 14001, the most common findings relate to compliance obligations and the identification of environmental aspects and impacts.
• For ISO 45001, more than one-quarter of findings relate to hazard identification and risk assessment processes that do not adequately cover relevant activities, functions or locations.

The underlying causes are more consistent. Across all three standards, around four in ten non-conformities are associated with a lack of understanding or awareness of requirements, while around one in five are linked to difficulties in understanding or following procedures.

The corrective actions point in a similar direction: strengthening the processes used to identify and address risks, improving hazard or environmental risk identification where relevant, and ensuring that those responsible understand both the requirements and the procedures they are expected to follow.

This suggests that the priority is not simply more documentation. Organisations need to understand the requirements, identify relevant risks and opportunities, translate them into appropriate actions, and follow through to determine whether those actions achieve the intended outcome.

Closing the loop in practice

The Plan-Do-Check-Act (PDCA) cycle cycle provides a practical way to connect the different stages of risk management. 

• In the Plan phase, organisations identify risks and opportunities and determine appropriate actions.
• In Do, those actions are implemented and responsibilities are put into practice.
• Check is where organisations monitor results, reassess risks and evaluate whether the actions taken have been effective.
• Act uses that learning to adjust controls, address gaps and improve the approach.

This is particularly relevant in light of the ViewPoint findings. Organisations report stronger structures for risk identification and analysis than for reassessment, monitoring and reporting, where evaluating effectiveness and learning from outcomes become critical.

Closing the loop therefore does not necessarily require another framework or increased documentation. The opportunity lies in making better use of existing management system processes, ensuring that risks and opportunities move from planning into action, that effectiveness is evaluated, and that the results feed into continual improvement and more informed business decisions.

What a more structured approach looks like

Leaders, defined in the survey as organisations reporting a very well-structured approach across the entire risk management process, are significantly more likely to integrate risk management into decision-making. They also report benefits such as improved compliance, better decision-making, and greater resilience and business continuity to a much greater extent.

Organisations with more mature risk management practices appear to rely on several key elements:

• Management systems provide structure and a common language.
• Competent people apply risk-based thinking in day-to-day operations.
• Assurance activities provide independent insight into implementation and effectiveness.
• Digital tools support accountability, traceability, monitoring and follow-up activities.

When these elements work together, organisations are better positioned to connect compliance requirements with more informed, risk-based business decisions.