ISO 31000 : ISO Lead Risk Manager Training — Lesson 2: Risk Context, Criteria, Identification, Analysis, and Evaluation

Learning Objectives

• Interpret the principles, requirements, roles, and dependencies shaping risk context, criteria, identification, analysis, and evaluation.
• Apply the workflow and produce enterprise risk assessment record that can withstand review.
• Analyze “teams use inconsistent impact scales” and recommend a proportionate evidence-based response.

Detailed Topics

• external context
• internal context
• risk criteria
• risk identification
• causes and consequences
• likelihood and impact
• risk analysis
• risk evaluation
• Competence, communication, governance, documented information, risk, and follow-up

Instructor Demonstration

The instructor demonstrates the risk context, criteria, identification, analysis, and evaluation workflow, identifies applicable inputs and responsibilities, records checkpoints in enterprise risk assessment record, and contrasts the accepted state with a condition where teams use inconsistent impact scales.

Hands-On Exercise

Complete a controlled implementation, audit, analysis, or foundation exercise for Risk Context, Criteria, Identification, Analysis, and Evaluation. Establish scope and criteria, collect or create evidence, examine “teams use inconsistent impact scales,” reach a supported conclusion, and preserve the result in enterprise risk assessment record.

1. Confirm objectives, scope, roles, criteria, stakeholders, and expected outputs.
2. Perform planned activities while recording assumptions, evidence, and decisions.
3. Test a normal case, an exception, and a follow-up or improvement condition.
4. Document conclusions, owners, due dates, escalation, and verification requirements.

Scenario Analysis

• Identify the requirement or principle with the strongest influence on risk context, criteria, identification, analysis, and evaluation.
• Compare two defensible responses and explain governance, risk, and evidence trade-offs.
• Determine how enterprise risk assessment record should be approved, retained, reviewed, and updated.

Troubleshooting Guidance

Separate missing evidence from ineffective practice, and distinguish a documentation issue from a control, process, governance, or competence failure. Use enterprise risk assessment record to trace the earliest divergence. Treat “teams use inconsistent impact scales” as a hypothesis until the response is validated against the relevant requirement and intended outcome.

Validation Checklist

• The scope, criteria, stakeholders, and intended outcome for risk context, criteria, identification, analysis, and evaluation are explicit.
• The enterprise risk assessment record links statements and decisions to objective, reviewable support.
• Responsibilities, competence, communication, risk, legal duties, and change impact were considered.
• Findings, corrective actions, monitoring, review triggers, and improvement ownership are clear.

Lesson Outcome

Learners can apply Risk Context, Criteria, Identification, Analysis, and Evaluation, explain the reasoning, and defend the result through enterprise risk assessment record.