ISO 31000 Introduction Training — Lesson 3: Exploring Scope, Context, Criteria, Identification, Analysis, Evaluation, and Treatment

Learning Objectives

• Interpret the purpose, responsibilities, inputs, and decision points shaping exploring scope, context, criteria, identification, analysis, evaluation, and treatment.
• Apply the workflow and produce enterprise risk assessment exercise that another practitioner can review.
• Analyze “two risks cannot be compared because criteria were never agreed” and recommend a proportionate, evidence-based response.

Detailed Topics

• assessment scope
• external context
• internal context
• risk criteria
• risk identification
• risk analysis
• risk evaluation
• risk treatment
• Governance, competence, communication, documentation, validation, risk, and follow-up considerations

Instructor Demonstration

The instructor demonstrates the exploring scope, context, criteria, identification, analysis, evaluation, and treatment workflow, identifies applicable responsibilities, records checkpoints in enterprise risk assessment exercise, and contrasts the accepted state with a condition where two risks cannot be compared because criteria were never agreed.

Hands-On Exercise

Complete a controlled implementation, management, audit, assessment, foundation, introduction, or transition exercise for Exploring Scope, Context, Criteria, Identification, Analysis, Evaluation, and Treatment. Establish scope and criteria, collect or create evidence, examine “two risks cannot be compared because criteria were never agreed,” reach a supported conclusion, and preserve the result in enterprise risk assessment exercise.

1. Confirm objectives, scope, roles, criteria, stakeholders, and expected outputs.
2. Perform the planned activities while recording assumptions, evidence, and decisions.
3. Test a normal case, an exception, and a follow-up or improvement condition.
4. Document conclusions, owners, due dates, escalation, and verification requirements.

Scenario Analysis

• Identify the requirement or principle with the strongest influence on exploring scope, context, criteria, identification, analysis, evaluation, and treatment.
• Compare two defensible responses and explain their governance, risk, and evidence trade-offs.
• Determine how the enterprise risk assessment exercise should be approved, retained, reviewed, and updated.

Troubleshooting Guidance

Separate missing evidence from ineffective practice, and distinguish a documentation issue from a control, process, governance, or competence failure. Use enterprise risk assessment exercise to trace the earliest divergence. Treat “two risks cannot be compared because criteria were never agreed” as a hypothesis until the response is validated against the applicable requirement and intended outcome.

Validation Checklist

• The scope, criteria, stakeholders, and intended outcome for exploring scope, context, criteria, identification, analysis, evaluation, and treatment are explicit.
• The enterprise risk assessment exercise links statements and decisions to objective, reviewable support.
• Responsibilities, competence, communication, risk, legal duties, and change impact were considered where relevant.
• Findings, corrective actions, monitoring, review triggers, and improvement ownership are clear.

Lesson Outcome

Learners can apply Exploring Scope, Context, Criteria, Identification, Analysis, Evaluation, and Treatment, explain the reasoning used, and defend the result through enterprise risk assessment exercise.