Risk Management

Definitions

European Definitions

[CBRN] The process, distinct from Risk Assessment, of weighing policy alternatives, in consultation with all interested parties, considering risk assessment and other factors relevant for the health protection of workers and consumers, the protection of the environment and for the promotion of fair trade practices, and, if needed, selecting appropriate prevention and control options .

Other International Definitions

NATO CEP / EAPC

A deliberate process of understanding risk and deciding upon and implementing actions to reduce risk to a defined level, which is an acceptable level of risk at an acceptable cost. This approach is characterised by identifying, measuring, and controlling risks to a level commensurate with an assigned level. .

UNISDR

The systematic approach and practice of managing uncertainty to minimize potential harm and loss..

According to UNISDR, risk management comprises risk assessment and analysis, and the implementation of strategies and specific actions to control, reduce and transfer risks. It is widely practiced by organizations to minimise risk in investment decisions and to address operational risks such as those of business disruption, production failure, environmental damage, social impacts and damage from fire and natural hazards. Risk management is a core issue for sectors such as water supply, energy and agriculture whose production is directly affected by extremes of weather and climate.

National Definitions

Czech Republic

Risk management are coordinated activities to manage and control an organization in view of the risks.

Koordinované činnosti pro vedení a řízení organizace s ohledem na rizika.

Germany

The totality of measures to minimise the risk situation, weighing up the strategic alternatives (optional courses of action) in consultation with the parties concerned and according due consideration to the Risk Assessment and other factors worthy of consideration. .

United States

DHS

Process of identifying, analyzing, and communicating risk and accepting, avoiding, transferring or controlling it to an acceptable level at an acceptable cost .

NIST

Prioritizing, evaluating, and implementing the appropriate risk-reducing controls/countermeasures recommended from the risk management process. (Source: CNSSI-4009; NIST SP 800-30; NIST SP 800-39)

Standard Definition

ISO/IEC 27000:2014

The standard defines risk management as

Coordinated activities to direct and control an organization with regard to risk(based on the ISO Guide 73:2009).

Risk management process is the systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context and identifying, analysing, evaluating, treating, monitoring and reviewing risk (based on the ISO Guide 73:2009). ISO/IEC 27005 uses the term ‘process’ to describe risk management overall. The elements within the risk management process are termed ‘activities’.

See also

• Disaster Risk
• Risk Analysis
• Risk Assessment
• Risk Identification
• Risk Transfer
• Risk Treatment
• Risk Mitigation