2. What should a typical risk management framework include? - Alex Sidorenko

Alex Sidorenko suggests that instead of having a single risk management framework document, companies should integrate risk analysis into existing documents such as financial policy, procurement policy, HR policies and procedures, and core processes. This would make risk management a part of the company culture and operations, rather than a separate activity. He suggests updating these documents to include risk thinking and analysis, and using this approach to change how processes operate. He invites viewers to comment and subscribe to the Risk Academy channel on YouTube.

[pierrepradal]

Thanks for this thought-provoking statement ! I agree about embedding risk management into every policy and practice, AND having a common statement and architecture that the highest governance bodies provide their support to and endorsement of. Not a compliance document, but rather a "shared contract" between all levels of the organization.

[herbmarime]

This is a great point you make here Alexei, however I think that Martine Triboulet's comment about requirements needing more than just updating current policies is an extension of your point.
Updating the current policies so that they incorporate risk management is a great starting point but it needs to be followed up with the next step of putting together a documented framework in the form of a group of policies that describe how the enterprise risk will be handled.

[almohnad]

I agree that risk should not be stand alone activity it is a part of each process

[martinetriboulet]

I agree but the point is that regulators usually ask for this single OR document

[sampathekanayake]

Greetings to you Alex. First I want to thank you for these wonderful videos. I am quite new to Enterprise risk and whenever I have a question, I search your videos to see whether there is a solution. Keep up the good work.
I totally agree that risk management to be part of the organization processes, cultures not limiting to one single document. My question to you is, Dont you think there has to be certain structure for the staff to follow when developing policy and procedures. Don t you think having a framework helps to communicate this concept easily across the organization . Don't this standardized structure reduces the cognitive biases of the these processes? Again much appreciate what you do. Looking forward to learn from them.

[alexdali]

Good explanation Alexei...This is exactly what G31000 approved/certified trainers constantly explain in our ISO 31000 certification course....including you.
Putting small videos on this kind of key concepts help risk professionals to better understand the content of the international ISO 31000 risk management standard.

[filizidil]

Sure you can do that but you will still need an aggregated one including common principles/practises for each area. Otherwise you will need to mention them in each policy repetetively. Instead of that, gathering common risk management principles and practises in one document and put the function specific ones in their own policies work better. Regards,