Every company is in business to take risks.

Every action or failure to take action by that company naturally has some form of risk inherent in the process. To survive, a company needs to identify opportunities and take them when beneficial, but the amount of risk must be understood. Whether it’s determining to pursue new markets and make new investments or discontinuing those pursuits, risk is built into the nature of business.

If risk is built into the nature of business, then risk analysis and management may be the most important activities a company engages in. With the recent changes to management systems standards, the concept of risk management has never been more prominent, or had more potential to be misunderstood.

Risk management used to be confined to specific standards around issues such as business continuity (ISO 22301), information security (ISO 27001), and supply chain security (ISO 28001), but now it’s a fundamental concept in quality, health and safety, and environmental standards as well.

 …