Organizations of all types and sizes must have risk management discipline. According to ISO 31000 standard, the risk management process is a systematic application of policies and practices created by an organization to identify, analyze, evaluate, treat, communicate, monitor, and review risk. ISO 31000 is applicable to any individual, teams, or organizations focused on managing risks to create value, make informed decisions, improving performance, and achieving defined objectives. Broadly, there are eight steps to risk management process. They are:
1. Communication and consultation
2. Scope, context, and criteria
3. Risk identification
4. Risk analysis
5. Risk treatment
6. Monitoring and review
7. Recording and reporting