Framework overview
ISO 31000:2018 §5 — Framework — what this requires
ISO 31000:2018 §5 — Framework
The purpose of the risk management framework is to assist the organization in integrating risk management into significant activities and functions. The effectiveness of risk management will depend on its integration into the governance of the organization, including decision-making.
How this app differs from ISO 31000
ISO 31000 describes a framework that an organisation designs, puts in place, evaluates and improves over time. This app records four parts of it. They are your external and internal context, top management's commitment to risk management, who holds each risk role, and how you apply each of the eight principles. You record the context in each assessment's Context stage, and the other three on the Framework pages.
The app keeps no records for the rest of the framework. These are the resources for risk management, the approach to communication and consultation, the plan to put the framework in place, and the evaluation and improvement of the framework. The commitment has free-text fields for resources and for review and improvement. They are statements of intent, not records of an evaluation or an improvement.
The organisation-wide configuration every assessment inherits: the packages you assess against, the organisation structure, who discharges what, and the shared defaults.