{"id":8,"date":"2025-12-24T04:41:57","date_gmt":"2025-12-24T04:41:57","guid":{"rendered":"http:\/\/grc.gapura.id\/?page_id=8"},"modified":"2026-01-12T13:31:52","modified_gmt":"2026-01-12T13:31:52","slug":"risk-management","status":"publish","type":"page","link":"https:\/\/grc.gapura.id\/en\/","title":{"rendered":"Risk Management"},"content":{"rendered":"
\n
\n
\n

Risk
Management<\/strong><\/h2>\n<\/div>\n\n\n\n
\n

Risk Management <\/strong>is a systematic process of identifying, analyzing, evaluating, and controlling risks that may affect the achievement of an organization\u2019s objectives. The main goal is to minimize negative impacts from uncertainties and maximize opportunities that can be leveraged. (References: ISO 31000 : 2018)<\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

Architecture of Risk Management<\/strong><\/h3>\n\n\n\n

ISO 31000:2018 provides a structured and universal framework for managing risks in any organization. The standard outlines principles, a framework, and a process for effective risk management.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n
\n
\"\"
\n
\n
\n

Framework<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\n
\n
\n

1. General<\/strong><\/p>\n\n\n\n

The purpose of the risk management framework is to assist the organization in integrating risk management into significant activities and functions. The effectiveness of risk management will depend on its integration into the governance of the organization, including decision-making. This requires support from stakeholders, particularly top management.<\/p>\n\n\n\n

Framework development encompasses integrating, designing, implementing, evaluating and improving risk management across the organization.<\/p>\n\n\n\n

The organization should evaluate its existing risk management practices and processes, evaluate any gaps and address those gaps within the framework.<\/p>\n\n\n\n

The components of the framework and the way in which they work together should be customized to the needs of the organization.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

2. Leadership and commitment<\/strong><\/p>\n\n\n\n

Top management and oversight bodies, where applicable, should ensure that risk management is integrated into all organizational activities and should demonstrate leadership and commitment by:<\/p>\n\n\n\n

    \n
  • customizing and implementing all components of the framework;<\/li>\n\n\n\n
  • issuing a statement or policy that establishes a risk management approach, plan or course of action;<\/li>\n\n\n\n
  • ensuring that the necessary resources are allocated to managing risk;<\/li>\n\n\n\n
  • assigning authority, responsibility and accountability at appropriate levels within the organization.<\/li>\n<\/ul>\n\n\n\n

    This will help the organization to:<\/p>\n\n\n\n

      \n
    • align risk management with its objectives, strategy and culture;<\/li>\n\n\n\n
    • recognize and address all obligations, as well as its voluntary commitments<\/li>\n\n\n\n
    • establish the amount and type of risk that may or may not be taken to guide the development of risk criteria, ensuring that they are communicated to the organization and its stakeholders;<\/li>\n\n\n\n
    • communicate the value of risk management to the organization and its stakeholders;<\/li>\n\n\n\n
    • promote systematic monitoring of risks;<\/li>\n\n\n\n
    • ensure that the risk management framework remains appropriate to the context of the organization.<\/li>\n<\/ul>\n\n\n\n

      Top management is accountable for managing risk while oversight bodies are accountable for overseeing risk management. Oversight bodies are often expected or required to:<\/p>\n\n\n\n

        \n
      • ensure that risks are adequately considered when setting the organization\u2019s objectives;<\/li>\n\n\n\n
      • understand the risks facing the organization in pursuit of its objectives;<\/li>\n\n\n\n
      • ensure that systems to manage such risks are implemented and operating effectively;<\/li>\n\n\n\n
      • ensure that such risks are appropriate in the context of the organization\u2019s objectives;<\/li>\n\n\n\n
      • ensure that information about such risks and their management is properly communicated.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n\n
        \n
        \n

        3. Integration<\/strong><\/p>\n\n\n\n

        Integrating risk management relies on an understanding of organizational structures and context. Structures differ depending on the organization\u2019s purpose, goals and complexity. Risk is managed in every part of the organization\u2019s structure. Everyone in an organization has responsibility for managing risk.<\/p>\n\n\n\n

        Governance guides the course of the organization, its external and internal relationships, and the rules, processes and practices needed to achieve its purpose. Management structures translate governance direction into the strategy and associated objectives required to achieve desired levels of sustainable performance and long-term viability. Determining risk management accountability and oversight roles within an organization are integral parts of the organization\u2019s governance.<\/p>\n\n\n\n

        Integrating risk management into an organization is a dynamic and iterative process, and should be customized to the organization\u2019s needs and culture. Risk management should be a part of, and not separate from, the organizational purpose, governance, leadership and commitment, strategy, objectives and operations.<\/p>\n<\/div>\n<\/div>\n\n\n\n

        \n
        \n

        4. Design<\/strong><\/p>\n\n\n\n

        4.1 Understanding the organization and its context<\/strong><\/p>\n\n\n\n

        When designing the framework for managing risk, the organization should examine and understand its external and internal context.<\/p>\n\n\n\n

        Examining the organization\u2019s external context may include, but is not limited to:<\/p>\n\n\n\n

          \n
        • the social, cultural, political, legal, regulatory, financial, technological, economic and environmental factors, whether international, national, regional or local;<\/li>\n\n\n\n
        • key drivers and trends affecting the objectives of the organization;<\/li>\n\n\n\n
        • external stakeholders\u2019 relationships, perceptions, values, needs and expectations;<\/li>\n\n\n\n
        • contractual relationships and commitments;<\/li>\n\n\n\n
        • the complexity of networks and dependencies.<\/li>\n<\/ul>\n\n\n\n

          Examining the organization\u2019s internal context may include, but is not limited to:<\/p>\n\n\n\n

            \n
          • vision, mission and values;<\/li>\n\n\n\n
          • governance, organizational structure, roles and accountabilities;<\/li>\n\n\n\n
          • strategy, objectives and policies;<\/li>\n\n\n\n
          • the organization\u2019s culture;<\/li>\n\n\n\n
          • standards, guidelines and models adopted by the organization;<\/li>\n\n\n\n
          • capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, intellectual property, processes, systems and technologies);<\/li>\n\n\n\n
          • data, information systems and information flows;<\/li>\n\n\n\n
          • relationships with internal stakeholders, taking into account their perceptions and values;<\/li>\n\n\n\n
          • contractual relationships and commitments;<\/li>\n\n\n\n
          • interdependencies and interconnections.<\/li>\n<\/ul>\n\n\n\n

            4.2 Articulating risk management commitment<\/strong><\/p>\n\n\n\n

            Top management and oversight bodies, where applicable, should demonstrate and articulate their continual commitment to risk management through a policy, a statement or other forms that clearly convey an organization\u2019s objectives and commitment to risk management. The commitment should include, but is not limited to:<\/p>\n\n\n\n

              \n
            • the organization\u2019s purpose for managing risk and links to its objectives and other policies;<\/li>\n\n\n\n
            • reinforcing the need to integrate risk management into the overall culture of the organization;<\/li>\n\n\n\n
            • leading the integration of risk management into core business activities and decision-making;<\/li>\n\n\n\n
            • authorities, responsibilities and accountabilities;<\/li>\n\n\n\n
            • making the necessary resources available;<\/li>\n\n\n\n
            • the way in which conflicting objectives are dealt with;<\/li>\n\n\n\n
            • measurement and reporting within the organization\u2019s performance indicators;<\/li>\n\n\n\n
            • review and improvement.<\/li>\n<\/ul>\n\n\n\n

              The risk management commitment should be communicated within an organization and to stakeholders, as appropriate.<\/p>\n\n\n\n

              4.3 Assigning organizational roles, authorities, responsibilities and accountabilities<\/strong><\/p>\n\n\n\n

              Top management and oversight bodies, where applicable, should ensure that the authorities, responsibilities and accountabilities for relevant roles with respect to risk management are assigned and communicated at all levels of the organization, and should:<\/p>\n\n\n\n