Risk Management is a Living Process

ISO 31000-2018 “Risk Management Guidelines” discusses on-going monitoring and review of risk management activities. We see a similar requirement in ICH Q9(r1) for the pharmaceutical industry. In many organizations we can take a lot of time on the performance of risk assessments (hopefully effectively) and a lot of time mitigating risks (again, hopefully effectively) but many organizations struggle in maintaining a lifecycle approach.

To do appropriate lifecycle management we should ensure three things:

1. Planned review
2. Continuous Monitoring
3. Incorporate through governance, improvement and knowledge management activities.

Reviews are a critical part of our risk management process framework.

This living risk management approach effectively drives work in Control Environment, Response and Stress Testing.

At heart lies the ongoing connection between risk management and knowledge management.