Risk Management Process – Establishing the Internal Context

Risk Management – Article 11

Risk Management Process – Establishing the Internal Context

Keshav Ram Singhal

Sub-clauses 5.3.3 of ISO 31000:2009 standard provides guidelines on establishing the internal context. Internal context of an organization is its internal environment in which the organization seeks to achieve organization’s objectives. Internal context is anything within the organization and it should include but not limited to:

- Organizational governance
(The system of rules, practices and processes by which an organization is directed and controlled may be referred as organizational governance. Organizational governance essentially involves balancing of interests of its stakeholders.)

- Organizational structure, and within which roles, authority and accountability in the organization
(Organizational structure determines how the roles, authority and responsibilities are assigned, controlled and coordinated, and how information flows within the organization. An organizational chart illustrates the organizational structure.)

- Organization’s policies

- Organization’s objectives

- Organization’s strategies

- Organization’s resources and knowledge capabilities, such as capital, time, people (human), processes, systems , technologies

- Information systems

- Information flows

- Formal and informal decision-making processes

- Relationship with internal stakeholders

- Perceptions and values of internal stakeholders

- Organization’s culture

- Standards, guidelines and models adopted by the organization

- Form and extent of contractual relationship


Risk management system of an organization operates within the parameters of the organization’s culture, processes, structure and study. Understanding the internal context is fundamental to risk management process. The risk management process should be aligned with the organization’s culture, processes, structure and strategy. Anything within the organization can influence the risk management process of the organization. Factors influencing the risk management process should be established as the risk management in the organization takes place in the context of organization’s objectives. Organization should consider objectives and criteria of a particular project, process or activity in light of organization’s overall objectives. Organization should recognize opportunities to achieve organization’s strategic, project or business objectives as these may affect ongoing organizational commitment, credibility, trust and value.