Risk management is a strategic management process.

According to ISO 31000:2018, risk management is fundamentally a strategic process. The standard emphasizes that risk management should be integrated into all of an organization's activities and functions, most critically into governance, strategy, and planning. It is not treated as a separate, siloed activity but as an essential component of strategic decision-making. By managing risks, an organization can better understand uncertainties and their potential effects on achieving strategic objectives, thereby improving performance and supporting sustainable value creation. This integration makes it an inherent part of strategic management.

B. False: This is incorrect. ISO 31000 explicitly moves risk management from a purely operational or compliance function to a core element of strategic planning and governance, as stated in its principles and framework guidelines.

1. ISO 31000:2018 - Risk management — Guidelines.

Clause 4, Principles: The principle of "Integrated" states, "Risk management is an integral part of all organizational activities." This includes governance and strategy.

Clause 5.4, Integration: This section explicitly details how to integrate risk management into an organization, stating it should be part of "governance, strategy and planning, management, reporting processes, policies, values and culture."

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886.

Page 883, Section "Integration": The author notes that ISO 31000's emphasis on integration "is intended to ensure that risk management is not a stand-alone activity... but is part of strategic and operational management." This academic analysis confirms the strategic nature of the process as defined by the standard. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x)

3. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300.

Page 275: The paper discusses how ISO 31000 promotes a "holistic and strategic vision of risk management" that is integrated with the organization's overall governance and objectives, contrasting it with older, more fragmented approaches. (DOI: https://doi.org/10.1057/rm.2012.9)