The organization’s resources and internal support are ________ the risk management strategy.

According to the ISO 31000:2018 standard, the design of the risk management framework requires a comprehensive understanding of the organization's internal context. This context explicitly includes available resources (e.g., capital, time, people, technology) and the degree of internal support and commitment from leadership. These factors are fundamental inputs that determine the scope, objectives, and feasibility of the risk management strategy. A strategy must be tailored to the organization's specific capabilities and culture to be practical and effective. Therefore, resources and support are considered foundational inputs during the development phase.

A. adjustable to match: Resources are often a constraint that the strategy must be designed around, not something that can always be adjusted to fit an ideal strategy.
C. metrics used to measure the value of: Resources are the means to execute the strategy, not the metrics themselves. Metrics would be things like cost savings or reduction in incident frequency.
D. outcomes of the development of: Resources and support are pre-existing conditions and inputs for strategy development, not the results or outcomes of that process.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Clause 5.3.1, "Understanding the organization and its context," states that in designing the framework, the organization should examine and understand its internal context, which includes "resources and knowledge (e.g. capital, time, people, processes, systems and technologies)" and "governance, organizational structure, roles, accountabilities, strategies, objectives and policies." This establishes resources and support as key inputs.

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis, 30(6), 881-886.

Page 883, Section "Framework for Managing Risk," discusses that the framework must be integrated into the organization's overall governance, strategy, and planning. This integration inherently requires considering the organization's existing resources and support structures as foundational inputs for the strategy to be coherent and viable. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. Leitch, M. (2010). ISO 31000:2009 - The new international standard on risk management. Risk Analysis: An International Journal, 30(6), 887-892.

Page 889, the article explains that understanding the organization's context (Clause 4.3.1 in the 2009 version, now 5.3.1 in 2018) is a critical first step. This involves analyzing internal factors like "capability in terms of resources and knowledge," which directly supports the concept of resources being an input to the entire process. DOI: https://doi.org/10.1111/j.1539-6924.2010.01441.x