When defining the success measures for the organization’s risk strategy, the risk management professional will include which of the following steps?

Defining success measures for a risk strategy is fundamentally about determining if the strategy has achieved its intended purpose. The purpose is articulated through the strategy's goals and objectives. Therefore, the foundational step is to review these goals and objectives to ensure that the chosen performance indicators (success measures) are relevant, aligned, and capable of tracking progress toward the desired outcomes. This aligns with the ISO 31000 principle that risk management should be integrated with organizational objectives to create and protect value.

B. A selection of appropriate media for communicating the risk strategy is part of the communication and consultation process, not the definition of performance metrics.

C. An analysis of the organization’s total cost of insurable risk is a specific, narrow metric, not the overarching step of defining all success measures for the entire strategy.

D. The development of timelines for implementing the risk strategy is a project management activity related to execution, not the evaluation of the strategy's effectiveness.

1. ISO 31000:2018, Risk management — Guidelines, Clause 5.6 "Evaluation": This clause states, "In order to evaluate the effectiveness of the risk management framework, the organization should: periodically measure the risk management framework’s performance against its purpose, implementation plans, indicators and expected behaviour." The "purpose" is directly derived from the organization's goals and objectives for risk management.

2. Purdy, G. (2010). ISO 31000: The Gold Standard. Risk Management Magazine, 57(9), 28-32. In this article, the author emphasizes that the core definition of risk in ISO 31000 is "the effect of uncertainty on objectives." Consequently, any measure of the success of risk management must be directly linked back to the achievement of those objectives.

3. North Carolina State University, Enterprise Risk Management (ERM) Initiative. (2017). ERM in Practice: A Look at the Application of ERM in Different Kinds of Organizations. This report, consistent with university-level ERM courseware, highlights that effective ERM programs define success by how well they support the achievement of strategic objectives. It notes that organizations often develop Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) that are explicitly tied to strategic goals (see pages 5-7 on "Linking ERM to Strategy").