A risk management professional advises management on the status of key risks by

A key role of a risk management professional is to support decision-making by providing timely and relevant information. According to ISO 31000, risk management is an iterative process that is responsive to change. Key risks are not static; their characteristics, such as likelihood, consequence, velocity, and interdependencies, evolve with changes in the internal and external context. Advising management on these changing characteristics ensures that the organization's understanding of its risk profile remains current and that risk responses are appropriate and effective. This aligns with the core ISO 31000 principles of being dynamic and integrated into decision-making.

A. annually identifying the inventory of risks. This is a periodic activity, whereas advising on the status of key risks should be a continuous process, as risk characteristics can change much more frequently than annually.
B. providing information about competitors’ risk management plan. While part of understanding the external context, this does not directly address the status of the organization's own key risks, which is the primary focus of the advisory role.
D. summarizing internal audit reports. This is too narrow. Internal audit reports are just one of many inputs for monitoring risks; the professional must synthesize information from all relevant sources to provide a complete picture.

1. ISO 31000:2018

Risk management — Guidelines.

Clause 4

Principle (d) "Iterative and responsive to change": States

"Risk management continually senses and responds to change. As external and internal events occur

context and knowledge change

monitoring and review take place

new risks emerge

some change

and others disappear." This directly supports the need to provide insights on changing risk characteristics.

Clause 6.6

"Monitoring and review": Emphasizes that the purpose is to "assure and improve the quality and effectiveness" of the process by checking for "changes in the external and internal context" and "monitoring risks". This necessitates communicating the evolving status of risks.

2. Purdy

G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal

30(6)

881-886.

Page 884

Section 3.2: The article discusses the principles of ISO 31000

highlighting that risk management "is dynamic

iterative and responsive to change." This principle underpins the professional's role in continuously assessing and communicating the changing nature of risks to management

rather than performing static

periodic reviews. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. University of Queensland

Course MINE7037 - Risk Management for Underground Mining. (2021). Lecture 2: Risk Management Frameworks and Processes.

Slide 15

"ISO 31000:2018 Principles": Course materials often summarize the standard's principles

explaining that being "dynamic

iterative and responsive to change" means the risk management framework must be able to adapt. The risk professional facilitates this by providing updated insights on risk status to inform ongoing strategic and operational decisions.