Organizational information systems, information flows, and formal and informal decision-making processes are all a part of establishing which type of…

According to ISO 31000:2018, establishing the context is a critical step in the risk management process. This involves defining the internal and external parameters to be considered when managing risk. The internal context specifically refers to the internal environment in which the organization operates and seeks to achieve its objectives. This includes governance, organizational structure, policies, capabilities, culture, and critically, the organization's information systems, information flows, and both formal and informal decision-making processes. These elements are fundamental to understanding how the organization functions internally and how risks can arise from and affect its operations.

A. External: The external context pertains to factors outside the organization, such as the social, political, legal, regulatory, economic, and competitive environments, which are not described in the question.

B. Technological: While information systems are technological, this option is too narrow. The question also includes non-technological elements like decision-making processes and information flows, which are part of the broader internal context.

C. Local: "Local" is not a formal category for establishing context within the ISO 31000 framework. The standard distinctly categorizes context as internal and external.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Section 6.3.2.2 Internal context: This section explicitly lists the elements to consider when establishing the internal context. It states

"In establishing the internal context

the organization should consider... information systems

information flows and decision-making processes (both formal and informal)..." This directly supports the correct answer.

2. Purdy

G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal

30(6)

881-886.

Page 884

Section "The Framework": The article discusses the ISO 31000 framework

explaining that establishing the context involves understanding the organization's internal environment

which includes its "objectives

strategies

structure

capabilities

culture

processes

systems

and other internal factors." This aligns with the elements mentioned in the question as being part of the internal context.

DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. Leitch

M. (2010). ISO 31000:2009 - The new international standard on risk management. Risk Analysis: An International Journal

30(6)

887-892.

Page 889

Table I

Row "Establishing the context": The table summarizes the risk management process according to ISO 31000. It describes establishing the internal context as understanding the "internal environment

" which encompasses the organization's governance

structure

culture

and systems—reinforcing that the items in the question are internal.

DOI: https://doi.org/10.1111/j.1539-6924.2010.01441.x