Risk management is a strategic management process.

ISO 31000:2018 establishes risk management as a core component of an organization's governance and leadership, fundamentally integrating it with strategy and objective-setting. The standard's framework requires that risk management is not treated as a separate, standalone activity but is woven into all significant decision-making processes, including strategic planning. By managing uncertainty related to the achievement of strategic objectives, risk management directly supports and influences the strategic direction of the organization, thereby functioning as a strategic management process.

The option "False" is incorrect. To suggest that risk management is not a strategic process would be to relegate it to a purely operational or compliance-focused function. This view contradicts the primary purpose and principles of ISO 31000, which emphasize the integration of risk management into the highest levels of organizational governance and decision-making to create and protect value.

1. ISO 31000:2018 - Risk management — Guidelines, Clause 4, Principles. Principle (a) states that for risk management to be effective, it should be "Integrated" and that "Risk management is an integral part of all organizational activities." This includes strategic planning and governance.

2. ISO 31000:2018 - Risk management — Guidelines, Clause 5.3, Integration. This section explicitly states that "Integrating risk management relies on an understanding of organizational structures and context. [...] Risk management should be a part of, and not separate from, the organizational purpose, governance, leadership and commitment, strategy, objectives and operations."

3. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. In the abstract and discussion, the author highlights that the standard's purpose is to integrate risk management into an organization's "overall governance, strategy and planning, management, reporting processes, policies, values and culture," confirming its strategic nature. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x)

4. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. The authors note that ISO 31000 promotes a "holistic and strategic vision of risk management" (p. 274) and is designed to be integrated into the organization's strategic processes. (DOI: https://doi.org/10.1057/rm.2012.9)