Uncertainty leads to a changing context

The statement is correct. According to the principles and process outlined in ISO 31000, the context in which an organization operates is not static; it is dynamic and continually evolving. This evolution is fundamentally driven by uncertainty. Uncertainty, defined in ISO 31000 as a "state, even partial, of deficiency of information," relates to the potential for future events and their consequences. As new information becomes available or as uncertain events materialize, the organization's internal and external context changes. For example, uncertainty about future economic conditions, technological advancements, or regulatory shifts means the context is in a constant state of potential change. The risk management process must therefore be iterative, with continuous monitoring and review to detect and respond to these changes in context.

Stating this is "False" would imply that context is static or that changes to it are independent of uncertainty. This contradicts a core tenet of ISO 31000, which treats risk management as a dynamic and integral part of decision-making that must adapt to change. The entire purpose of the "Monitoring and review" step (Clause 6.7) in the risk management process is to systematically track risks and the effectiveness of controls in light of the evolving internal and external context, which changes precisely because of unfolding uncertainties.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Clause 6.7 (Monitoring and review): This clause states that the purpose of monitoring and review is to assure and improve the effectiveness of the risk management process. This is achieved

in part

by "detecting changes in the external and internal context... which can require revision of risk treatments and priorities." This directly links the need for monitoring to a changing context.

Clause 6.3.2 (Establishing the external context): This section lists factors such as the "social

cultural

political

legal

regulatory

financial

technological

economic

and environmental" environment. These factors are inherently uncertain and subject to change

thus making the context dynamic.

Principle (d) "Iterative": The standard lists "Iterative" as a key principle of risk management

stating that "Risk management is iterative. As new information becomes available

and as a result of monitoring and review

the understanding of risk can change. This leads to the re-analysis of risks

and the revision of risk treatments and controls." This new information directly addresses and alters the state of uncertainty

thereby changing the context.

2. Purdy

G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis

30(6)

881-886.

Page 884

Section "Principles for Managing Risk": The author discusses the principle that risk management should be "dynamic

iterative and responsive to change." It explains

"Organizations exist in a context that changes. Risk management anticipates

detects

acknowledges and responds to those changes and events in an appropriate and timely manner." These "changes and events" are the materialization of uncertainties

which directly alter the context. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x)

3. Lalonde

C.

& Boiral

O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management

14(4)

272-300.

Page 280: The authors note that the ISO 31000 process begins with establishing the context

which "is not a static photograph of the organization and its environment

but a dynamic process that must be regularly updated." This dynamism is a direct consequence of the uncertainties inherent in the internal and external environments. (DOI: https://doi.org/10.1057/rm.2012.9)