ISO 31000 is built on 11 guiding principles. Identify THREE of these.

The question refers to the 11 guiding principles of the ISO 31000:2009 standard. According to this standard, effective risk management should:
1. Create and protect value (A).
2. Explicitly address uncertainty (C).
3. Take human and cultural factors into account (B). These three options are direct restatements of the core principles outlined in the standard. The goal of these principles is to ensure that risk management is not a standalone activity but an integrated, dynamic, and tailored part of an organisation's governance, strategy, and culture, ultimately contributing to the achievement of its objectives.

D. Risk Management should be done annually: This is incorrect. A key principle is that risk management must be dynamic, iterative, and responsive to change, not confined to a rigid annual schedule.
E. Risk Management should include only the Departments affected by risk: This is incorrect. The standard mandates that risk management be an integral part of all organisational processes and be inclusive, not siloed within specific departments.

1. International Organization for Standardization. (2009). ISO 31000:2009 Risk management — Principles and guidelines. Clause 3, Principles, pp. 3-4.

2. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272–300. (The 11 principles are listed and discussed on p. 275). https://doi.org/10.1057/rm.2012.9

3. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. (Discusses the principles, including value creation, addressing uncertainty, and human/cultural factors on pp. 882-883). https://doi.org/10.1111/j.1539-6924.2010.01442.x