4. Risk management and Risk manager

4.1 Prerequisite

Implementing the above-mentioned best practices therefore presupposes the establishment of a risk management system, rather than the haphazard addition of individual actions. This inevitably raises the question of how this system is managed. In other words, if there is risk management, what about the risk manager?

In the past, risk management was often dispersed across several functions – customer credit, insurance management, legal department, occupational health and safety... – and thus limited to these few functions. The move towards unified, integrated risk management is changing all that.

So, what does ISO 31000 have to say on the subject? Not much, to be honest, although responsibilities within the management system...