The importance of 𝘶𝘯𝘥𝘦𝘳𝘴𝘵𝘢𝘯𝘥𝘪𝘯𝘨 𝘰𝘧 𝘵𝘩𝘦 𝘤𝘰𝘯𝘵𝘦𝘹𝘵 in risk management cannot be overstated. Every enterprise is functioning in their own unique environment influenced by various internal and external factors that can determine their ability to achieve the set objectives. Where these factors should appropriately reflect is, on the ʀɪsᴋ ᴀssᴇssᴍᴇɴᴛ. While performing the risk assessment, if these factors are not considered properly, it is very likely that the organisation will not be able to identify the 𝙧𝙞𝙜𝙝𝙩 𝙧𝙞𝙨𝙠𝙨 that they need to address.
Generally, the practice is that the team begins with risk identification without the understanding of the environment in which they (the organisation) perform their (business or other) activities and how the above factors can influence the accuracy/correctness of their risk assessment.
Refer to any ISO 𝑟𝑒𝑞𝑢𝑖𝑟𝑒𝑚𝑒𝑛𝑡 𝑠𝑡𝑎𝑛𝑑𝑎𝑟𝑑 (like ISO 9001, ISO 20000-1, ISO 27001), clause 4 is 𝘤𝘰𝘯𝘵𝘦𝘹𝘵 𝘰𝘧 𝘵𝘩𝘦 𝘰𝘳𝘨𝘢𝘯𝘪𝘴𝘢𝘵𝘪𝘰𝘯. The expectation is that the organisation understands the internal and external environments that can influence the risks to the organisation in achieving their objectives (may be, in a particular area). Whenever these standards refer to the context of the organisation, they also expect the user of the standard to refer to ISO 31000 for further understanding of the contexts concept.
ISO 31000 gives a very good perspective of the contexts that an enterprise may want to consider. These contexts change from organisation to organisation, region to region or sectors to sectors and so on. A wide variety of factors may have to be considered while preparing for risk assessment.
Is this (contexts) the only factor to consider while performing risk assessment? No.
The entire risk management effort is towards 𝐚𝐜𝐡𝐢𝐞𝐯𝐢𝐧𝐠 𝐭𝐡𝐞 𝐨𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞𝐬. So it becomes very important that the context and objectives are considered together while assessing the risks.
Comentarios