2
© ISO 2009 – All rights reserved
NOTE 5 Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of an
event, its consequence, or likelihood. [ISO Guide 73:2009, definition 1.1]
2.2 risk management
coordinated activities to direct and control an organization with regard to risk 2.1
[ISO Guide 73:2009, definition 2.1]
2.3 risk management framework
set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring 2.28, reviewing and continually improving risk management 2.2 throughout the organization
NOTE 1 The foundations include the policy, objectives, mandate and commitment to manage risk 2.1.
NOTE 2 The organizational arrangements include plans, relationships, accountabilities, resources, processes and
activities. NOTE 3
The risk management framework is embedded within the organizations overall strategic and operational policies and practices.
[ISO Guide 73:2009, definition 2.1.1]
2.4 risk management policy
statement of the overall intentions and direction of an organization related to risk management 2.2
[ISO Guide 73:2009, definition 2.1.2]
2.5 risk attitude
organizations approach to assess and eventually pursue, retain, take or turn away from risk 2.1
[ISO Guide 73:2009, definition 3.7.1.1]
2.6 risk management plan
scheme within the risk management framework 2.3 specifying the approach, the management components and resources to be applied to the management of risk 2.1
NOTE 1 Management components typically include procedures, practices, assignment of responsibilities, sequence
and timing of activities. NOTE 2
The risk management plan can be applied to a particular product, process and project, and part or whole of the organization.
[ISO Guide 73:2009, definition 2.1.3]
2.7 risk owner
person or entity with the accountability and authority to manage a risk 2.1
[ISO Guide 73:2009, definition 3.5.1.5]
Normen-Download-Beuth-Brokersclub AG-KdNr.7542443-LfNr.5061405001-2010-09-27 15:56
© ISO 2009 – All rights reserved
3
2.8 risk management process
systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context, and identifying, analyzing, evaluating, treating, monitoring 2.28 and
