IRM/AIRMIC/ALARM A Risk Management Standard (2002)

The Institute of Risk Management's risk management framework is set out in A Risk Management Standard, written in 2002 by the IRM with AIRMIC and ALARM using the ISO/IEC Guide 73 vocabulary and still issued free by the IRM. It treats risk as having upside and downside, is deliberately non-prescriptive and not certifiable, and describes a process from the organisation's strategic objectives through risk assessment (identification, description, estimation, analysis techniques, risk profile, evaluation against criteria), internal and external reporting, treatment (control, avoidance, transfer, financing) and monitoring and review, together with the structure for administering it: the risk management policy and appetite and the roles of the board, business units, the risk management function and internal audit, with resourcing and embedding. It comprises 17 controls organised across 7 domains, and applies in International.