ISO 31022:2020

ISO 31022:2020 gives guidelines for managing legal risk, the risk related to legal, regulatory and contractual matters and to non-contractual rights and obligations (illegal conduct, duty of care, intellectual property), as a complement to ISO 31000 for any organization. Clause 4 recasts the ISO 31000 principles for legal risk (integration into governance and decision-making, a structured and customised approach reflecting the legal environment and conflict of laws, inclusion that preserves legal privilege, dynamic monitoring of legal change, the best available legal information, human and cultural factors, continual improvement) and adds equity. Clause 5 runs the ISO 31000 process for legal risk: external context (laws by jurisdiction, extraterritoriality, third parties, regulators and media) and internal context (entity structure, contracts, rights, duty of care, transaction liabilities, dispute history); legal risk criteria agreed with management and never so narrow that legal is engaged only in a crisis; identification through a methodology, a register and a process for new and changed laws; analysis of causes, likelihood and consequences with the correlation to other risks; evaluation against the criteria including reputation, values, maturity and negotiating leverage; treatment options with key risk indicators (contract liability against value, executed contracts against deals, sales against compliance training), residual-risk acceptance and a plan of policies, standard practices, contract templates, notifications and training; and communication that preserves privilege, learning, monitoring with early warning and pattern analysis, and record-keeping under privilege, retention, chain-of-evidence and access rules. Clause 6 embeds the discipline: a policy, assigned roles and functions with counsel available to risk owners, integration into all activities, resources and awareness. Annexes give an identification matrix, a register, likelihood and consequence approaches and key contract clauses. It comprises 24 controls organised across 3 domains, and applies in International.