How RAISE applies ISO 31000
RAISE is built on the risk-management process of the ISO 31000:2018 standard. Each phase of the process, from context to recording, has a function in the software, and the risk index comes from a transparent formula: a central value, a range from a Monte Carlo simulation and the exact weight of each factor. The risk index, the Monte Carlo simulation and the risk register are techniques described in IEC 31010:2019.
ISO 31000 phases in RAISE
| ISO 31000 phase | In RAISE |
|---|---|
| Scope, context and criteria | Structures as a pyramid, the asset register, configurable risk criteria and thresholds. |
| Risk identification | Configurable risk categories; factors from confirmed documents, from hazard data about the territory and from threats. |
| Risk analysis | Likelihood and impact per category, a Monte Carlo simulation of the index. |
| Risk evaluation | Comparison with thresholds, the level on the scale, a register sorted by risk. |
| Risk treatment | Actions with owner, due date and cost; residual risk. |
| Monitoring and review | Index history and trend, trend alerts and live alerts. |
| Recording and reporting | Chained audit trail, assessment report, register export. |
How the risk index is calculated
Factors
Each factor of the asset, the territory or the threats is brought onto a scale from 0 to 1.
Categories
For each risk category, the weighted sum of its factors gives the likelihood; the asset's criticality gives the impact.
Index
The highest category, likelihood times impact, becomes the index from 0 to 100, with its level on the scale.
Range
A Monte Carlo simulation varies the factors within their uncertainty: the central value is the 50th percentile, the range runs from the 10th to the 90th.
Explanation
Each factor's contribution is exact; the explanation reports the main ones, with their numbers. A missing value stays neutral and is flagged.
The time horizon of each alert
Live alerts carry a horizon, shown as a ruler: Past, Now, Soon. Live events are evidence for the next assessment and never change the validated index.
- Past
- Now (active)
- Soon (active)
Frequently asked questions
Is there an ISO 31000 certification?
No: ISO 31000 is a guideline and offers no certification. RAISE follows its process, phase by phase.
Why does RAISE use a Monte Carlo risk simulation?
Because the input data are uncertain. The Monte Carlo simulation, one of the techniques described in IEC 31010:2019, the companion standard to ISO 31000, varies the factors within their margins and shows where the value falls between the 10th and the 90th percentile of the scenarios, around the central value.
What does ISO 31000 say about risk management?
ISO 31000:2018 sets eight principles: risk management should be integrated, structured and comprehensive, customised, inclusive, dynamic, based on the best available information, attentive to human and cultural factors, and continually improved. RAISE follows its process, from context to recording.
Does RAISE use a risk matrix?
Not a fixed one: for each risk category RAISE takes the likelihood from the factors and the impact from the asset's criticality, and for the highest category their product becomes the index from 0 to 100. In the treatment plan, residual likelihood and impact are set on a scale from 1 to 5.
What happens when a value is missing?
The factor stays neutral and the explanation flags it as missing: RAISE does not fill gaps with assumed values.
Which ISO 31000 phases does RAISE cover?
The phases of the process: scope, context and criteria; risk identification, analysis and evaluation; treatment; monitoring and review; recording and reporting.