ECERTP USA
ISO 31000 Foundation
Course Description
The ISO 31000 Foundation Course is an introductory training program designed to equip individuals with a fundamental understanding of the principles, framework, and process of risk management as outlined in the ISO 31000:2018 standard. This course provides a comprehensive overview of how to integrate a robust risk management system into an organization’s governance, planning, and decision-making processes. A key focus is placed on understanding the unique risks posed by modern technologies, including artificial intelligence (AI) systems, and how the core ISO 31000 principles can be applied to address these emerging challenges. Participants will learn to identify and address a wide range of risks, from traditional business hazards to the complex, socio-technical risks of AI, enabling them to contribute to a secure and resilient organizational environment.
Course Outline
Module 1: Introduction to ISO 31000 and the Modern Risk Landscape
● What is risk? Defining terms and concepts in an evolving world.
● Overview of the ISO 31000:2018 standard and its relevance to all types of organizations.
● The principles of effective risk management in the 21st century.
● The New Risk Frontier: Differentiating traditional risks from those posed by AI and other emerging technologies.
Module 2: The Principles of Risk Management
● In-depth review of the 8 principles of ISO 31000.
● Applying the principles to both conventional and AI-driven business activities.
● Leadership and commitment in fostering a risk-aware culture.
Module 3: The Risk Management Framework
● Designing and implementing a risk management framework that can adapt to rapid
technological change.
● Integrating the framework into existing governance, strategy, and operational processes.
● Evaluating and continually improving the framework, including mechanisms to handle
new types of risks.
Module 4: The Risk Management Process
● Communication & Consultation: Engaging with diverse stakeholders, including
technical and ethical experts.
● Establishing the scope, context, and criteria for risk assessments in a data-driven world.
● Risk Assessment:
○ Risk Identification: Identifying risks from various sources, including data,
algorithms, and AI system behavior.
○ Risk Analysis: Understanding the likelihood and impact of risks, including AI-specific
vulnerabilities like data poisoning and adversarial attacks.
○ Risk Evaluation: Deciding on risk significance and a path forward.
● Risk Treatment and Planning: Developing strategies to manage risks, including those
related to AI model bias and security flaws.
● Monitoring & Review: Establishing continuous monitoring for risks, including drift in AI
model performance.
● Recording & Reporting: Documenting the risk management process for accountability
and transparency.