Risk frameworks and the human factor
A risk framework gives you a common language and a repeatable process. It does not, by itself, make an organisation better at managing risk. What determines that is whether people engage honestly with it — and that is a question about behaviour, incentives and culture rather than methodology.
What this session covers
- Frameworks such as ISO 31000 and the NIST risk management guidance provide structure: context, identification, analysis, evaluation, treatment, monitoring and communication.
- Scoring scales must be defined explicitly, or 'high' means something different to every person using it.
- People systematically underestimate risks they have lived with for a long time and overestimate recent, vivid ones.
- If reporting a risk gets someone into trouble, risks stop being reported. Incentives shape the register more than any framework does.
This is the area where GRC most clearly stops being a documentation exercise. The register reflects what people are willing to say out loud. If a team believes that raising a risk will be treated as an admission of failure, the register will be quietly optimistic and the organisation will be blind in exactly the places it most needs to see.
Building the conditions for honest reporting is a large part of what a good GRC function actually does.
Go further with mentorship
This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation.