Enterprise Risk Management Policy and Procedure
SecureXcel Private Limited is a cybersecurity, governance, risk and compliance (GRC), and assurance services company.
An enterprise risk management policy and procedure, and a complete risk register to go with it: 81 risks in 12 registers, including AI and cybersecurity, with the scales used to score them.
ISO 31000 is guidance on managing risk, not a certifiable standard. It describes principles, a framework and a process: set the scope and criteria, identify, analyze and evaluate risks, treat them, and monitor and review. The policy sets out how an organization does that, and the register is where the result lives.
The register is a working Excel file: department registers, a consolidated register and the rating scales as annexures. It is shown here risk by risk, so you can see what a complete one looks like before you download it.
SecureXcel Private Limited is a cybersecurity, governance, risk and compliance (GRC), and assurance services company.
An ISO 31000 enterprise risk register in Excel: 81 risks across 12 registers, including AI and cybersecurity, with the rating scales and treatment plans.
No. ISO 31000:2018 gives guidelines rather than requirements, so there is nothing to certify against. It is widely used as the basis for a risk process, and ISO 27001 and ISO 42001 both rely on a documented risk method.
81 risks in 12 registers, one for each department plus AI and cybersecurity, each with an owner, inherent and residual ratings, existing controls and a treatment plan.
Yes. ISO 27001 requires a risk assessment and risk treatment process, and a register like this is the record of both. Add your own assets, threats and controls.
Yes. Read the policy and the register in full on this site; the Word and Excel files are free once you sign in.