Global ISO survey Results & analysis

Transcription

1 Global ISO survey 011 Results & analysis

2 Survey Background ISO 31000:009 Risk management principles and guidelines published in 009. ISO is a voluntary generic guideline. Internationally recognised reference. LinkedIn ISO group founded March 009 ISO experts are working on the ISO guide to ISO due to be published in 014

3 How the survey was conducted Conducted between the 17th of October and the1th of December 011. Internet-based survey with 10-1 closed questions + open questions for feedback to ISO PC 6. Global reach via more than 100 risk management associations and LinkedIn groups in all sectors worldwide. No sponsors to ensure impartiality. Managed by a committee of volunteer experts who have large amount of experience using ISO 31000

4 G31000 Committee in charge Questionnaire design : Jacquetta Goy (Canada), Grant Purdy (Australia), Arnold Schanfield (USA), John Lark (Canada), Julian Talbot (Australia), Julian du Plessis (South-Africa), Jeffrey DeRose (USA), Pat Croke (Ireland) and Alex Dali (France) Participating contacts : one person for each of the 100+ participating associations/linkedin groups IT systems and survey design : Pat Croke Powerpoints : Pat Croke, Alex Dali Translation : Angel Escorial Bonet (Spanish), Alex Dali (French) We would like to thank all those who co-operated with the conduct this survey. Without their help, this survey could not have been carried out. 01 Copyright of G31000 all rights reserv. reserved

5 Survey Objectives Understand how ISO is perceived by risk practitioners in all sectors worldwide. How the ISO is used by risk practitioners. Collect questions, comments and input for the future ISO guide. Raise awareness about the existence of the ISO Risk Management standard

6 People Contacted Main Source : ISO LinkedIn discussion group which has participants from over 90 countries. Additionally 100 risk management associations and other LinkedIn groups, on a voluntary basis representing more than people (note 1) Advertised via a few risk management websites and several risk management magazines Note 1 Many people are part of multiple LinkedIn groups and associations

7 List of associations & LinkedIn groups participating

8 Survey Population 183 responses from 111 countries. Largest Country representation in the survey USA 0% Australia 10% U.K. 10% South Africa 8% India 4% Canada 4% France 3%

9 Survey Population (based on 183 responses) USA 0% UK 10% 111 countries Australia 10% South Africa 10% India 4% France 3% Canada 4%

10 Word of caution Some countries are over represented and others under represented relative to their population sizes USA sample 366 population 314 million ratio 1:1,000,000 Australia sample 176 population million ratio 8:1,000,000 U.K. sample 179 population 6 million ratio 3:1,000,000 South Africa sample 139 population 0 million ratio 3:1,000,000 India sample 78 population 110 million ratio.06:1,000,000 Canada 76 population 34 million ratio :1,000,000 France sample 3 population 6 million ratio.84:1,000,000 New Zealand 43 population 4. million ratio: 9.:1,000,000 UAE 30 population 8 million ratio: 3.7:1,000,000

11 Word of caution Some Country samples are too small to be representative. Self selecting sample likely to more interested in risk management than the normal population. Likely to be over represented by people interested in ISO English speaking countries over represent 0% of sample. Risk Management departments over represented 41% of sample.

12 Participating Organizations Size (based on 183 responses) # responses percent % % % % % 1,001-, %,001-10, % 10, %

13 Participation by Sector Public sector 11 Management Consulting 04 Information Technology 18 Insurance 134 Financial services 13 Banking 90 Manufacturing 8 Education 83 Other 79 Energy 63 Oil & Gas 6 Construction Telecommunications (based on 183 responses) Computers 1 Mining & metals 49 Health products & services - 47 Transport and logistics 47 Utilities 3 Aerospace & defense 8 Chemicals 3 Retailing 1 Medical & Hospital 0 Food drink & tobacco production 19 Media 19 Automotive & transport equipment 17 Not for Profit 16 Security 11

14 Participation by Sector (based on 183 responses) 3% 3% 4% % % % 1% 7% 7% 11% 10% Public sector Management Consulting Information Technology Insurance Financial services Banking Manufacturing Education Other Energy Oil & Gas Construction Telecommunications Computers Mining & metals Health products & services Transport and logistics Utilities Aerospace & defense Chemicals Retailing Medical & Hospital Food drink & tobacco production Media Automotive & transport equipment Not for Profit Security

15 Participation by Department Type % % % % 3% 4% % % % 1% 1% 1% 1% 1% Risk Management Information Technology 6% 9% 1% 41% (based on 183 responses) Audit Occupational Health & Safety Operations Other Accounting/Finance Business development Services Facility management/security Administration Insurance Consulting Legal Sales & marketing Quality Product development Project Management

16 Participation by Job Type (based on 183 responses)

17 What is your level of awareness about ISO 31000? I understand ISO completely I have some knowledge of ISO I have heard of ISO I dont know what ISO is (based on 183 responses) 14% % 6% 3%

18 What is your level of awareness about ISO 31000? by Country (based on 183 responses) Australia New Zealand Canada UAE Brazil South Africa All Countries Rest of World Spain Netherlands UK Finland Italy France USA India % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% I understand ISO completely I have some knowledge of ISO I have heard of ISO I dont know what ISO is

19 What is your level of awareness about ISO 31000? by Organization Size (based on 183 responses) % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% I understand ISO completely I have some knowledge of ISO I have heard of ISO I dont know what ISO is

20 What is your level of awareness about ISO 31000? by Department (based on 183 responses) All Departments Other Departments Audit Operations Occupational Health & Safety Information Technology Risk Management % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% I understand ISO completely I have some knowledge of ISO I have heard of ISO I dont know what ISO is

21 How is risk management mainly used within your organization? (based on 176 responses)

22 How is risk management mainly used within your organization? by Country (based on 176 responses) All Countries Rest of World UAE South Africa New Zealand Italy Finland Spain India Canada Brazil Australia UK Netherlands France USA % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% Not used Report performance Safety/Security Insurance Auditing/Compliance All decisions

23 How is risk management mainly used within your organization? by Country (based on 176 responses) 40%-Decisions AU, 64% NZ, 60% SA, 48% UK, 48% CA, 47% UAE,43% USA,3% FI,3% IN,8% ES,8% FR,% NL,3% BR,3% IT,3% IN, 40% BR, 38% SA, 34% FR, 8% FI,4% NL,3% UAE,0% ES,19% UK,19% CA,16% USA,1% AU,1% NZ,1% IT,9% 1%-Audit/compliance 18%-Safety/security IT, 34% NL, 30% FI, 9% ES, 8% USA,1% BR,1% CA,0% FR,19% UK,17% NZ,16% UAE,13% IN,13% AU,11% SA,% UAE, 17% IN, 14% UK,1% FI,1% IT,11% BR,10% NZ,9% AU,9% SA,9% USA,8% CA,8% ES,6% NL,% FR,% 9%-Reporting 7%-Insurance IT, 0% USA,17% ES, 1% FR,9% CA,% SA,4% UAE,3% NL,% IN,1% AU,1% UK,1% FI,0% BR,0% NZ,0% FR, 17% NL, 16% BR,8% ES,4% CA,4% IN,4% USA,4% UAE,3% FI,3% IT,3% UK,3% NZ,% AU,% SA,1% %_Not used

24 How is risk management mainly used within your organization? by Organization Size (based on 176 responses) % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% Not Used Report performance Safety/security Insurance Auditing/Compliance All decisions

25 How is risk management mainly used within your organization? by Department (based on 176 responses) Not used Report performance Safety/Security Insurance Auditing/Compliance All decisions All Departments Other Departments Facility management/security Information Technology Operations Occupational Health & Safety Audit Risk Management

26 How is risk management mainly used within your organization? by Department (based on 176 responses) Audit Information Technology Health and Safety Operations Risk Management

27 How would you compare ISO 31000: Risk Management Principles and Guidelines (009) to other risk management references, guidelines and standards? (based on 1086 responses)

28 How would you compare ISO 31000: Risk Management Principles and Guidelines (009) to other risk management references, guidelines and standards? By Country All Countries Rest of World Brazil South Africa India Italy UAE Canada France New Zealand Australia Spain Finland Netherlands USA UK 0% 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% Similar Worse Better No Opinion (based on 1086 responses)

29 How would you compare ISO 31000: Risk Management Principles and Guidelines (009) to other risk management references, guidelines and standards? By Country Better BR, 7% SA, % IN, % IT, 3% UAE, 0% CA, 49% FR,46% NZ,4% AU,44% ES,43% FI,41% NL,3% USA,34% UK,9% Same NL, 7% UK, 4% UAE, 0% AU, 47% NZ,4% FI,41% ES,39% USA,38% FR,38% SA,36% IT,3% BR,3% CA,33% IN,30% No Opinion USA, 7% ES, 18% FI, 17% IN,1% UK,1% FR,13% IT,1% CA,10% BR,9% NL,9% SA,8% NZ,8% AU,7% UAE,0% Worse NZ, 9% CA, 8% FR,4% AU,% UK,% USA,1% BR,0% FI,0% IN,0% IT,0% NL,0% SA,0% ES,0% UAE,0% (based on 1086 responses)

30 How would you compare ISO 31000: Risk Management Principles and Guidelines (009) to other risk management references, guidelines and standards? By Department (based on 1086 responses) All Departments Other Departments Accounting/Finance Occupational Health & Safety 0 17 Audit Information Technology Operations Risk Management % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% Same Worse Better No Opinion

31 Do you think that the associations you are a member of, should officially recommend that their members use ISO31000? (based on 890 responses)

32 Do you think that the associations you are a member of, should officially recommend that their members use ISO31000? By Country (based on 890 responses) All Countries Other Countries Netherlands Canada Italy UAE France USA UK India New Zealand Spain South Africa Australia Finland Brazil 0% 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% Should strongly endorse Should not recommend No Opinion Should recommend My association does not recommend

33 Which of the following definitions of risk best reflects your understanding of the word Risk? Effect of uncertainty on objectives 8 9% ISO Guide 73:009 Combination of the probability of an event and its consequences Combination of the probability of occurrence of harm and the severity of that harm Chance of something happening that will have an impact on objectives Event that would have a negative impact on the organization % ISO Guide 73: % ISO Guide 1:1999 (safety) 30 18% AS/NZ 4360: % COSO ERM:004 Exposure to the chance of injury or loss 69 4% Webster Hazard or chance of loss 3 % Webster Opportunity to make a profit or increase revenue 7 1% Amount of money that the organisation company may lose 1 1% None of the above 33 % (based on 18 responses)

34 Which of the following definitions of risk best reflects your understanding of the word? By Country (based on 18 responses) All Countries Rest of the World New Zealand Australia Canada UAE Finland South Africa UK Brazil France USA Netherlands India Spain Italy % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% ISO 009 COSO ERM:004 ISO 00 AS/NZS 4360:004 ISO Safety Other

35 Which of the following definitions of risk best reflects your understanding of the word? By Department (based on 181 responses) All Departments Other Departments Information Technology Operations Occupational Health & Safety Audit Risk Management % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% Effect of uncertainty on objectives Event that would have a negative impact on the organization Combination of the probability of occurrence of harm and the severity of that harm Combination of the probability of an event and its consequences Chance of something happening that will have an impact on objectives Other Definition

36 Which of the following definitions of risk best reflects your understanding of the word? By Department Audit Health and Safety Operations Risk Management Information Technology (based on 181 responses)

37 Which of the following standards/guidelines are used in your organization? (multiple selections allowed) (based on 1338 responses) BASEL BS ISO 700 PMBOK ISO/IEC ISO Guide 73 Inhouse FERMA COSO ERM AS/NZS 4360 ISO % 4% 11% 1% 17% 13% 16% 18% 13% 36% 40%

38 Usage of ISO by Country (based on 1338 responses) All Countries Italy India USA Spain France UK Netherlands South Africa Brazil UAE Canada Finland Australia New Zealand Yes No 0% 0% 40% 60% 80% 100%

39 Usage of AS/NZS 4360 by Country (based on 1338 responses) All Countries UAE New Zealand Finland Italy Brazil Netherlands Spain France Canada India Australia South Africa UK USA Yes No 0% 0% 40% 60% 80% 100%

40 Usage of COSO ERM by Country (based on 1338 responses) All Countries Italy New Zealand UAE France Netherlands Spain Finland Australia India Brazil Canada UK USA South Africa Yes No 0% 0% 40% 60% 80% 100%

41 Usage of Self Developed by Country (based on 1338 responses) All Countries New Zealand Finland Netherlands UAE Spain France Italy Brazil India Australia Canada South Africa UK USA Yes No 0% 0% 40% 60% 80% 100%

42 Usage of IRM/FERMA/AIRMIC standard by Country (based on 1338 responses) All Countries UAE Italy Finland Brazil New Zealand Netherlands Spain France Canada India South Africa UK Australia USA Yes No 0% 0% 40% 60% 80% 100%

43 Certification ISO of your Organization? (based on 1338 responses) 8% External certification is desireable 18% 43% I have no opinion on the issue External certification is not needed for other reasons 19% External certification is not needed because internal evaluation / audit is sufficient 1% External certification is not needed because external evaluation / audit is sufficient

44 Certification ISO of your Organization? by Country (based on 1338 responses) Spain Brazil India Netherlands UAE Canada South Africa Italy USA Australia All Countries Finland UK New Zealand France External certification is desireable I have no opinion on the issue External certification is not needed for other reasons External certification is not needed because internal evaluation / audit is sufficient External certification is not needed because external evaluation / audit is sufficient 0% 0% 40% 60% 80% 100%

45 ISO is a voluntary risk management guideline. Do you believe that organizations (based on 1338 responses)

46 Your Organization Implementation of ISO (based on 1498 responses) No opinion 0% 4% is going to implement ISO in the future. 33% 3% has no plans to implement ISO has implemented ISO

47 Your Organization Implementation of ISO by Country (based on 1498 responses) Australia New Zealand UAE Canada South Africa Brazil All Countries UK Finland Other Countries Netherlands USA Spain France India Italy 0% 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% has implemented ISO is going to implement ISO in the future. has no plans to implement ISO No opinion

48 Your Organization Implementation of ISO by Organization Size (based on 1498 responses) % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% has implemented ISO is going to implement ISO in the future. has no plans to implement ISO No opinion

49 Your Organization by Department (based on 1498 responses) All Departments Other Departments Risk Management Occupational Health & Safety Operations Information Technology Audit % 10% 0% 30% 40% 0% 60% 70% 80% 90% 100% has implemented ISO is going to implement ISO in the future. has no plans to implement ISO No opinion

50 Your Organization Implementation of ISO 31000, by Department (based on 1498 responses) Audit Information Technology Health and Safety 1% 7% 7% 4% 36% 0% 30% 0% 6% 38% 37% 43% Operations Risk Management 3% 16% 0% 8% 19% 8% 4% 4%

51 Does your organization provide you with risk management training? (based on 1338 responses) I don't know 7% No and has no plans No but is planning to Yes 16% % %

52 If yes, which of the following types of training have you received? (based on 1338 responses)

53 Global ISO survey 011 Results & analysis Call for sponsors If you wish to become a sponsor for the next Global ISO survey please contact Madeleine at Madeleine.leblanc@G31000.org