Risk Management's Architect Admits Flaws: ISO 31000 Co-Author Calls for a Shift to Decision Support

The Architect's Uncomfortable Truth

Grant Purdy, a pivotal figure in the development of modern risk management and co-author of the globally recognized ISO 31000 standard, has issued a stark critique of the field he helped shape. After five decades, Purdy asserts that risk management has largely failed to deliver on its core promise: to help organizations make better decisions under uncertainty. Instead, he observes a pervasive shift towards a compliance-centric model, characterized by unread risk registers, ineffective heat maps, and processes that prioritize documentation over genuine insight. This evolution, he argues, has transformed a potentially valuable tool into a bureaucratic burden that consumes resources without providing meaningful decision support.

The Divergence of Purpose: Compliance vs. Decision Making

Purdy identifies the root of the problem in the divergence between two distinct objectives within risk management. One objective is to satisfy external regulatory and 'best practice' requirements, leading to a focus on generating reports and adhering to prescribed methodologies. The other, and arguably more crucial, objective is to genuinely assist internal stakeholders in discussing and navigating uncertainty when making real-world business decisions. He contends that the former has largely overshadowed the latter, turning risk management into a performative exercise rather than a strategic enabler. This disconnect has resulted in a system that often creates a false sense of security, while the actual risks impacting business outcomes remain unaddressed.

A Call for a Mindset Shift: From Risk Management to Decision Support

Purdy's proposed solution is both straightforward and profound: a fundamental mindset shift from "risk management" to "decision support." He advocates for moving beyond generic risk registers and colorful heat maps, which often serve little practical purpose, towards tools and processes that directly inform specific choices. This means focusing on understanding options, scrutinizing assumptions, building in safety margins, and exploring 'what if' scenarios. For internal audit and assurance professionals, this perspective offers a critical opportunity to challenge existing paradigms, streamline processes, and re-align assurance activities with the goal of enhancing organizational decision-making and fostering genuine resilience, rather than merely checking boxes.

Practical Implications for Assurance Professionals

• Re-evaluate Current Practices: Internal auditors should critically assess whether their organization's risk management framework truly supports decision-making or primarily serves compliance.
• Focus on Actionable Insights: Shift the emphasis from documenting risks to providing insights that directly influence strategic and operational choices.
• Promote Simplicity and Utility: Advocate for risk tools and methodologies that are practical, user-friendly, and directly relevant to business leaders, moving away from overly complex or theoretical approaches.
• Challenge the Status Quo: Embrace Purdy's honesty as an opportunity to initiate conversations about more effective ways to manage uncertainty and add value within the organization.