COVID-19 and the ISO 31000 definition of risk - auteur Peter Blokland

Communicatie GvRM | Bekeken (97) | TERUG|

The Spanish flu infected 500 million people around the world, or about 27% of the then world population of between 1.8 and 1.9 billion, including people on isolated Pacific islands and in the Arctic. The death toll is estimated to have been anywhere from 17 million to 50 million, and possibly as high as 100 million, making it one of the deadliest epidemics in human history (Source: Wikipedia).

Are we in for the same kind of catastrophe? Today, this would mean over 2 billion infections and a toll of 50 million to 200 million dead! However, in many countries well-equipped healthcare systems are in place with modern technologies to support highly trained medical staffs. This is a strength compared to the situation of a hundred years ago. But, we also live in a much more connected world and this is a huge vulnerability or weakness in preventing the quick dissemination of viruses. It means that our modern healthcare systems can be overwhelmed when insufficient measures are taken to slow down the dissemination of this virus. What this means became clear in Italy and Spain.

In comparison with a hundred years ago, we have better and faster communication channels, more timely information and an evolved understanding of viruses. So, supposedly we have more knowledge and options on how to manage this kind of threat. Still, it seems the western world wasn’t really ready for this event and early signs haven’t been picked up. Suddenly, there was a lack of crucial medical equipment and supplies, hospitals are overloaded, people don’t follow directives, new protocols have to be prepared and decisions need to be made with little or no prior preparation.  

Although a horrible experience, this pandemic is a good opportunity to explain what risk is, how it is defined in the ISO 31000 standard for risk management and why this definition offers (better) insights to deal with these kind of complex occurrences.

ISO 31000 defines risk as an effect of uncertainty on objectives. It also notes that this effect can be positive, negative or both. I have to admit, the first time I read this definition I didn’t understand a bit of it and struggled to understand it’s full range of possibilities. I was educated with the understanding that risk was a probability multiplied by consequences, only looking at loss. Yet, consequences of events can be a loss, a gain or even both at the same time, all depending on one’s perceptions and objectives.

For ISO 31000, everything starts with the concept of objectives. Objectives are those things we want, pursue, need, aim for, … anything that is valuable to us. There’s no certainty that achievements of these “objectives” are guaranteed or safeguarded in the future. Never, as this crisis shows us! Objectives will always undergo ever changing influences of various, expected and unexpected, risk sources, or at least we cannot be 100% sure this won’t happen. Altogether, we can call these uncertain varying effects the “effect of uncertainty”, affecting objectives in a positive and/or negative way. This is what we call risk. Hence, risk is the effect of uncertainty on objectives. Therefore, the aim of risk management is both the creation (more positive effects) and protection (less negative effects) of value. Because objectives differ and can be valued in different ways from one person to another, risks can be perceived differently by different persons.

The worldwide COVID-19 crisis is a very good example to explain the ISO 31000 definition of risk. In the COVID-19 case the main objectives at risk are health and prosperity on a societal level. This catastrophe shows that one event has the ability to affect a multitude of objectives worldwide. This case doesn’t fit very well with a traditional risk management approach that tries to predict and prevent, based on defined probabilities and consequences. Because data concerning the SARS-Cov-2 virus (probabilities and consequences) are not available or highly unreliable. When something happens for which no data is available, when probabilities are highly uncertain and when the gravity of consequences is unknown, statistical methods are just not adequate to support decisions. Only in hindsight, when knowledge and data become available, these kind of methods to assess risks become useful again.

What really counts in complex and uncertain situations/issues are the objectives that matter. They can be affected by the effects of uncertainty, coming from whatever risk source possible. Individual health, the quality of health care systems, the performance of economic systems, all these objectives are connected and should be taken into account in a balanced way. It is the value of the objectives involved and their exposure to risk sources that determines the level of risk. Highly valuable objectives and high uncertainty, with high exposure is high risk. Decisions should then be directed towards the optimisation of the effects of uncertainty on these valuable objectives, to get the best possible outcome.

For the current COVID-19 crisis, one of the most important objectives for society as a whole is the ability of healthcare systems to cope with the flood of patients needing intensive care. This also involves the specialised staff and their protection equipment, the use of respirators and their related consumable items. Focusing on these important sub-objectives immediately gives a direction for decision makers to look at. Searching for risk sources and their possible effects of uncertainty on those objectives (risks). Since we are not sure about the outcome, we have to manage and control these effects to create value, managing the positive side of risk. What do we want/need and what are possible positive effects that increase the capacity of intensive care services and what could positively impact the number of patients needing hospitalisation and intensive care? Again, new objectives will emerge as solutions to these questions arise. For instance: increase the number of intensive care beds in hospitals, get more equipment and consumables, have more trained personnel to increase intensive care capacity. Promote or enforce social distancing to avoid an accelerated propagation of the virus and its disease to prevent capacity overload. These are top priorities to cope with the Covid-19 threat, as China has shown earlier (a country with a huge experience concerning these kind of viruses).

But, also negative risk sources need to be addressed. What could be the negative effects on those objectives? What risk sources can be identified? Shortages of supplies of consumables, healthcare personnel getting ill, other patients using up intensive care capacity after surgery, etc… these are all negative risk sources that need to be addressed as well. Likewise, what will happen when people don’t follow up the advice of social distancing, not following directives of washing hands, staying at home, avoid contact, etc…? Taking measures to pursue objectives, trying to create value and protect value, also means introducing new effects of uncertainty on other objectives. So what will be the impact on mental health and the economy when the aforementioned measures and controls are implemented?

Each time, objectives show how value can be created and what is necessary to protect this created value. It allows to determine stringent and clear criteria that determine how far you can or want to go. That is the real strength of using the ISO 31000 definition of risk. Probabilities only play a role in choosing options once the objectives and criteria are clear. Options then can be assessed using traditional or other risk management methods, to select and decide upon the best possible solutions that maximise the desired effects, while minimising the negative effects on each of these objectives. That is the real benefit of acting according to ISO 31000 and its definition of risk.


Auteur: Peter Blokland MSc

Website: www.byaz.be

Over de auteur


Geen artikelen