Reference document: ISO31000

Release Date: May 2024

 

1. Introduction

The Digital Transformation Office and Knowledge Sources – affiliated with Najran University, is committed to implementing an integrated risk management framework according to ISO 31000:2018 standard and in accordance with national cybersecurity policies and the requirements of the Government Digital Authority and the Ministry of Education. This policy aims to enhance the Office’s ability to predict, analyze, and effectively manage risks, which contributes to protecting resources and assets, ensuring business continuity, and supporting the University's strategic objectives.

2. The Purpose

  • Establish a methodological framework for risk management at all levels.
  • Enable decision-makers to manage risks within the accepted risk framework.
  • Ensuring connectivity between risks and the University's strategic and operational objectives.
  • Business Continuity Support and Integration with the ISO 22301 Business Continuity Management System.

3. Application Scope

This policy applies to:

  • All departments and units affiliated with the Deanship.
  • The technological systems, digital services, infrastructure, data, human resources, and suppliers.
  • Operational processes, projects, and digital initiatives.

4. General Principles

  • Inclusivity: Managing all types of risks (strategic, operational, technical, financial, legal, security).
  • Integration: Linking risks with business continuity plans and digital governance.
  • Engagement: Involving all employees and stakeholders in identifying and assessing risks.
  • Transparency: Documenting all stages of risk management in the approved risk register.
  • Compliance: Complying with national regulations (Royal Orders – Cabinet Decisions – Agency Policies – Ministry of Education Requirements).
  • Continuous Improvement: Reviewing and updating the policy and procedures periodically.

5. Methodology

  1. Risk Identification: Identifying potential risks related to operations and services.
  2. Risk Analysis: Assessing (likelihood x impact) using the approved risk matrix.
  3. Risk Assessment: Identifying the level of risk (Low – Medium – High – Critical).
  4. Risk Treatment: Selecting one of the methods (Avoidance – Reduction – Transfer – Acceptance).
  5. Monitoring and Review: Tracking the status of the risk and the measures taken periodically.
  6. Documentation: Recording data in the risk register, including:
    • Risk Name
    • Reasons
    • Effects
    • Related Objectives
    • Assessment Level Before / After Treatment
    • Responsible Owner
    • Preventive / Therapeutic Measures
    • Status (Implemented – Proposed – Open – Archived)