Which risk assessment methodology offers a generic framework for risk management and is widely applicable across industries?

• A. COBIT is a governance framework.
• B. NIST SP 800-30 provides a structured process for identifying threats, vulnerabilities, and impacts.
• C. ITIL is a service management framework.
• D. ISO 31000 provides principles and a generic framework for risk management.

Answer: (D)

ISO 31000 provides principles and a generic framework for risk management that can be applied across industries and any type of risk. It emphasizes integrating risk management into governance and decision-making, using a flexible, principles-based approach rather than prescribing a single method. The framework guides organizations through establishing context, conducting risk assessment (identifying, analyzing, evaluating risks), selecting and applying risk treatments, and then monitoring, reviewing, and continually improving the program. Because it’s not tied to a specific domain, it can be adapted to different regulatory environments, business models, and risk appetites, which is why it’s widely applicable across sectors. Other options focus on particular domains or practices: COBIT centers on IT governance, NIST SP 800-30 provides a structured risk assessment process for information systems, and ITIL concentrates on service management.