Enterprise risk management · ISO 31000
A risk framework your board can use.
ISO 31000 risk frameworks, risk registers and facilitated workshops for Malaysian companies — designed so risk reporting reaches the board and changes decisions.
- Enterprise and operational risk frameworks (ISO 31000)
- Risk register design, facilitation and assurance review
- Facilitated risk workshops and risk maturity assessment
- Compliance reviews and obligations registers
Senior, certified GRC team · Think Risk International Sdn Bhd, Kuala Lumpur · part of the Think Risk group
Thank you — your enquiry is in.
Our team will reply to you personally. A confirmation is on its way to your inbox.
- ISO 9001
- ISO 14001
- ISO 45001
- ISO/IEC 27001
- ISO 31000
- ISO 37001
- ISO 22301
- COSO
- IIA IPPF
- Section 17A MACC Act
- ISPS Code
What you get
Risk & Compliance Management
- ISO 31000
- Enterprise and operational risk frameworks (ISO 31000)
- Risk register design, facilitation and assurance review
- Facilitated risk workshops and risk maturity assessment
- Compliance reviews and obligations registers
- Policy, delegation and governance framework development
- Psychosocial risk assessment and control review
How it runs
Five steps, every time.
- 1
Scope & plan
Objective, scope, criteria and reporting line agreed; workplan mapped to your risks.
- 2
Evidence
Document review, data interrogation, walkthroughs and interviews where the work is done.
- 3
Analyse
Findings rated on a defensible risk basis, root cause separated from symptom.
- 4
Report
Decision-ready findings, business impact and a corrective action plan with owners and dates.
- 5
Embed
Capability transfer so your team sustains it; actions and KPIs handed over in StrategyX.
FAQ
Before you ask.
What is ISO 31000?
ISO 31000 is the international guideline for managing risk. It is not a certifiable standard: it describes the principles, framework and process for identifying, analysing, evaluating and treating risk, which we tailor to your organisation's size and risk profile.
Do listed companies in Malaysia need a risk management framework?
Bursa Malaysia's Listing Requirements require the board of a listed issuer to include a statement on the state of its risk management and internal control in the annual report, and the Malaysian Code on Corporate Governance expects an effective framework behind it. Private companies use the same approach to meet lender, customer and tender expectations.
Can you facilitate risk workshops with our business units?
Yes. We run facilitated risk workshops with business units and management, maintain or review the risk register, and prepare reporting for the risk committee and board.
What does an engagement cost?
It depends on the model. Projects such as a gap assessment or a single internal audit are quoted at a fixed fee for a fixed scope. Retained and co-sourced internal audit is billed as a retainer or per audit cycle, and investigations at a day rate. Tell us what you need and we will send a written proposal.
Ready when you are.
One short form. A personal reply from our team — no obligation.
Book a consultation