What is the purpose of ISO 31000 in organisational decision-making?

ISO 31000 provides principles and guidance for managing risk. Grant Purdy, who was involved in its development, argues that risk management should ultimately support organisational decision-making by helping leaders understand uncertainty, consequences and the practical options available to them.

What does sufficient certainty mean in decision-making?

Sufficient certainty is the level of confidence decision-makers need to exercise judgement and act without expecting complete certainty. Grant Purdy argues that absolute certainty is rarely achievable and that continually seeking it can lead to analysis paralysis, delayed decisions and missed opportunities.

Why should organisations record the assumptions behind important decisions?

Recording assumptions makes the basis of a decision visible and enables organisations to monitor whether those conditions subsequently change. This helps boards and executives identify when a previously sound decision may need to be reviewed rather than simply monitoring whether implementation remains on schedule.

Are risk matrices still useful for risk management?

Risk matrices can be useful as simple prioritisation tools, but Grant Purdy cautions against treating them as precise quantitative decision models. Their value depends on understanding their limitations, including subjective consequence criteria, likelihood assessments and the difficulty of comparing different types of impact.

How can AI improve risk management and decision-making?

AI can support better decisions by broadening the information considered, surfacing hidden assumptions and challenging potential biases. Grant Purdy distinguishes this decision-support role from allowing AI to make consequential decisions, where human judgement and accountability remain important.

What is a decision broker in risk management?

A decision broker is a way of describing a risk professional who helps others make better decisions rather than concentrating primarily on risk registers, matrices and reporting. The role involves facilitating challenge, understanding uncertainty, surfacing assumptions and connecting risk insight to organisational purpose and decisions.

Is this RiskMasters episode with Grant Purdy CPD-accredited?

Yes. This RiskMasters episode is CPD-accredited and provides professional learning on ISO 31000, risk management, decision-making under uncertainty, governance, risk matrices, assumptions and the use of AI in decision support.

CPD EP26 - Risk Management, Uncertainty and Better Decision-Making with Grant Purdy

Julien Haye
1 day ago
8 min read

RiskMasters podcast cover featuring Grant Purdy discussing risk management, uncertainty and better decision-making.

Has Risk Management Lost Sight of the Decision?

“Better decisions begin when you understand your organisation's purpose.” – Grant Purdy

Risk management has changed considerably over the past three decades. Frameworks have become more sophisticated, reporting more comprehensive and governance more formalised. Risk registers, appetite statements, matrices and dashboards are now familiar features of organisational life.

But has all that sophistication actually helped organisations make better decisions?

That question sits at the heart of my conversation with Grant Purdy, who has spent almost five decades working in risk and decision-making. Grant was a nominated expert involved in the development of ISO 31000, contributed to ISO Guide 73 and helped shape ISO/IEC 31010. Few people have had such a close view of how modern risk management has evolved.

What makes the conversation particularly interesting is that Grant is willing to challenge some of the practices that the profession has built along the way.

His argument is not that organisations should abandon risk management. It is that we need to remember why we are doing it in the first place.

Risk Management Was Never the Destination

Grant takes us back to the origins of ISO 31000 and its predecessor, the Australian and New Zealand standard AS/NZS 4360. The original purpose was relatively straightforward: create useful information about what could happen, what the consequences might be, how likely those effects were and what could practically be done about them.

That information could then support a decision.

Over time, however, risk management developed its own processes, language, governance structures and reporting cycles. In many organisations, it became something that happened alongside decision-making rather than within the decisions themselves.

This distinction matters.

A board can receive an excellent risk report and still make a poor strategic decision. An organisation can maintain a comprehensive risk register without recognising the assumptions underpinning a major investment. A risk appetite statement can satisfy governance expectations while remaining disconnected from the choices leaders make about strategy and resources.

Grant's challenge to the profession is therefore uncomfortable but useful: if risk management does not improve decision-making, what purpose is it serving?

Better Decisions Do Not Require Certainty

The conversation becomes particularly interesting when we move from risk management into uncertainty.

Organisations often respond to uncertainty by seeking more information. Another analysis is commissioned. Another report is requested. Another meeting takes place before the decision can finally be made.

Sometimes that is necessary. Sometimes it is simply the search for certainty in an environment where certainty cannot exist.

Grant describes decision-making as a process of resolving uncertainty until decision-makers have sufficient certainty to exercise judgement. That is fundamentally different from trying to eliminate uncertainty.

The distinction is increasingly important. Geopolitical instability, technological change, climate pressures and interconnected supply chains mean that many important decisions must be made while conditions are still evolving. Waiting for complete information can therefore create its own exposure. Opportunities disappear, problems deteriorate and decisions that could have been taken become decisions that circumstances eventually make for us.

The objective is not to know everything before acting.

It is to understand enough to make a considered decision, while remaining alert to what could invalidate it.

The Assumptions We Rarely Write Down

This leads to one of the most practical insights from our conversation.

Every significant decision rests on assumptions.

We make assumptions about markets, customers, technology, organisational capability, economic conditions, competitors and how people will behave. We also make assumptions about whether the decision itself will produce the outcome we expect.

Yet Grant observes that boards and executive teams rarely record those assumptions explicitly.

That creates an important weakness in governance.

Imagine approving a major investment because several conditions are believed to be true. Six months later, one of those conditions changes materially. If the original assumption was never made explicit, the organisation may continue implementing the decision without recognising that its underlying rationale has changed.

This is where Grant's approach to decision-making becomes particularly practical. He argues for clarity around the organisation's purpose, the opportunity being considered, the outcomes being sought and the assumptions on which the decision rests. Monitoring should then be designed as part of the decision itself, rather than added afterwards.

That changes monitoring from simply asking, Are we implementing what we approved?

It also asks, Are the conditions that made this a good decision still true?

For boards and executives, that is a much more powerful form of governance.

When Risk Tools Create More Confidence Than Insight

Grant is equally challenging about one of the most recognisable tools in risk management: the risk matrix.

His perspective is particularly interesting because he used matrices himself decades ago. Their original purpose was simple. They helped practitioners prioritise different hazards and determine which required attention.

The problem, in his view, is what happened next.

A simple prioritisation device gradually became something organisations began treating as a form of quantitative analysis. Colours acquired meaning. Positions on matrices were compared. Risks were shown moving from red to amber or green. Increasingly sophisticated governance processes were built around what remained a relatively crude assessment technique.

Grant identifies several problems with this, including inconsistent consequence criteria, the treatment of probability and frequency, and the mathematical assumptions implied when organisations manipulate essentially subjective scales.

The broader lesson goes beyond the risk matrix.

Risk tools can be useful without being precise. Problems emerge when the apparent sophistication of the tool creates greater confidence than the underlying information warrants.

The question should therefore not be whether an organisation has a risk matrix, appetite statement or risk register. It should be whether those tools genuinely help leaders understand uncertainty and make better choices.

Governance Should Tell Us Something About Decision Quality

That same challenge extends to governance and regulation.

Grant argues that organisations and regulators can become overly focused on evidence that governance processes exist: frameworks, registers, appetite statements, surveys and reports.

These artefacts have a legitimate role. But their presence does not necessarily tell us whether an organisation is governed well.

Governance ultimately manifests itself through decisions.

Were the organisation's objectives clear? Was the opportunity properly understood? Were alternative outcomes considered? Were assumptions surfaced and challenged? Was uncertainty understood? Did people have the ability to challenge a powerful advocate for the decision? And, once the decision was made, did the organisation monitor whether its assumptions remained valid?

Those questions are harder to evidence than the existence of a framework.

They are also much closer to explaining why apparently well-governed organisations sometimes make extraordinarily poor decisions.

AI Could Make This Better, or Simply Automate the Problem

Our discussion eventually turns to artificial intelligence.

Grant sees considerable potential here. AI can help decision-makers examine a broader context, surface assumptions they have overlooked and challenge biases in their reasoning. Used in this way, it can perform some of the role of an impartial facilitator, prompting people to consider questions they might otherwise miss.

That could materially improve decision-making.

But there is another possibility.

We could use AI to automate the existing machinery of risk management: generating risk registers, producing matrices, categorising risks and creating reports more quickly.

That may improve efficiency without improving the underlying decision.

Grant's concern becomes stronger when AI moves from supporting judgement to making consequential decisions itself.

This creates an important distinction for risk leaders considering AI adoption. The greatest opportunity may not be using AI to remove humans from decision-making. It may be using it to make human judgement more disciplined, transparent and better informed.

From Risk Manager to Decision Broker

Towards the end of our conversation, I ask Grant what advice he would give to the next generation of risk professionals.

His answer is deliberately provocative.

Do not become trapped in a professional niche defined by risk registers, matrices and specialist software.

Instead, develop the capabilities to help people make better decisions.

Grant refers to a term he recently heard at a conference: decision broker.

I think there is something powerful in that description.

A decision broker does not make the decision for management. Nor do they simply produce information and hand it over.

They help create the conditions for a better decision. They clarify purpose, surface assumptions, introduce challenge, explore uncertainty and help decision-makers understand what would need to change for the decision itself to be reconsidered.

That is a very different conception of the role of a risk professional.

And perhaps it brings the profession back to where Grant believes it should have been all along.

Final Reflection

Risk management has accumulated considerable infrastructure over the past three decades.

Much of it serves an important purpose.

But frameworks, registers, matrices and appetite statements are means, not outcomes. Their value ultimately depends on whether they help organisations make better decisions.

Grant's challenge is therefore not to dismantle risk management. It is to reconnect it with its purpose.

In a world where uncertainty cannot be eliminated, organisations do not need the appearance of certainty.

They need the ability to understand uncertainty, challenge their assumptions, make considered decisions and recognise when changing conditions mean those decisions need to change.

Perhaps that is also a useful test for every risk function:

Are we managing risk, or are we helping the organisation make better decisions?

WATCH THE FULL EPISODE:

[VIDEO EMBED]

More about the interview with Grant Purdy

In this episode of RiskMasters, I speak with Grant Purdy about risk management, uncertainty and the relationship between risk and better decision-making.

Grant has spent almost five decades working in risk and decision-making. He was a nominated expert involved in the development of ISO 31000, contributed to ISO Guide 73 and helped shape ISO/IEC 31010.

He is also co-author, with the late Roger Estall, of Deciding, a practical guide designed to help people make better decisions.

Our conversation examines how risk management has evolved, why Grant believes parts of the profession have become disconnected from decision-making, and what boards, executives and risk professionals can do differently.

🎯 What You Will Learn

Why risk management should ultimately improve decision-making
How to make decisions without waiting for impossible certainty
Why identifying and monitoring assumptions strengthens governance
Where risk matrices and risk appetite can create false confidence
How AI can support judgement without replacing accountability

🕒 Episode Highlights

01:23 - What ISO 31000 was originally trying to achieve

Grant traces the development of ISO 31000 from AS/NZS 4360 and explains why creating useful information for decision-making was central to the original approach.

06:03 - Where risk management lost its way

We discuss the different philosophies that emerged around risk management and why Grant believes the profession needs to reconnect risk with decision support.

10:29 - Uncertainty, assumptions and sufficient certainty

Grant explains why decisions require clarity about purpose, opportunity, desired outcomes and the assumptions on which they depend.

16:08 - The danger of seeking certainty

Why waiting for complete information can produce analysis paralysis, missed opportunities and delayed action.

21:10 - What risk matrices can and cannot tell us

Grant explains why a useful prioritisation tool can become misleading when organisations treat it as a form of quantitative analysis.

24:20 - Governance, regulation and decision-making

A provocative discussion about the relationship between standards, regulation and consultancy, and why governance should ultimately be concerned with how decisions are made.

32:49 - Why well-governed organisations still make poor decisions

We explore unclear purpose, hidden assumptions, predetermined outcomes, insufficient challenge and weak monitoring.

36:49 - AI and the future of decision support

Grant considers how AI can broaden context, challenge bias and surface assumptions, alongside the dangers of allowing technology to substitute for human judgement.

41:01 - The future of the risk profession

Why Grant believes risk professionals should broaden their capabilities and become facilitators of better organisational decisions.

44:02 - Better decisions begin with purpose

Grant closes with the principle at the heart of his approach to decision-making.

💡 Key Insight

“Certainty is a total illusion. It can never be achieved. Sufficient certainty is as good as we can get.” – Grant Purdy

🎧 Listen now on:

Apple Podcasts: [ADD LINK]
Spotify: [ADD LINK]
Other platforms available

👤 About Grant Purdy

Grant Purdy has almost five decades of experience working in risk management and decision-making. He chaired the Standards Australia and Standards New Zealand risk management committee for ten years and was a nominated expert involved in developing ISO 31000.

Together with Roger Estall, Grant wrote Deciding, which draws on their experience to provide a practical, jargon-free approach to making better and more durable decisions.