National foreword

This British Standard is the UK implementation of ISO 31022:2020.

The UK participation in its preparation was entrusted to Technical Committee RM/1, Risk management.

A list of organizations represented on this committee can be obtained on request to its secretary.

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 June 2020.

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 262, Risk management.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

Organizations operate in a complex environment with a variety of legal risks. Not only are organizations required to comply with the laws of all the countries within which they operate, legal and regulatory requirements can vary between different countries, strengthening the need for organizations to understand and have confidence in their processes. Organizations need to keep pace with legal and regulatory environment changes and review their needs as new activities and operations are developed. Organizations face considerable uncertainty when making decisions and taking actions that can have significant legal consequences. The management of legal risk helps organizations to protect and increase value.

This document provides guidance on activities that support organizations to manage legal risk efficiently and cost effectively to meet the expectations of a wide range of stakeholders. By developing an improved understanding of the external and internal legal context, organizations may be able to develop new opportunities or improve operational performance. However, failure to meet the requirements and expectations of stakeholders can have considerable and immediate negative consequences that could affect an organization’s performance and reputation and might lead to criminal prosecution of top management.

ISO 31000 provides a generic framework for the management of all types of risks, including legal risk. This document is aligned with ISO 31000 and provides more specific guidelines applicable to the management of legal risk. The purpose of this document is to develop an improved understanding of the management of legal risk faced by an organization applying the principles of ISO 31000. These guidelines are intended to help organizations and their top management to:

achieve the strategic outcomes and objectives of the organization;
encourage a more systematic and consistent approach to the management of legal risk, and to identify and analyse a comprehensive range of issues so that legal risks are proactively treated with the appropriate resources and supported by top management and by the right level of expertise;
better understand and assess the extent and consequence of legal issues and risk, and to exercise proper due diligence;
identify, analyse and evaluate legal risks, and to provide a systematic way to make informed decisions;
enhance and encourage the identification of opportunities for continual improvement.

It should be noted that legal risk within this document is broadly defined and is not limited to, for example, risk related to compliance or contractual matters. It includes these, but legal risk is deliberately defined to also include risks from or to third parties where there is not necessarily a contractual relationship with such third parties but where there is a possibility of litigation or other action depending on the third parties’ contractual obligations with their stakeholders.

This document:

provides guidance for the management of legal risk so it aligns with compliance activities and provides the assurance needed to meet the obligations and objectives of the organization;
can be used by organizations of all types and sizes to deliver a more structured and consistent approach to the management of legal risk for the benefit of the organization and its stakeholders across all processes;
offers an integrated management approach to the identification, anticipation and management of legal risk;
supports and complements existing approaches, enhancing them by providing better information and insight on potential issues that the organization could face;
supports any process of compliance that organizations could have in place, such as a compliance or other management system;
supports the compliance function by more broadly identifying the organization’s legal and contract rights and obligations.

It is intended that organizations using this document will benefit from improved commercial and operational results, such as an enhanced reputation, better staff retention, improved stakeholder relationships and greater synergies between resources and capabilities.

While this document is intended for use as part of the ISO 31000 framework, it should be noted that the ISO 31000 framework may be used either on a standalone basis or with other management systems.

This document is not intended to:

be a substitute for risk owners seeking expert legal advice (external or internal);
apply to the process of law making or lobbying for new laws or changes to existing laws.

All references to the word “include” and “including” in this document should be interpreted as meaning the wording “including, without limitation”.

1 Scope

This document gives guidelines for managing the specific challenges of legal risk faced by organizations, as a complementary document to ISO 31000. The application of these guidelines can be customized to any organization and its context.

This document provides a common approach to the management of legal risk and is not industry or sector specific.

2 Normative references

3 Terms and definitions

4 Principles

5 Legal risk management process

5.1 General

5.2 Establishing the relevant context and criteria

5.3 Assessment of legal risk

5.4 Treatment of legal risk

5.5 Communication (internal and external), consultation and reporting mechanisms for the management of legal risk

6 Implementation of the management of legal risk

6.1 General

6.2 Policy for the management of legal risk

6.3 Roles and functions for the management of legal risk

6.4 Integrating the management of legal risk

6.5 Resource allocation for the management of legal risk

6.6 Awareness of legal risk

Bibliography

BS ISO 31022:2020

Risk management. Guidelines for the management of legal risk

Current, Under Review

Published:

30 Jun 2020