1. Learn
  2. Align
  3. Perform
  4. Review

Align14 min read

Applying ISO 31000 Under Pressure

By J Damien Scott, Trusted Advisor

What a risk management standard actually looks like when the country is on fire. Drawing from seven years of experience in Haiti, this article demonstrates how ISO 31000's framework for managing uncertainty translates into life-or-death operational decisions in one of the world's most complex security environments.

Context first: Haiti's operating environment

The ISO 31000 process begins with defining scope, context, and criteria. In most countries, this is a formality. In Haiti, it is the whole ballgame. Organizations that ran annual or quarterly context reviews never had a chance to catch the 2024 Viv Ansanm coalition offensive. The shift from two rival gang coalitions to a single unified force happened in plain view and still surprised people whose risk documents had not been updated to reflect it.

ISO 31000's external context is not a one-time exercise in Haiti. It is a weekly exercise. Your internal context matters just as much: what is your organization's actual risk appetite, not what the policy document says, but what senior leadership will genuinely support when a field team makes a conservative call and a programme deliverable slips? That internal contradiction is itself a risk, and ISO 31000 asks you to name it.

ISO 31000 is not a checklist. It is not a certification you hang on a wall. It is a framework built on three things — principles, a governance structure, and a risk process — that you are explicitly required to adapt to your own context.

Risk treatment: avoid, reduce, share, accept

Avoid means do not go. In Haiti, that decision is sometimes the only responsible one. When 400 Mawozo controls the road and your intelligence says movement is not viable today, the answer is no. Reduce means invest in the controls that actually change the probability or consequence of an event: route planning, communications redundancy, local relationships, and real ongoing investment. Share or transfer means kidnap and ransom insurance, medevac contracts, and intelligence-sharing within security coordination clusters.

Accept is the honest acknowledgment that some residual risk remains after everything else. You have done everything proportionate and reasonable. You have documented why the remaining risk is acceptable given your mission. You have sign-off. You move. But the critical word is documented. In high-risk environments, acceptance cannot be a shrug or an unspoken assumption. It has to be a deliberate, traceable, signed-off decision.

The dynamic part: because Haiti never stays still

ISO 31000 is iterative by design. The standard builds in monitoring and review as a continuous loop, not an annual box-tick. In Haiti, that loop has to spin fast. The UNICEF kidnapping of July 2025 makes this point with brutal clarity: six staff members were abducted during a mission that had been assessed and authorized. The risk had been evaluated. The decision had been made that it was manageable. The gang economy had shifted in ways that should have triggered a context update.

What ISO 31000 can do is give you a professional architecture that makes your judgment accountable and your decisions explainable to your staff, your leadership, and to the inquiry that will eventually come after an incident, asking what you knew and when you knew it. The standard cannot give you judgment, empathy, or the specific earned knowledge of a place that only comes from actually being there.

GRCISO 31000Risk managementHaitiCrisis operations

Originally published on LinkedIn. Read it there

Field Notes · by email

One email when a new article publishes. Nothing else.

Field notes on converged security from J Damien Scott, Trusted Advisor: the article, its summary, and the phase it belongs to. No digests, no offers, no third party reading over your shoulder.

Email delivery is being set up. The feed carries every article the day it publishes. About Field Notes