Communication and Consultation in Risk and Opportunity Management

Introduction

Managing risks and opportunities under ISO 18788:2015 is not a siloed exercise—it requires systematic communication and consultation, both internally and externally. Clause 6.1.3 emphasizes that stakeholders at all levels must be engaged in the risk management process. This is directly aligned with ISO 31000:2018, which identifies communication and consultation as a core principle in risk management.

By ensuring transparency, participation, and alignment, communication and consultation enable organizations to capture diverse perspectives, reduce blind spots, and enhance decision-making in the Security Operations Management System (SOMS).

The Role of Communication and Consultation

Clause 6.1.3 requires organizations to:

  • Communicate and consult with internal stakeholders (Board, managers, supervisors, employees, SOMS Champions) to ensure shared understanding of risks, opportunities, and responsibilities.
  • Engage external stakeholders (clients, regulators, subcontractors, local communities, NGOs, and auditors) to identify expectations, obligations, and emerging risks.
  • Ensure that risk and opportunity management is inclusive, transparent, and iterative, not a one-off activity.

Internal Communication and Consultation

Effective internal processes are essential for building a risk-aware culture. Examples include:

  • Board and Executive Communication - Risk appetite, strategic risks, and governance obligations are cascaded from the top.
  • Divisional and Departmental Briefings - Managers align tactical and operational risks with the broader SOMS.
  • Supervisor and Frontline Engagement - Guards and operators provide feedback on daily risks, incidents, and vulnerabilities.
  • Training and Awareness Programs - Build competence and ensure everyone understands their role in risk management.
  • Feedback Channels - Whistleblower lines, reporting apps, or anonymous feedback mechanisms to capture emerging risks.

This ensures alignment between tone at the top, tone in the middle, and tone at the operational level.

External Communication and Consultation

External engagement ensures that risks and opportunities are understood within the wider context:

  • Clients - Consultation to align on service-level risks, reporting mechanisms, and contractual obligations.
  • Regulators & Authorities - Regular communication on compliance with licensing and legal requirements.
  • Communities & NGOs - Engagement to manage human rights risks, cultural sensitivities, and reputational impacts.
  • Subcontractors & Partners - Ensuring alignment of risk controls across the value chain.
  • Auditors & Certification Bodies - Providing assurance of transparency, compliance, and improvement.

This reflects the stakeholder engagement requirements of ISO 18788 Clause 4.2 (Understanding stakeholder needs and expectations).

Alignment with ISO 31000:2018

ISO 31000:2018 emphasizes that communication and consultation are critical for effective risk management because they:

  • Ensure that relevant stakeholders are involved in defining risk criteria, assessing risks, and evaluating opportunities.
  • Facilitate two-way exchange of information to improve accuracy and legitimacy of risk assessments.
  • Build ownership of risk treatment measures, ensuring accountability at all levels.
  • Strengthen transparency and trust, essential for stakeholder confidence.

The framework in ISO 31000 (Clause 6) specifies that communication and consultation must occur throughout the risk management process, not only at the beginning or end. This aligns perfectly with ISO 18788's emphasis on ongoing dialogue in the SOMS.

Best Practices for Communication and Consultation in Risk Management

  1. Structured Processes - Establish documented communication protocols for internal and external stakeholders.
  2. Inclusive Participation - Ensure representation from all relevant functions (legal, HR, operations, compliance).
  3. Cultural Sensitivity - Adapt consultation methods to community and stakeholder contexts.
  4. Feedback Loops - Ensure that input from stakeholders is acted upon and outcomes are communicated back.
  5. Documentation - Keep evidence of consultations and communications as part of the SOMS for accountability and audits.

Benefits of Clause 6.1.3 Compliance

  • Improved Risk Awareness - Broader perspectives highlight blind spots.
  • Stronger Compliance - Ensures risks tied to legal and regulatory requirements are identified and addressed.
  • Enhanced Human Rights Protection - Communities and stakeholders can raise concerns proactively.
  • Greater Trust - Transparency builds confidence among clients, regulators, and employees.
  • Continual Improvement - Consultation drives feedback, which feeds into SOMS enhancements.

Conclusion

Clause 6.1.3 of ISO 18788 reinforces that risk and opportunity management is a shared responsibility, dependent on structured communication and consultation. By engaging stakeholders internally and externally, organizations ensure that risks are identified comprehensively, managed effectively, and aligned with both operational needs and human rights obligations.

When aligned with ISO 31000:2018, communication and consultation become not only a compliance requirement but also a strategic enabler of resilience, trust, and continual improvement in security operations.