Organizational context
External context, internal context, and risk criteria — the document ISO 31000 asks for before assessing anything.
Why it comes first
ISO 31000 asks the organization to establish context before assessing risk. The reason is practical: without stating what sector you operate in, what regulation reaches you, and what your organization considers tolerable, any risk score is a number with no ruler. Context is that ruler.
The three sections
External context: sector, applicable regulation, and the macro threats of the environment the organization operates in. Internal context: governance, capabilities, and culture — what the organization can actually execute. Risk criteria: what your organization considers acceptable, and the point past which a risk requires treatment.
It is a single document per organization, editable at any time. It is not filled in once and forgotten — when the sector shifts, when a new regulation lands, it should shift with them.
The AI-generated draft
The platform can generate an editable draft of the context, anchored to the profile you registered — industry, sector, country, and applicable regulations. The text arrives ready to be corrected, not ready to be accepted as-is.
Two limitations are deliberate and worth knowing. Generation does not search the web, and the prompt explicitly forbids inventing dates, named incidents, or statistics. That means the draft is a structural starting point — it organizes the right questions — and not a source of live facts about your market. Usage is billed to your organization's AI quota.