Framework overlap

Does ISO/IEC 23894:2023 cover IRM Enterprise Risk Management Framework (Institute of Risk Management)?

You hold ISO/IEC 23894:2023 and have been told to do IRM Enterprise Risk Management Framework (Institute of Risk Management). Here is how much overlaps, control by control.

29% of IRM Enterprise Risk Management Framework (Institute of Risk Management) you already have

ISO/IEC 23894:2023 already covers about 29% of IRM Enterprise Risk Management Framework (Institute of Risk Management), leaving 5 of 7 controls as genuinely new work.

Already covered 0 Likely covered 2 New work 5

No control in ISO/IEC 23894:2023 maps directly to one in IRM Enterprise Risk Management Framework (Institute of Risk Management). Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in ISO/IEC 23894:2023 reaches these. This is the list to scope.

IRM-Architecture-Strategy-Protocols-Appetite-Culture-Board-Audit-Committee-CRO-Three-Lines
IRM RASP - Risk Architecture + Strategy + Protocols + Risk Appetite Statement + Risk Culture + Board + Audit Committee + Chief Risk Officer + Three Lines of Defence + Tone at the T
IRM-Capability-Training-CMIRM-Improvement-Integration-Coord-ISO31000-COSO-FRC-Walker-Basel-APRA
IRM Capability + Risk Training + CMIRM/Diploma Qualifications + Continual Improvement + Integration with Strategy + Coordination ISO 31000 + COSO ERM + UK FRC + Walker Review + Bas
IRM-Project-Programme-ThirdParty-SupplyChain-Resilience-BCP-Crisis-AssuranceMapping-3LoD
IRM Project + Programme Risk + Third Party + Supply Chain Risk + Operational Resilience + BCP + Crisis Management + Assurance Mapping + Three Lines of Defence
IRM-Reporting-KRIs-Performance-HorizonScanning-Dashboard-Heatmap-RiskRegister-EmergingRisk
IRM Risk Reporting + Key Risk Indicators (KRIs) + Performance Measurement + Horizon Scanning + Dashboard + Heat Map + Risk Register + Emerging Risk Identification
IRM-Scope-ARM-Standard-2002-AIRMIC-ALARM-IRM-ISOGuide73-ISO31000-Definitions-Upside-Downside
IRM ERM Framework Scope + A Risk Management Standard (2002) + Co-Authored AIRMIC/ALARM/IRM + ISO Guide 73 Vocabulary + Upside/Downside Risk + CMIRM Qualification
Show the 2 you already have
IRM-Process-Identification-Analysis-Evaluation-Treatment-Monitoring-Review-ISO31000-Aligned
IRM Risk Management Process - 5-Stage Cycle + Identification + Analysis (Inherent/Residual) + Evaluation + Treatment (4Ts Tolerate/Treat/Transfer/Terminate) + Monitoring + Review +
IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside
IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe

How this is calculated

Already covered means a mapping runs from a control in ISO/IEC 23894:2023 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition