Risk Consultants near you

The sequence used by most practitioners follows the ISO 31000 pattern, and Public Safety Canada's risk management guide for critical infrastructure sectors, which states that it is adapted from that standard, sets it out in a form that is easy to follow. It starts with communication and consultation, because a risk assessment done to people rather than with them collects polite answers instead of real ones.

Establishing the context comes next: what the organisation actually does, which services and products matter most, and what it depends on to deliver them. Risk identification then builds a register of the threats and hazards that could affect those services, taking an all-hazards view that includes natural hazards, deliberate threats and accidental or technical failures. Risk analysis assesses likelihood and consequence, drawing on expert judgement and structured techniques rather than intuition alone.

Risk evaluation is where judgement becomes policy: risks are prioritised, typically into those that are intolerable, those worth weighing the cost of treatment against the benefit, and those that can reasonably be accepted. Treatment and monitoring follow, with mitigation strategies, implementation plans and exercises that test whether the treatment works. The loop closes through continuous improvement, capturing lessons after incidents. If a consultant's method skips the context stage and starts at a risk workshop, expect a generic register.

ISO 31000 is guidance. It gives principles and a framework for managing risk, and because it is not intended for certification there is no such thing as being certified to it. A consultant offering to certify your organisation against ISO 31000 has misunderstood the standard, or is hoping you have. What you can do is align your practice with it and have that alignment reviewed.

ISO 22301 is different in kind. It sets out requirements for a business continuity management system covering planning, implementation, operation, monitoring, review and improvement, and its requirements are generic and intended to apply to organisations of any type or size. Because it is written as requirements, it can be certified by an accredited certification body. ISO 22313 provides guidance on applying ISO 22301 for organisations that want the discipline without the certificate.

Sector obligations are the third layer, and they apply to far fewer organisations than the marketing around them suggests. OSFI's guidelines are directed at federally regulated financial institutions such as banks, foreign bank branches, insurers and trust and loan companies. If your business is not federally regulated, those guidelines are not rules you must follow, although they are often worth reading as a well-developed statement of practice. Other sectors carry their own regulators and their own expectations, so establish which regime genuinely binds you before buying a programme built for someone else's.

Guideline E-21, Operational Risk Management and Resilience, was published in August 2024. It sets expectations for identifying, assessing, managing and monitoring operational risk, and for operational resilience: the ability to prepare for and recover from severe disruptive events, whether they arise from internal control failures, third-party disruption, infrastructure or technology failures, cyber incidents, pandemics or natural disasters. Its resilience expectations extend to business continuity risk management, crisis management, change management and data risk management. Adherence to the operational risk management expectations was immediate on publication, with the remaining expectations phased in and full implementation expected by 1 September 2026.

Guideline B-10, Third-Party Risk Management, covers the arrangements an institution has with outside parties and applies to all federally regulated financial institutions. It requires a third-party risk management framework, risk assessments proportionate to how critical an arrangement is, both before entering into it and periodically afterwards, written agreements setting out rights and responsibilities, monitoring and incident management, contingency and exit plans for critical arrangements, and attention to technology and cyber risk. The principle underneath it is that an institution keeps accountability for activities it has outsourced.

For everyone else, the useful part of these guidelines is structural rather than legal: the idea that resilience is defined around critical operations, that dependence on a supplier is a risk you still own, and that plans which have never been exercised are assumptions.

Continuity planning starts by asking which activities the organisation cannot be without, and for how long. That business impact analysis drives everything else, because it decides what gets recovered first when resources are short. Without it, continuity plans tend to protect whatever the person writing them understood best.

The plan itself should be specific enough to be usable by someone having a bad day: who decides that the plan is active, who must be contacted, what the fallback arrangements are for premises, systems, data and key suppliers, and what the organisation will tell customers and staff. Crisis management and communication belong in it, because most reputational damage in a disruption comes from the silence rather than the fault.

Then it has to be exercised. Testing is what converts a document into a capability, and it reliably finds the dependencies nobody wrote down: the system only one person can restore, the supplier with no alternative, the contact list that was accurate two reorganisations ago. Exercises also give the people who would have to act a rehearsal before the real thing. A consultant who delivers a continuity plan but never proposes testing it has delivered half the engagement.

Engagements are usually scoped by breadth and depth: how much of the organisation is in scope, how many sites, systems and third parties are involved, whether the work is a one-off assessment or the design of a framework somebody has to run afterwards, and whether continuity plans are to be written and exercised as well as drafted. Work driven by a regulator or a major customer's requirements tends to be tighter in scope because the requirements are written down. A proposal that does not distinguish between assessing risk once and building a capability that outlives the engagement is worth questioning.

On LokalMatch you describe the organisation, what triggered the enquiry, whether any regulator or customer requirement is driving it and whether you need an assessment or an ongoing framework, and risk consultants serving your area contact you directly. LokalMatch does not assess risk, does not certify management systems and does not vet, rank or recommend the consultants who reply; consultants pay for the requests they receive, so approaching several costs you nothing. Ask each of them who will operate the framework once they have gone, and how they propose to test whatever they produce.