Audit & Certification
TÜV AUSTRIA Websites > EN-TRUSTIT > Solution > Industry > Risk Management Certification for Organizations and Systems \| ONR 49001 Solution: Risk Management Certification for Organizations and Systems \| ONR 49001 Audit & Certification Solution: Risk Management Certification for Organizations and Systems \| ONR 49001 Ing. Klaus Mlekus, MBA Ing. Klaus Mlekus, MBA TÜV AUSTRIA-Platz 1 2345 Brunn am Gebirge Österreich +43 5 0454 6067 Send email TÜV AUSTRIA-Platz 1 2345 Brunn am Gebirge Österreich Save to My Bundle Ing. Klaus Mlekus, MBA Save to My Bundle TÜV AUSTRIA CERT GMBH TÜV AUSTRIA-Platz 1 2345 Brunn am Gebirge Tel: +43 (0)504 54-6048 Fax: +43 (0)504 54-8145 E-Mail: cert@tuv.at tuv.at/cert Save to My Bundle Save to My Bundle TÜV AUSTRIA CERT GMBH TÜV AUSTRIA-Platz 1 2345 Brunn am Gebirge Tel: +43 (0)504 54-6048 Fax: +43 (0)504 54-8145 E-Mail: cert@tuv.at tuv.at/cert TÜV AUSTRIA Risk Management Certification ONR 49001 In which region do you need this solution? All regions Certification Procedure 1. Briefing 2. Commissioning 3. Pre-audit (optional) 4. Level 1 certification audit 5. Level 2 certification audit 6, TÜV AUSTRIA certificate 7. Surveillance audits 8. Re-certification audit Accreditation Managementzertifizierungsstelle nach ISO 17021 Managementzertifizierungsstelle nach ISO 17021 All accreditations "TÜV AUSTRIA certifies risk management systems according to the internationally recognized and established standard ONR49001." Information, Target Group, Requirements The efficacy of a practiced risk management system is often of vital, even existential importance for organizations. This calls for a system that ensures the necessary transparency and reproducibility. Risk management constitutes this system and is a cyclic process to identify, assess and control corporate risks. The ÖNORM ONR 49001 accomplishes and describes an internationally recognized management system standard that defines the elements of a risk management system understandably and verifiably, and at the same time can be used as a basis for certifications. ONR 49001 essentially corresponds to the intent and content of ISO 31000, but its aim and actual contents go beyond this. The elements of the risk management system are shown more differentiated so as to ensure an objective verifiability. From medium-sized enterprises through to major industrial enterprises, from service providers to producers – across all sectors and irrespective of the type of company, you too can be certified pursuant to ONR 49001. Every company that wishes to implement an in-depth risk management system in excess of the risk-based approach of management system standards and demonstrate this on the market too through a certification, would do well to decide on a certification pursuant to ONR 49001. A documented risk management system that is integrated in and lived by the organization is required. Your certificate is valid for three years and may be used for advertising purposes in accordance with the certification regulations. Take a look at a sample certificate! You are free to use the certification logo on your business stationery, website (in each case in connection with your organization), for example. Your planned use has to be approved/confirmed by the certification body for legal reasons. Advantages Through a certification, your company demonstrates that it is both aware of and manages corporate risks as well as risks in processes accordingly. Apart from risks that are familiar in the realization of services and products, it also identifies and controls risks in the context of the organization. This should ensure a continuous and consistent rendering of services. A functioning risk management system consequently leads to a reduction of costs through a predictive management of measures. It should help supply information and analyses based on evidence, which in turn can be used as a basis for comprehensible decisions on how to handle certain risks and how to choose between the available options. The main benefits include: Understanding a risk as well as its possible consequences for goals and targets Providing information for decision-makers Contributing to an understanding of the risk, thus making it easier to make a correct choice between alternative actions Determining the most important contributors to risks and weak spots in systems and organizations Comparing risks with those in alternative systems, technologies or procedures Identifying and reporting risks and uncertainties Helping establish priorities Determining the root cause of incidents and helping to avoid new incidents Selecting various ways to handle the risk Satisfying official requirements Supplying information that can be used as a basis for assessing the tenability of risks according to given criteria Assessing the risks for the end-of-life disposal Thanks to a certified system according to ISO standards (e.g. 9001 or 14001), the interaction between processes is already documented and key processes in planning, reporting and the management of measures are designed, which is why experience has shown that establishing a risk management system pursuant to ONR 49001 can be realized very efficiently with manageable extra effort. Existing processes can be integrated in the risk assessment, thus allowing the exploitation of synergies between risk management and management systems according to common standards. The risk management system can be established along the PDCA cycle, thus greatly simplifying a bottom-up assessment of the process risks and allowing the ideal consideration of different process orientations with respect to quality, the environment or industrial safety. Find the right balance – with experts from TÜV AUSTRIA. Documentation for the sake of documentation? A risk management system can only work effectively if it serves the company. Our auditors create the greatest possible benefits from auditing and certification for you. Certification Procedure We will determine the actual duration, effort as well as the costs together with you before the start of the certification. This is why every certification process begins with a briefing. 1. Briefing We will explain the procedure to obtain your certificate in a non-binding and free meeting. Amongst those items that will be clarified in this meeting are: Basis requirements for your certification Goals and benefits of the certification Comparison of the business data and definition of the scope of the certification Discussion of your specific needs and wishes Determination of the next steps that are needed for the certification You will then receive an individual offer that is tailored to your organization on the basis of this briefing. 2. Commissioning If our offer meets with your approval, the certification body is commissioned. Once you have received confirmation of your order, the certification process begins with a joint agreement of the timetable with the responsible auditor(s). 3. Pre-audit (optional) A pre-audit can be carried out on request. However, this is not an essential requirement for certification. Either specific areas and/or processes or the overall situation in your organization will be audited on the basis of a jointly defined framework. Any weak spots in the documentation and implementation of the system will be identified here. A pre-audit can provide you with a status report regarding the basic suitability for certification, a detailed expertise on individual processes or the conformity with individual requirements of the respective standard on request. The audit method hereby corresponds to that of the certification audit. 4. Level 1 certification audit The level 1 audit serves to determine whether you are suitable for certification. Location-specific conditions are assessed and any necessary information with respect to the scope is collected. The level 1 audit primarily deals with the following main points: Verification of the documentation for conformity and completeness compared to the requirements of the standard. Status of the implementation of the management system within the company: Does the existing management and the level of implementation of the management system in the organization allow a certification in principle, or are any crucial details missing? Before the level 2 audit is performed, an audit plan for the actual certification audit will be drafted on the basis of knowledge gained of your organization and the management system and jointly agreed upon with you. 5. Level 2 certification audit During the level 2 audit, the efficacy of the management system in place in your company will be verified. Random checks will hereby be made with respect to all of the requirements in departments and organizational units as well as along the process chain. This audit is based on: The audit plan The respective certification standard and/or the individual standard requirements specified therein Organization-specific documents General and industry-specific principles (laws, additional, industry-specific, necessary standards,..) Following an analysis and assessment of the results, you will already be informed of the outcome of the audit and any deficiencies or deviations during the final review. Corrective measures will be specified in the event of deficiencies. Subsequently, a root cause analysis and a respective documented measure will once again be verified by the audit team. 6. TÜV AUSTRIA certificate The actual certification will be issued by the certification body of TÜV AUSTRIA following a successful audit and reporting on the basis of the audit report. Provided the following certification requirements have been satisfied, there is no reason why the certificate should not be issued promptly: Documentation and implementation of the management system Certification agreement (confirmation of the certification offer, the certification regulations and the T&Cs) Positive outcome of the audit and thus a corresponding recommendation by your audit team to the certification body A certificate will be issued for a period of 3 years. In order to maintain the validity of the certificate over its entire term, an annual surveillance audit has to be performed with a positive outcome (12 months and 24 months after the certificate has been issued). 7. Surveillance audits The annual surveillance audit verifies the efficacy and further development of the management system through random sampling. Surveillance audits are shorter than a normal audit and cover the deficiencies discovered in the last audit along with various key points of the requirements in the standard. 8. Re-certification audit This has to be carried out before the certificate becomes invalid (usually after three years). In a re-certification audit (often also referred to as a repeat audit), all of the requirements are checked at random, the same as for a certification audit. The effort involved for this repeat certification audit is less than that for an initial certification (approx. 2/3 of the time needed for an initial certification audit). Following a positive decision on the certification, a new certificate valid for a further three years will be issued that also has to be confirmed by an annual surveillance audit. More Tags: Audit Auditing Certificate Certification Certification audit Compliance Corporate risks ISO 31000 ISO certificate Legal security Liability risk Management system Management system certification Management system standard ÖNORM Process optimization Risk Risk analysis Risk management Risk minimization Standard Related solutions from the same sector: Trade & Commerce Type testing of boilers for solid fuels according to EN 303-5 Industry Show more Save to my Bundle Support with official procedures Industry Show more Save to my Bundle TÜV AUSTRIA Academy International Course Program 2023 Industry Show more Save to my Bundle Change in the approval condition Industry Show more Save to my Bundle All Solutions Discover more sectors: Agriculture Automotive Certification Communications Technology Construction & Real Estate Electronics Energy Foodstuffs Health & Medicine Industry IT & Security Leisure & Entertainment Machinery Municipalities Science & Research Sports & Fitness Sustainability Tourism Transport & Traffic Klaus Mlekus, +43 5 0454 6067 \| klaus.mlekus@tuv.at
Klaus Mlekus, +43 5 0454 6067 \| klaus.mlekus@tuv.at

TÜV AUSTRIA Websites > EN-TRUSTIT > Solution > Industry > Risk Management Certification for Organizations and Systems | ONR 49001

Solution: Risk Management Certification for Organizations and Systems | ONR 49001

Audit & Certification

Ing. Klaus Mlekus, MBA

TÜV AUSTRIA-Platz 1 2345 Brunn am Gebirge Österreich

+43 5 0454 6067

Send email

TÜV AUSTRIA CERT GMBH

TÜV AUSTRIA-Platz 1
2345 Brunn am Gebirge
Tel: +43 (0)504 54-6048
Fax: +43 (0)504 54-8145
E-Mail: cert@tuv.at
tuv.at/cert

TÜV AUSTRIA CERT GMBH

TÜV AUSTRIA-Platz 1
2345 Brunn am Gebirge
Tel: +43 (0)504 54-6048
Fax: +43 (0)504 54-8145
E-Mail: cert@tuv.at
tuv.at/cert

TÜV AUSTRIA Risk Management Certification ONR 49001

In which region do you need this solution?

All regions

Certification Procedure

1.
Briefing
2.
Commissioning
3.
Pre-audit (optional)
4.
Level 1 certification audit
5.
Level 2 certification audit
6,
TÜV AUSTRIA certificate
7.
Surveillance audits
8.
Re-certification audit

Accreditation

"TÜV AUSTRIA certifies risk management systems according to the internationally recognized and established standard ONR49001."

Information, Target Group, Requirements

The efficacy of a practiced risk management system is often of vital, even existential importance for organizations. This calls for a system that ensures the necessary transparency and reproducibility. Risk management constitutes this system and is a cyclic process to identify, assess and control corporate risks. The ÖNORM ONR 49001 accomplishes and describes an internationally recognized management system standard that defines the elements of a risk management system understandably and verifiably, and at the same time can be used as a basis for certifications. ONR 49001 essentially corresponds to the intent and content of ISO 31000, but its aim and actual contents go beyond this. The elements of the risk management system are shown more differentiated so as to ensure an objective verifiability.

From medium-sized enterprises through to major industrial enterprises, from service providers to producers – across all sectors and irrespective of the type of company, you too can be certified pursuant to ONR 49001. Every company that wishes to implement an in-depth risk management system in excess of the risk-based approach of management system standards and demonstrate this on the market too through a certification, would do well to decide on a certification pursuant to ONR 49001.

A documented risk management system that is integrated in and lived by the organization is required.

Your certificate is valid for three years and may be used for advertising purposes in accordance with the certification regulations.

Take a look at a sample certificate!

You are free to use the certification logo on your business stationery, website (in each case in connection with your organization), for example. Your planned use has to be approved/confirmed by the certification body for legal reasons.

Advantages

Through a certification, your company demonstrates that it is both aware of and manages corporate risks as well as risks in processes accordingly. Apart from risks that are familiar in the realization of services and products, it also identifies and controls risks in the context of the organization. This should ensure a continuous and consistent rendering of services.
A functioning risk management system consequently leads to a reduction of costs through a predictive management of measures. It should help supply information and analyses based on evidence, which in turn can be used as a basis for comprehensible decisions on how to handle certain risks and how to choose between the available options.

The main benefits include:

Understanding a risk as well as its possible consequences for goals and targets
Providing information for decision-makers
Contributing to an understanding of the risk, thus making it easier to make a correct choice between alternative actions
Determining the most important contributors to risks and weak spots in systems and organizations
Comparing risks with those in alternative systems, technologies or procedures
Identifying and reporting risks and uncertainties
Helping establish priorities
Determining the root cause of incidents and helping to avoid new incidents
Selecting various ways to handle the risk
Satisfying official requirements
Supplying information that can be used as a basis for assessing the tenability of risks according to given criteria
Assessing the risks for the end-of-life disposal

Thanks to a certified system according to ISO standards (e.g. 9001 or 14001), the interaction between processes is already documented and key processes in planning, reporting and the management of measures are designed, which is why experience has shown that establishing a risk management system pursuant to ONR 49001 can be realized very efficiently with manageable extra effort. Existing processes can be integrated in the risk assessment, thus allowing the exploitation of synergies between risk management and management systems according to common standards. The risk management system can be established along the PDCA cycle, thus greatly simplifying a bottom-up assessment of the process risks and allowing the ideal consideration of different process orientations with respect to quality, the environment or industrial safety.

Find the right balance – with experts from TÜV AUSTRIA. Documentation for the sake of documentation? A risk management system can only work effectively if it serves the company. Our auditors create the greatest possible benefits from auditing and certification for you.

Certification Procedure

We will determine the actual duration, effort as well as the costs together with you before the start of the certification. This is why every certification process begins with a briefing.

1. Briefing
We will explain the procedure to obtain your certificate in a non-binding and free meeting. Amongst those items that will be clarified in this meeting are:

Basis requirements for your certification
Goals and benefits of the certification
Comparison of the business data and definition of the scope of the certification
Discussion of your specific needs and wishes
Determination of the next steps that are needed for the certification

You will then receive an individual offer that is tailored to your organization on the basis of this briefing.

2. Commissioning
If our offer meets with your approval, the certification body is commissioned. Once you have received confirmation of your order, the certification process begins with a joint agreement of the timetable with the responsible auditor(s).

3. Pre-audit (optional)
A pre-audit can be carried out on request. However, this is not an essential requirement for certification. Either specific areas and/or processes or the overall situation in your organization will be audited on the basis of a jointly defined framework. Any weak spots in the documentation and implementation of the system will be identified here. A pre-audit can provide you with a status report regarding the basic suitability for certification, a detailed expertise on individual processes or the conformity with individual requirements of the respective standard on request. The audit method hereby corresponds to that of the certification audit.

4. Level 1 certification audit
The level 1 audit serves to determine whether you are suitable for certification. Location-specific conditions are assessed and any necessary information with respect to the scope is collected. The level 1 audit primarily deals with the following main points:

Verification of the documentation for conformity and completeness compared to the requirements of the standard.
Status of the implementation of the management system within the company: Does the existing management and the level of implementation of the management system in the organization allow a certification in principle, or are any crucial details missing?
Before the level 2 audit is performed, an audit plan for the actual certification audit will be drafted on the basis of knowledge gained of your organization and the management system and jointly agreed upon with you.

5. Level 2 certification audit
During the level 2 audit, the efficacy of the management system in place in your company will be verified. Random checks will hereby be made with respect to all of the requirements in departments and organizational units as well as along the process chain.

This audit is based on:

The audit plan
The respective certification standard and/or the individual standard requirements specified therein
Organization-specific documents
General and industry-specific principles (laws, additional, industry-specific, necessary standards,..)
Following an analysis and assessment of the results, you will already be informed of the outcome of the audit and any deficiencies or deviations during the final review. Corrective measures will be specified in the event of deficiencies. Subsequently, a root cause analysis and a respective documented measure will once again be verified by the audit team.

6. TÜV AUSTRIA certificate
The actual certification will be issued by the certification body of TÜV AUSTRIA following a successful audit and reporting on the basis of the audit report. Provided the following certification requirements have been satisfied, there is no reason why the certificate should not be issued promptly:

Documentation and implementation of the management system
Certification agreement (confirmation of the certification offer, the certification regulations and the T&Cs)
Positive outcome of the audit and thus a corresponding recommendation by your audit team to the certification body

A certificate will be issued for a period of 3 years. In order to maintain the validity of the certificate over its entire term, an annual surveillance audit has to be performed with a positive outcome (12 months and 24 months after the certificate has been issued).

7. Surveillance audits
The annual surveillance audit verifies the efficacy and further development of the management system through random sampling. Surveillance audits are shorter than a normal audit and cover the deficiencies discovered in the last audit along with various key points of the requirements in the standard.

8. Re-certification audit
This has to be carried out before the certificate becomes invalid (usually after three years). In a re-certification audit (often also referred to as a repeat audit), all of the requirements are checked at random, the same as for a certification audit. The effort involved for this repeat certification audit is less than that for an initial certification (approx. 2/3 of the time needed for an initial certification audit).
Following a positive decision on the certification, a new certificate valid for a further three years will be issued that also has to be confirmed by an annual surveillance audit.