The statement is false. ISO 31000:2018 provides high-level principles and a framework for risk management, emphasizing its integration into an organization's overall governance, strategy, and decision-making. Its focus is fundamentally strategic, not tactical. The standard is intentionally non-prescriptive and does not dictate specific operational processes or tactical actions. Instead, it guides organizations on how to establish a strategic context for managing risk and empowers them to design and implement their own customized, tactical processes that fit their specific objectives and environment.

A. True: This is incorrect because the standard's core purpose is to provide a strategic framework and guiding principles, deliberately avoiding the prescription of specific tactical or process-level details.

1. ISO 31000:2018, Risk management — Guidelines. Introduction, p. v: "This document provides guidelines on managing risk faced by organizations... Applying these guidelines can be customized to any organization and its context." This highlights its non-prescriptive, high-level nature.

2. ISO 31000:2018, Risk management — Guidelines. Clause 4, Principles: The principles, such as being "Integrated" into all organizational activities and "Customized," confirm the standard's strategic and framework-oriented focus rather than a one-size-fits-all tactical approach.

3. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x. While analyzing the 2009 version, this paper establishes the standard's foundational strategic nature, which was enhanced in the 2018 revision. It states, "It is not a 'how-to' book with detailed instructions... it is a high-level standard that sets out what should be achieved" (p. 882).

4. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. https://doi.org/10.1057/rm.2012.9. This analysis emphasizes the standard's "managerial and strategic orientation" and its goal to integrate risk management into "the overall governance, strategy and planning" (p. 274), contrasting it with more procedural or tactical approaches.