ISO 31000

ISO 31000 provides guidance on managing risk faced by organisations of any size, sector or maturity. It was first published in 2009 and revised in 2018. Unlike a management system standard, it contains recommendations rather than auditable requirements, and ISO states that it is not intended for certification purposes.

What it covers

• Principles. Eight principles describing what effective risk management looks like, including being integrated, structured, customised, inclusive and based on the best available information.
• Framework. Leadership and commitment, integration, design, implementation, evaluation and improvement of risk management across the organisation.
• Process. Scope and context, risk identification, analysis, evaluation and treatment, supported by continual communication, consultation, monitoring, review and recording.

Who uses it

Boards and executives use ISO 31000 to set risk appetite and governance expectations. Risk, compliance, finance, project and operations teams use it to bring a common vocabulary to risk discussions. It is frequently used alongside certifiable management system standards, because those standards require risk-based thinking but do not prescribe how to do it.

How to apply it

1. Agree the scope, context and criteria for risk in your organisation.
2. Map ISO 31000 principles onto the governance and decision-making you already have, rather than building a parallel process.
3. Establish a single risk register and a consistent method for analysing and evaluating risk.
4. Define treatment options, owners and review points, and record the rationale for each decision.
5. Review effectiveness periodically and feed the outcome back into strategy and objectives.

Related standards

ISO 31000 is commonly applied together with ISO 9001, ISO 27001, ISO 45001 and ISO 22301, all of which are certifiable and all of which expect a risk-based approach. IEC 31010 provides risk assessment techniques that support ISO 31000.