Risk management that creates and protects value
What ISO 31000 is
ISO 31000 is the international standard that gives organisations guidelines for managing risk. It is not tied to any industry, size or type of risk, so it works for strategy, operations, projects, finance, safety, information and more. The current edition, ISO 31000:2018, centres on creating and protecting value and is built from three parts: principles, a framework and a process.
What the standard contains
- Principles (8): the qualities that make risk management effective, such as being integrated, structured, customised, inclusive, dynamic, based on the best available information, considerate of human and cultural factors, and continually improved.
- Framework: how leadership, integration, design, implementation, evaluation and improvement fit risk management into governance and daily work.
- Process: the repeatable cycle of communication and consultation, scope, context and criteria, risk assessment, risk treatment, monitoring and review, and recording and reporting.
Organisations cannot be certified to ISO 31000. See “Assessment and certification options” below for the routes that do exist: maturity assessments, internal audits, independent reviews and personal qualifications.
What changed in 2018 compared with 2009
- Fewer, clearer principles, and a stronger focus on value creation.
- More emphasis on leadership by top management and on integration into governance.
- Greater emphasis on an iterative, continually improving process.
Key terms in plain language
- 01Risk
- The effect of uncertainty on objectives, which can be positive, negative or both
- 02Risk source
- Anything that can give rise to risk
- 03Risk appetite
- The amount and type of risk an organisation is willing to pursue or accept
- 04Risk owner
- The person accountable for managing a specific risk
- 05Risk register
- The record of identified risks, their ratings, owners and treatments
- 06Risk treatment
- The action taken to change a risk: avoid, reduce, share, accept or take it for an opportunity
- 07Residual risk
- The risk that remains after treatment
Risk management as part of how decisions are made
ISO 31000 makes risk management part of how decisions are made, not a separate report.
Better decisions
Risk information is available when strategy, budgets and projects are decided.
Protects and creates value
Threats are managed and opportunities are spotted and pursued deliberately.
Stronger governance
Clear accountability, risk appetite and reporting lines from board to team.
Fewer surprises and losses
Early identification and monitoring reduce incidents, disruption and cost.
Consistent language and method
One common approach to rating and reporting risk across departments.
Stakeholder confidence
Investors, clients, partners and regulators see a structured, defensible approach.
Efficient use of resources
Effort and budget go to the risks that matter most.
Works with other systems
Aligns with ISO 27001, ISO 27701, ISO 22301, ISO 9001 and similar management systems.
Continual improvement
Monitoring, review and lessons learned keep the approach current.
Any organisation with objectives and uncertainty
Whatever its size, sector or maturity, an organisation that has objectives and faces uncertainty can use ISO 31000.
One method every team can follow
From the boardroom to the project office, ISO 31000 gives people a shared way to talk about, rate and act on risk, and it scales down to small and medium businesses: start simple and build up.
| Audience | Why it fits |
|---|---|
| Boards and executive teams | Need risk information for strategy, investment and risk appetite decisions |
| Risk, compliance and internal audit teams | Need a common framework, method and reporting structure |
| Project and programme offices | Need a consistent way to rate and manage project risk |
| Banks, insurers and fintech | High exposure to credit, market, operational and conduct risk |
| Energy, construction and manufacturing | Safety, supply chain and operational continuity risks |
| Healthcare and life sciences | Patient safety, quality and regulatory risks |
| Government and public sector | Service delivery, public trust and accountability |
| Technology and cloud providers | Cyber, privacy, third-party and service availability risks |
| Small and medium businesses | Scalable approach; start simple and build up |
Do these sound familiar?
- 1Do your departments rate risk differently?
- 2Does leadership see risk reports before major decisions?
- 3Are risks tracked with owners and deadlines?
Two or more “no” answers mean a risk maturity assessment is a sensible next step.
Book a free risk maturity assessmentFrom mandate to continual improvement in eleven stages
A first working framework typically takes 3 to 6 months (approximate; depends on size and existing practice). Risk management then runs continually.
A repeatable cycle, not a one-off project
Stages 5 to 7 form the core risk process, and they repeat as the context changes and new information arrives. Communication and monitoring run alongside every stage.
-
01 Leadership commitment and mandate Top management approves a risk management policy, sets the purpose and objectives, and commits resources.
-
02 Context and scope Understand the organisation’s objectives, internal and external context, stakeholders and the boundaries of the programme.
-
03 Framework design Define how risk management integrates with governance, strategy, planning and reporting; set accountabilities and risk appetite.
-
04 Risk criteria and method Agree scales for likelihood and consequence, a risk matrix, rating rules and the thresholds for treatment and escalation.
-
05 Risk identification Run workshops and reviews to find risks, sources, events and their causes and consequences; record them in a risk register.
-
06 Risk analysis and evaluation Rate each risk, compare it with the criteria and appetite, and decide which need treatment and in what order.
-
07 Risk treatment Choose and plan actions (avoid, reduce, share, accept, or pursue for opportunity), assign owners and deadlines, and record residual risk.
-
08 Integration into decisions Build risk review into budgeting, project approval, procurement, change management and performance management.
-
09 Communication, consultation and training Keep stakeholders informed throughout and train staff and managers in the method.
-
10 Monitoring, review and reporting Track risk indicators and treatment progress; report to management and the board on a fixed rhythm.
-
11 Evaluate and improve Periodically check how well the framework fits the organisation, assess maturity and update it.
How ISO 31000 works with other standards
ISO 31000 supports compliance and other management systems but does not replace them. The mapping below is indicative.
| Standard or requirement | Relationship to ISO 31000 |
|---|---|
| ISO 31073 | Risk management vocabulary; use it for consistent terms across your documents |
| IEC 31010 | Risk assessment techniques (for example, bow-tie, FMEA, scenario analysis) to use inside the assessment step |
| ISO/IEC 27001 | Information security management; its risk assessment and treatment requirements can follow the ISO 31000 process |
| ISO/IEC 27701 | Privacy information management; privacy risk assessment can use the same method and register |
| ISO 22301 | Business continuity; risk assessment feeds business impact and continuity planning |
| ISO 9001 | Quality management; supports its risk-based thinking requirements |
| ISO 14001 and ISO 45001 | Environmental and health and safety management; supports hazard and aspect risk assessment |
| ISO 37301 | Compliance management; supports compliance risk assessment |
| Sector regulator and client requirements | Many regulators and clients expect documented risk governance; check the rules that apply to your sector |
Related service: see our ISO/IEC 27701 PIMS page, since privacy risk assessment is a shared activity.
Documents and records for a risk management framework
ISO 31000 is guidance, so it does not list required documents the way a certifiable standard does. It does expect risk management to be documented, and its results recorded and communicated.
| Document or record | Purpose | Status |
|---|---|---|
| Risk management policy | States commitment, purpose and approach, approved by top management | Core |
| Risk management framework document | Describes how risk management is integrated into governance and processes | Core |
| Risk appetite and tolerance statement | Sets how much risk is acceptable, by category | Core |
| Risk criteria and rating method | Scales, matrix and escalation thresholds | Core |
| Risk register | Risks, causes, consequences, ratings, owners and treatments | Core |
| Risk treatment plans | Actions, owners, deadlines and resources | Core |
| Risk assessment reports | Results of each assessment, with method and assumptions | Core |
| Risk reports to management and board | Periodic summary of top risks and trends | Core |
| Key risk indicator (KRI) dashboard | Early-warning measures with thresholds | Recommended |
| Communication and consultation plan | Who is told what, and when | Recommended |
| Training and competence records | Evidence that staff understand the method | Recommended |
| Incident and lessons-learned log | Feeds improvement of the framework | Recommended |
| Review and improvement records | Maturity assessments, audit results and actions | Recommended |
| Controls required by a related system or regulator | For example ISO 27001 risk treatment plan | Required where applicable |
Items are required only where a regulator, a client contract or a related management system such as ISO 27001 asks for them.
Assessment and certification options
Organisations cannot be certified to ISO 31000. ISO describes it as guidance that can also support internal and external audit programmes. These are the routes that do exist.
| Option | What it is | Output |
|---|---|---|
| Risk maturity assessment | Review of current practice against the ISO 31000 principles, framework and process | Gap report and improvement roadmap |
| Internal audit against ISO 31000 | Your own or a consultant’s audit of how well the framework is applied | Audit report and corrective actions |
| Independent external review | A third party reviews the framework and gives an opinion, not a certificate | Review report you can share with clients or boards |
| Personal qualifications | ISO 31000 Foundation, Risk Manager or Lead Risk Manager courses and exams from training providers | Individual certificate for staff, not for the organisation |
| Certifiable management systems that use risk management | ISO/IEC 27001, ISO/IEC 27701, ISO 22301, ISO 9001 and similar | Organisation certificate from an accredited certification body |
Wording we use, and avoid
- Use: “aligned with ISO 31000”, “based on ISO 31000 guidelines”, “independently reviewed against ISO 31000”.
- Avoid: “ISO 31000 certified”, “ISO 31000 certification for your company”.
- For personal qualifications, the certificate belongs to the person, not to the organisation.
ISO 31000:2018 is the current edition and was confirmed at its last review in 2023. A revision is listed as in development; we keep this page current when it changes.
Typical timeline
- Framework design and rollout: 3–6 months (approximate).
- Maturity assessment, training and fees are scoped to your organisation; request a quote after the free assessment.
Questions we hear most about ISO 31000
Talk to a QMet consultant and we will answer it directly, with no obligation.
Ask your question01 What is ISO 31000?
The international standard that gives guidelines on managing risk, through principles, a framework and a process that any organisation can adapt.
02 Can we get certified to ISO 31000?
No. It is a guidance standard, not a certifiable one. You can have your practice assessed or reviewed against it, and individuals can earn qualifications.
03 How is it different from ISO 27001 or ISO 9001?
Those are management system standards with requirements and certification. ISO 31000 is generic guidance on risk that can support them.
04 Is ISO 31000 only for large organisations?
No. It is designed to be customised to the size, sector and maturity of any organisation.
05 Does it cover only negative risks?
No. It defines risk as the effect of uncertainty on objectives, so it covers opportunities as well as threats.
06 How long does implementation take?
A first working framework usually takes 3 to 6 months, and risk management then continues as an ongoing practice.
07 What is the current edition?
ISO 31000:2018, published in February 2018.
08 Will ISO 31000 help with compliance?
It supports compliance by structuring how risks are identified, owned and treated, but it does not by itself make an organisation compliant with any law or regulation.
Ready to build a risk framework that supports better decisions?
Book a free risk maturity assessment. We will review how risk is rated, owned and reported across your organisation today, and show you the quickest route to a working ISO 31000 framework.
By submitting a request you agree to our Privacy Policy. Name, work email, company and headcount are all we need to start.
Disclaimer: This page is for general information and does not constitute legal or professional advice. ISO and IEC are trademarks of their respective organisations. QMet is not affiliated with ISO, IEC or any certification body unless stated. ISO 31000 is a guidance standard and cannot be certified.