ISO 31000

Organizations manage many kinds of risk, from strategic and financial risk to safety, security, project and compliance risk. Without a common approach, each area tends to develop its own terms, scales and methods, which makes it hard to compare risks or combine them into an overall picture. ISO 31000 offers a common foundation. It explains what good risk management looks like, how to build it into the organization's governance and decision making, and the steps of the risk management process. Because it is general rather than technical, it can be applied to any type of risk. It is equally relevant to a small charity, a hospital, a government agency or a global company.

ISO 31000 was first published by the International Organization for Standardization in 2009 and revised in 2018. The 2018 version is shorter and places more emphasis on leadership, integration with management and continual improvement. Unlike ISO 27001, ISO 31000 is a guidance standard rather than a requirements standard, so organizations cannot be certified against it. It is supported by related documents, including ISO Guide 73, which defines risk vocabulary, and IEC 31010, which describes risk assessment techniques. For risk, compliance and leadership teams, ISO 31000 is a widely recognized reference for designing or improving a risk management program.

Definition of ISO 31000

ISO 31000, Risk management, Guidelines, is an international standard that describes the principles of effective risk management, a framework for integrating risk management into an organization's governance and activities, and a process for identifying, analyzing, evaluating, treating, monitoring and communicating risk.

It is one of the most common references for a risk management framework, underpins many approaches to enterprise risk management and defines the stages of a risk assessment.

The Three Parts of ISO 31000

The principles describe the characteristics of effective risk management. The 2018 version lists eight: integrated, structured and comprehensive, customized, inclusive, dynamic, based on the best available information, taking account of human and cultural factors, and continually improved. All of them serve the purpose of creating and protecting value. The principles are intended to guide how the framework and process are designed and judged.

The framework describes how to embed risk management in the organization, centered on leadership and commitment and covering integration, design, implementation, evaluation and improvement.

The process describes the steps of managing risk: communication and consultation; establishing the scope, context and criteria; risk assessment, made up of identification, analysis and evaluation; risk treatment; monitoring and review; and recording and reporting.

ISO 31000 and Other Frameworks

COSO Enterprise Risk Management covers similar ground, with a stronger link to strategy and performance and more detail on governance. Many organizations draw on both. For example, they may use ISO 31000 for the risk process and COSO for governance and board reporting.

ISO 27001 and ISO/IEC 27005 apply ISO 31000 concepts to information security, and ISO 27001 requires a risk process consistent with them.

ISO 22301 for business continuity and other ISO management system standards also use ISO 31000 terms and concepts.

Sector frameworks, such as banking regulations or the NIST risk management framework, can be aligned with ISO 31000 by mapping their steps to its process.

Importance of ISO 31000 in Risk and Compliance

ISO 31000 provides a common language. Using its definitions and process helps teams across the organization describe and manage risk consistently. This consistency makes it easier to combine risks into an enterprise view.

It is flexible. Because it is principles-based and not certifiable, organizations can adapt it to their size, sector and maturity.

It also connects risk to value. The standard emphasizes that risk management should support decision making and the achievement of objectives, not just avoid losses.

ISO 31000 and Financial Management

A consistent risk process across the organization makes it easier to compare risks and direct spending to the most significant ones.

Integrating risk into planning and investment decisions, as the standard recommends, helps weigh potential rewards against risks before committing money.

Since ISO 31000 is not certifiable, there are no certification fees, although organizations may pay for training, advice or independent reviews.

Aligning with a recognized standard can support discussions with insurers, lenders and rating agencies about the quality of risk management.

Common Challenges

Because the standard is general, organizations must decide for themselves how to put its principles into practice. Related guidance, such as IEC 31010, can help with specific techniques.

Programs can adopt the process steps but neglect the framework elements, such as leadership commitment and integration into decisions.

Without certification, there is no external check on whether an organization actually follows the standard well. Internal audit or an independent review can fill this gap.