ISO 31000
Also called ISO 31000:2018, risk management guidelines standard
ISO 31000 is the international standard that gives guidelines for managing risk in any organisation. The current edition, ISO 31000:2018, sets out principles, a framework for embedding risk management in governance and a process for identifying, analysing, evaluating and treating risk. It is guidance only, so organisations cannot be certified against it.
How it works
The standard has three parts. The principles describe what effective risk management looks like: integrated, structured, customised, inclusive, dynamic, based on the best available information, mindful of human and cultural factors, and continually improved. The framework covers leadership and commitment, and how risk management is designed, implemented, evaluated and improved within the organisation's governance. Together they make risk management part of decision-making rather than a separate exercise.
The process is the operational core. The organisation sets the scope, context and criteria, then assesses risk by identifying, analysing and evaluating it, and chooses treatments such as avoiding, reducing, sharing or accepting the risk. Communication and consultation, monitoring and review, and recording and reporting run throughout. Banks and insurers often map their enterprise risk frameworks, risk registers and risk appetite statements to ISO 31000 terms, alongside sector rules.
The rules
Provides principles, a framework and a process for managing risk; replaces ISO 31000:2009 and is not intended for certification.
Any organisation, voluntaryCompanion standard that describes techniques for risk assessment, such as scenario analysis, bow-tie analysis and consequence and likelihood matrices.
Any organisation, voluntaryCommon questions
Can a company be certified to ISO 31000?
No. ISO 31000 gives guidelines rather than requirements, so there is no certification. Organisations can state that their framework is aligned with it, and auditors can assess that alignment.
How does ISO 31000 differ from COSO ERM?
Both describe enterprise risk management. ISO 31000 is a short international standard usable by any organisation. The COSO framework is US-origin, more detailed and closely linked to internal control and financial reporting. Many firms draw on both.
Do regulators require ISO 31000?
No financial regulator mandates it. Banks and insurers must meet sector rules on risk management, and many use ISO 31000 terms and process to structure their frameworks.
