ISO 31000 — Risk Management Guidelines

Why does it matter?

The Introduction describes managing risk as iterative work that helps organizations set strategy, achieve objectives and make informed decisions, and as part of governance and leadership, not a separate compliance activity. ISO 31000:2018 gives organizations a common vocabulary and structure for it.

Key benefits include:

• Value creation and protection

Clause 4 states that the purpose of risk management is the creation and protection of value, and that it improves performance, encourages innovation and supports the achievement of objectives.

• Accountability at the top

Top management is accountable for managing risk and oversight bodies are accountable for overseeing risk management, with authority, responsibility and accountability assigned at appropriate levels (Clause 5.2).

• One approach for any type of risk

The guidelines provide a common approach to managing any type of risk and are not industry or sector specific (Clause 1).

• Fitted to the organization

The framework and process are customized and proportionate to the organization's external and internal context and objectives (Clause 4, principle c, and Clause 5.4.1).

• Decisions on the best available information

Inputs rest on historical and current information and future expectations, with limitations and uncertainties stated, and the results are recorded and reported (Clause 4, principle f, and Clause 6.7).

How does it work?

ISO 31000:2018 has three connected components, shown in Figure 1 of the Introduction: principles (Clause 4), a framework (Clause 5) and a process (Clause 6). The principles describe the characteristics of effective risk management; the framework helps the organization integrate risk management into significant activities and functions; the process covers communicating, establishing the context, assessing, treating, monitoring, reviewing, recording and reporting risk.

The framework is built by integrating, designing, implementing, evaluating and improving risk management across the organization (Clause 5.1). Design covers understanding the organization and its context, articulating the commitment, assigning roles and accountabilities, allocating resources and establishing communication and consultation (Clauses 5.4.1 to 5.4.5). Evaluation (Clause 5.6) and improvement, which adapts the framework and improves it continually (Clauses 5.7.1 and 5.7.2), close the loop.

The process begins by defining the scope, the external and internal context and the risk criteria (Clause 6.3). Risk assessment follows as identification, analysis and evaluation (Clauses 6.4.2 to 6.4.4), then risk treatment, which selects options and prepares and implements treatment plans (Clauses 6.5.2 and 6.5.3). Communication and consultation (6.2) and monitoring and review (6.6) run alongside every step, and the outcomes are recorded and reported (6.7).

Key Elements

• Principles (Clause 4)

Eight principles: integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, and continual improvement.

• Leadership and commitment (Clause 5.2)

Top management and oversight bodies customize and implement the framework, issue a risk management statement or policy, allocate resources and assign authority, responsibility and accountability.

• Integration and design (Clauses 5.3 and 5.4)

Risk management becomes part of governance, strategy, objectives and operations, with context, commitment, roles, resources and communication designed in.

• Scope, context and criteria (Clause 6.3)

Defining the scope (6.3.2), the external and internal context (6.3.3) and the risk criteria (6.3.4); leadership communicates the amount and type of risk that may or may not be taken to guide the criteria (5.2).

• Risk assessment (Clause 6.4)

Risk identification (6.4.2), risk analysis (6.4.3) and risk evaluation (6.4.4).

• Risk treatment (Clause 6.5)

Selection of risk treatment options (6.5.2) and preparing and implementing risk treatment plans (6.5.3).

• Monitoring, review, recording and reporting (Clauses 6.6 and 6.7)

Monitoring and review of the process and its outcomes (6.6), and recording and reporting of those outcomes (6.7).

What does it cover?

ISO 31000:2018 provides guidelines on managing risk faced by organizations and can be customized to any organization and its context (Clause 1). It provides a common approach to managing any type of risk, is not industry or sector specific and can be used throughout the life of the organization and for any activity, including decision-making at all levels. It has no normative references (Clause 2). ISO states that it cannot be used for certification, but that it offers guidance for internal or external audit programs.

What are its objectives?

ISO 31000:2018 is written for people who create and protect value in organizations by managing risks, making decisions, setting and achieving objectives and improving performance (Introduction). In practice, adopting it means to:

Integrate risk management into governance, strategy, objectives and decision-making (Clauses 5.1 and 5.3).

Assign authority, responsibility and accountability and allocate resources (Clauses 5.2, 5.4.3 and 5.4.4).

Run a consistent process of scope, context and criteria, assessment and treatment (Clauses 6.3 to 6.5).

Communicate and consult with stakeholders throughout (Clause 6.2).

Monitor, review, record and report, and improve the framework over time (Clauses 5.7, 6.6 and 6.7).

Framework in Context

The second edition canceled and replaced ISO 31000:2009. The Foreword lists four changes: a review of the principles, more emphasis on leadership by top management and on integrating risk management starting with governance, greater emphasis on the iterative nature of risk management, and a streamlined text focused on an open systems model. ISO's catalog shows the standard through a systematic review that closed on October 11, 2024 with the status to be revised, and lists ISO/CD 31000 as under development. Other ISO standards build on it; for example, the Foreword of ISO 28000:2022 says its Clause 4 principles were added for better coordination with ISO 31000. IEC 31010:2019 covers risk assessment techniques.

Common Framework Mappings

Organizations map ISO 31000:2018 to the risk, continuity and information security standards and frameworks below so that one risk process and one set of records serve several programs.

Mapped frameworks include:

COSO Enterprise Risk Management (COSO ERM)

ISO 22301 — Business Continuity Management Systems

IEC 31010 — Risk assessment techniques

ISO/IEC 27001 — Information Security Management System

ISO/IEC 27005 — Information Security Risk Management

NIST Risk Management Framework (SP 800-37)