Risk management frameworks: ISO 31000, NIST RMF and COSO ERM compared, and how to pick one

Answer first. A risk management framework is the set of principles, structures and process steps an organization uses to identify, assess, treat and monitor risk. ISO 31000 is a generic guideline for any organization, COSO ERM ties risk to strategy for boards, and NIST RMF is a seven-step process for securing information systems. Most organizations combine them rather than choose one.

What a risk management framework is, and what it is not

ISO 31000:2018 defines risk as the "effect of uncertainty on objectives" (clause 3.1) and uses the word framework for something specific: the set of components that assist the organization in integrating risk management into significant activities and functions (clause 5.1). In that usage the framework is the governance layer (leadership, roles, resources, review), and the process (clause 6) is the repeatable cycle of identifying, analyzing, evaluating and treating risk that runs inside it.

The market applies "risk management framework" to three different kinds of document:

• Generic guidelines that describe how any organization should manage any risk. ISO 31000:2018 is the reference case.
• Enterprise governance frameworks that connect risk to strategy, performance and board oversight. COSO's Enterprise Risk Management — Integrating with Strategy and Performance (2017) is the reference case.
• Domain process frameworks that prescribe steps for one class of asset or risk. NIST SP 800-37 Rev. 2, the Risk Management Framework for information systems, is the reference case; ISO/IEC 27005:2022 for information security risk and NIST AI RMF 1.0 for AI risk are others.

Three things a framework is not. It is not a control catalog: NIST SP 800-53 Rev. 5 supplies the controls the RMF selects, and neither ISO 31000 nor COSO ERM lists a single control. It is not a certification: ISO 31000:2018 states in its scope that it "is not intended for the purpose of certification", COSO issues no certificates, and the RMF ends in an authorization decision by the organization's own senior official. And it is not the risk register or the scoring method; those are covered in the sibling guide Risk register and risk assessment matrix: how to build one, and the boundaries between assessment campaigns and control testing are set out in RCSA vs Risk Assessment vs Control Testing.

For the short definitions, see What is risk management? and What is a risk assessment framework?.

The frameworks at a glance

The table compares the three frameworks in the title with the two that most often sit beside them: Open FAIR for quantification and the Basel Committee's operational risk principles as a sector example. Cost of adoption covers the document and the effort it implies; no publisher charges a license fee for using the approach.

The frameworks at a glance

	ISO 31000:2018	COSO ERM 2017	NIST RMF (SP 800-37 Rev. 2)	Open FAIR (O-RT 3.1, O-RA 2.1)	Basel PSMOR (2021)
Publisher	International Organization for Standardization	Committee of Sponsoring Organizations of the Treadway Commission	National Institute of Standards and Technology (US Department of Commerce)	The Open Group	Basel Committee on Banking Supervision
Scope	Any type of risk, any organization; 8 principles, a 6-part framework and a 6-step process	Enterprise risk tied to strategy and performance; 5 components, 20 principles	Security and privacy risk of information systems and the organizations that run them; 7 steps, 47 tasks	Information and operational risk analysis; a taxonomy of risk factors and an analysis method	Operational risk in banks; 12 principles
Certifiable	No (clause 1 says not intended for certification)	No	No; the output is an authorization to operate or to use, granted by the organization's own authorizing official	No for organizations; The Open Group certifies individuals	No; supervisory expectation, not a standard
Quantitative	Method-neutral: analysis can be qualitative, quantitative or both (6.4.3)	Method-neutral; principle 11 asks the organization to assess severity	Semi-quantitative categorization (low, moderate, high impact under FIPS 199); assessment method from SP 800-30	Yes; risk is expressed as probable frequency and probable magnitude of loss	Method-neutral; expects identification, assessment, monitoring and reporting
Primary audience	Risk managers, top management and oversight bodies in any sector	Boards, executives, internal audit and finance; strong in SOX-regulated companies	Federal agencies and contractors; CISOs and system owners in any sector	Cyber and operational risk analysts who must express risk in money	Bank boards, senior management, corporate operational risk functions and supervisors
Best fit	The enterprise-level umbrella; the language and structure for a risk policy	Board reporting, appetite and strategy alignment; companies already on COSO Internal Control 2013	Authorizing systems; organizations that must evidence control selection, assessment and continuous monitoring per system	The handful of risks where a decision turns on a currency figure	Banks and other firms whose supervisor expects Basel-aligned operational risk management
Cost of adoption	Standard is 16 pages and sold by ISO (CHF 135 at time of writing); low prescriptive burden, high judgment	Executive summary free; full framework and compendium purchased through COSO's publishing partners; effort is board and management engagement across 20 principles	Free; highest documentation burden of the five (system security and privacy plans, assessment reports, plans of action and milestones, authorization packages per system)	Standards free; effort is analyst training, calibrated estimation and loss data	Free; effort is governance, three-lines structure and supervisory reporting

ISO 31000:2018: principles, framework and process

ISO 31000:2018, Risk management — Guidelines, is the second edition; it cancels and replaces ISO 31000:2009. The 2018 revision, according to its foreword, put more emphasis on leadership by top management, on integrating risk management into the organization, and on the iterative nature of the process. The scope says the document provides a common approach to managing any type of risk, is not industry or sector specific, and can be applied to any activity including decision-making at all levels. The ISO 31000 framework page holds the official links and mappings.

The standard has three parts that nest.

Principles (clause 4). The stated purpose of risk management is the creation and protection of value. Eight principles describe what effective risk management looks like: integrated; structured and comprehensive; customized; inclusive; dynamic; best available information; human and cultural factors; and continual improvement. They are the test to apply to any framework you adopt, including the other four in this guide.

Framework (clause 5). Six components: leadership and commitment (5.2), integration (5.3), design (5.4), implementation (5.5), evaluation (5.6) and improvement (5.7). Clause 5.2 assigns accountability: top management is accountable for managing risk, oversight bodies for overseeing risk management. Design (5.4) is where the organization writes down its context, its risk management commitment, roles and authorities, resources, and communication arrangements.

Process (clause 6). Communication and consultation (6.2); scope, context and criteria (6.3), including defining risk criteria (6.3.4); risk assessment (6.4), which the standard splits into identification (6.4.2), analysis (6.4.3) and evaluation (6.4.4); risk treatment (6.5); monitoring and review (6.6); and recording and reporting (6.7). Clause 6.4.3 says analysis can be qualitative, quantitative or a combination, which is why ISO 31000 can sit above a FAIR analysis or a 5×5 matrix without contradiction. The techniques themselves are catalogued separately in IEC 31010.

What ISO 31000 does not do is say which risks matter, which controls to select or how to score. That is its strength as an umbrella and its weakness as a sole framework: an organization that adopts nothing else still writes the scales, the appetite statement, the register schema and the reporting cadence itself.

NIST RMF: the seven steps of SP 800-37 Rev. 2

NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, was published in December 2018 and runs to 183 pages. It is free. Federal agencies apply it under the Federal Information Security Modernization Act and OMB Circular A-130, which also requires them to integrate privacy into the RMF process. NIST describes the framework as policy and technology neutral, and its 2024 small enterprise guide (SP 1314) states that the RMF can be applied within any type of organization regardless of size or sector. The NIST SP 800-37 Rev. 2 framework page lists its mappings to ISO/IEC 27001, NIST CSF, FedRAMP and SP 800-53 Rev. 5.

The RMF is a process that runs per system, inside the system development life cycle. Chapter 3 of SP 800-37 Rev. 2 sets out seven steps and 47 tasks; the table gives each step's purpose as NIST states it and the documents that step depends on.

NIST RMF: the seven steps of SP 800-37 Rev. 2

Step	Tasks	Purpose (from SP 800-37 Rev. 2)	Supporting NIST documents	Main outputs
Prepare	P-1 to P-18	Carry out essential activities at the organization, mission and business process, and system levels so the organization is ready to manage its security and privacy risks with the RMF	SP 800-39, SP 800-30, SP 800-53B, SP 800-160	Risk management strategy, organization-wide risk assessment, tailored control baselines, common controls, authorization boundaries, system-level risk assessment
Categorize	C-1 to C-3	Determine the adverse impact of a loss of confidentiality, integrity and availability of the system and its information	FIPS 199, FIPS 200, SP 800-60	Security categorization (low, moderate or high impact), approved by the authorizing official
Select	S-1 to S-6	Select, tailor and document the controls needed to protect the system and organization commensurate with risk	SP 800-53, SP 800-53B, SP 800-30	Security and privacy plans; system-level continuous monitoring strategy
Implement	I-1 to I-2	Implement the controls in the plans and document the specific details in a baseline configuration	SP 800-53, SP 800-128	Implemented controls; updated plans reflecting the as-implemented state
Assess	A-1 to A-6	Determine whether the controls are implemented correctly, operating as intended and producing the desired outcome	SP 800-53A	Assessment plans and reports; initial remediation; plan of action and milestones
Authorize	R-1 to R-5	Provide accountability by requiring a senior official to decide whether the security and privacy risk, including supply chain risk, is acceptable	SP 800-39, SP 800-30	Authorization package; risk determination; authorization to operate or to use, with any conditions
Monitor	M-1 to M-7	Maintain ongoing situational awareness of the security and privacy posture of the system and organization in support of risk decisions	SP 800-137, SP 800-53A	Change monitoring, ongoing assessments and risk responses, updated reports, ongoing authorization

Three features distinguish the RMF from the enterprise frameworks. Every step has a system as its subject, and the authorization decision is about that system. The Select step draws from SP 800-53 Rev. 5 baselines, so the RMF is control-driven in a way ISO 31000 and COSO ERM are not. And the outputs column is a list of documents an authorizing official will ask to see; NIST's own advice is to make the transition to ongoing authorization a priority and use continuous monitoring to reduce the cost.

The RMF is not an enterprise risk framework. It says nothing about strategic, financial, legal or conduct risk and does not tell a board what its appetite should be. Organizations that adopt it for cyber and call it their risk management framework get a well-documented system estate and no view of the risks that do not live in a system.

NIST SP 800-39: the tiers above the RMF

NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View (March 2011), is the document that connects the RMF to the enterprise. It describes risk management as four components: frame risk (establish the context and produce a risk management strategy), assess risk, respond to risk, and monitor risk. It applies them across three tiers: Tier 1, the organization; Tier 2, mission and business processes; Tier 3, information systems. SP 800-37 Rev. 2 uses the same three levels and places most of the RMF at Level 3, informed by decisions at Levels 1 and 2.

That answers a common question: where does NIST expect the enterprise view to come from? From Tier 1, where the organization writes its risk management strategy and appetite. NIST does not prescribe how; that is where ISO 31000 or COSO ERM does the work. The SP 800-39 framework page holds the official links.

COSO ERM 2017: five components and twenty principles

COSO's Enterprise Risk Management — Integrating with Strategy and Performance (2017; executive summary dated June 2017) updates the 2004 Enterprise Risk Management — Integrated Framework. The executive summary is a free download; the full framework, its appendices and a compendium of examples are purchased through COSO's publishing partners. The COSO ERM framework page holds the official links.

COSO's stated aim is to clarify the importance of enterprise risk management in strategic planning and to embed it throughout the organization. The framework is a set of twenty principles organized into five interrelated components.

COSO ERM 2017: five components and twenty principles

Component	What COSO says it covers	Principles
Governance and Culture	Governance sets the tone and establishes oversight responsibilities; culture covers ethical values, desired behaviors and understanding of risk	1 Exercises Board Risk Oversight; 2 Establishes Operating Structures; 3 Defines Desired Culture; 4 Demonstrates Commitment to Core Values; 5 Attracts, Develops, and Retains Capable Individuals
Strategy and Objective-Setting	Risk appetite is established and aligned with strategy; business objectives put strategy into practice and are the basis for identifying, assessing and responding to risk	6 Analyzes Business Context; 7 Defines Risk Appetite; 8 Evaluates Alternative Strategies; 9 Formulates Business Objectives
Performance	Risks to strategy and objectives are identified, assessed and prioritized by severity in the context of appetite; responses are selected and a portfolio view taken	10 Identifies Risk; 11 Assesses Severity of Risk; 12 Prioritizes Risks; 13 Implements Risk Responses; 14 Develops Portfolio View
Review and Revision	Reviewing entity performance shows how well the components are working and what revisions are needed	15 Assesses Substantial Change; 16 Reviews Risk and Performance; 17 Pursues Improvement in Enterprise Risk Management
Information, Communication, and Reporting	A continual process of obtaining and sharing information that flows up, down and across the organization	18 Leverages Information Systems; 19 Communicates Risk Information; 20 Reports on Risk, Culture, and Performance

Only the Performance component describes the identify-assess-respond cycle that ISO 31000 calls the process; the other four are about governance, strategy and reporting, which is why COSO ERM reads as a board document and ISO 31000 as a practitioner document. COSO ERM is also not COSO Internal Control: the 2013 Internal Control — Integrated Framework is the one SOX programs use for internal control over financial reporting; the 2017 ERM framework is broader and SOX does not require it.

Open FAIR: quantifying risk in money

Open FAIR is The Open Group's standard for quantitative risk analysis. It has two parts: the Risk Taxonomy (O-RT) Standard, Version 3.1 (C251), and the Risk Analysis (O-RA) Standard, Version 2.1 (C250), both published on 22 May 2025 and both free to download; they supersede the 2021 editions (C20B and C20A). The Open Group also runs an Open FAIR certification program for individuals.

FAIR defines risk as the probable frequency and probable magnitude of future loss. Loss event frequency decomposes into threat event frequency and vulnerability; threat event frequency into contact frequency and probability of action; and vulnerability into threat capability against resistance strength. Loss magnitude splits into primary loss and secondary loss, across six forms: productivity, response, replacement, fines and judgments, competitive advantage and reputation. Inputs are estimated as ranges and the output is a distribution of loss in currency, not a color on a grid.

FAIR is not a management framework in the ISO 31000 sense. It has no governance layer, appetite statement or register. It is a method for the analysis step (ISO 31000 clause 6.4.3, COSO principle 11, the risk assessments the RMF's Prepare step calls for), and it earns its cost where a decision turns on money: an insurance limit, a control investment, a vendor exit. Cyber Risk Quantification vs Cyber Risk Management sets out where it fits; Understanding risk analysis: quantitative vs qualitative defines the terms.

Sector overlays: the Basel operational risk principles

Regulated sectors add a layer on top of whichever generic framework a firm chooses. The Basel Committee's Revisions to the Principles for the Sound Management of Operational Risk (31 March 2021, 23 pages) is the clearest example because it is explicitly a framework document: Principle 2 requires banks to develop, implement and maintain an operational risk management framework that is fully integrated into the bank's overall risk management processes.

The Principles were introduced in 2003, revised in 2011 after the financial crisis, and revised again in 2021 to align with the finalised Basel III operational risk framework and to update guidance on change management and information and communication technologies, after a 2014 review found several principles inadequately implemented. Four features that a generic framework does not supply:

• A fixed definition. Operational risk is "the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events"; it includes legal risk and excludes strategic and reputational risk (section 3, paragraph 1).
• A structure. Banks commonly rely on three lines of defense: business unit management; an independent corporate operational risk management function; and independent assurance (paragraph 6). Principle 2 expects the framework to be implemented by the first line, reviewed and challenged by the second and independently reviewed by the third.
• Twelve principles covering the board's role in risk culture (1), the framework (2), board approval of the framework (3), a risk appetite and tolerance statement for operational risk (4), senior management's role (5), identification and assessment (6), change management (7), monitoring and reporting (8), control and mitigation (9), ICT risk management (10), business continuity (11) and disclosure (12).
• Proportionality. The Committee recommends that banks take account of the nature, size, complexity and risk profile of their activities when implementing the Principles.

Other overlays work the same way: APRA CPS 230 for Australian financial institutions, ISO/IEC 27005:2022 for information security risk, NIST AI RMF 1.0 for AI. Each assumes an enterprise framework exists and adds definitions, structures and expectations for one risk class. Read them as requirements to map into your umbrella, not as alternatives to it. Connected GRC for Operational Risk Leaders covers the operational risk data model.

ISO 31000 vs COSO ERM

The two enterprise frameworks are more alike than the "vs" search suggests. Both cover any type of risk, both put the board and top management at the center, both require an appetite or criteria statement before assessment, both are method-neutral, and neither is certifiable. The differences are of origin, emphasis and vocabulary.

ISO 31000 vs COSO ERM

	ISO 31000:2018	COSO ERM 2017
Origin	Standards body; written to harmonize risk management across other standards, and referenced by ISO 22301:2019 and ISO/IEC 27005:2022	Accounting and audit sponsors (AAA, AICPA, FEI, IMA, IIA); sibling of the Internal Control framework used for SOX
Unit of analysis	Objectives at any level: strategic, organization-wide, project, product, process	Strategy and business objectives of the entity
Where the process sits	Clause 6 is a standalone process any team can run	Inside the Performance component; the other four components are governance and reporting
Appetite	"Risk criteria" (6.3.4), set by top management under 5.2	Principle 7, "Defines Risk Appetite", inside Strategy and Objective-Setting
Length and style	16 pages; principles and guidance	Executive summary plus a purchased framework with appendices and a compendium of examples
Natural home	Risk function, operations, projects, public sector, non-US organizations	Board, audit committee, internal audit, finance, US-listed companies

A practical rule. If the board already receives COSO-structured internal control reporting, COSO ERM gives it a risk framework in the same language and format. If the organization runs ISO management systems, ISO 31000 gives the risk function a vocabulary those systems already reference. Many use both: COSO's components for board oversight, ISO 31000's process for the work. GRC vs IRM vs ERM explains how the ERM program relates to the wider GRC operating model.

NIST RMF vs the enterprise frameworks

The comparison people search for, "ISO 31000 vs NIST RMF", is a comparison of levels, not of rivals. The RMF is a Tier 3 process (SP 800-39's term) for information systems; ISO 31000 and COSO ERM are Tier 1 frameworks for the organization. The table lines up their steps.

NIST RMF vs the enterprise frameworks

Activity	ISO 31000:2018 (process)	COSO ERM 2017 (principles)	NIST SP 800-39 (components)	NIST SP 800-37 Rev. 2 (RMF steps)
Set context, appetite and criteria	6.3 Scope, context and criteria	6 Analyzes Business Context; 7 Defines Risk Appetite	Frame	Prepare (organization-level tasks P-1 to P-7)
Identify	6.4.2 Risk identification	10 Identifies Risk	Assess	Prepare (P-8 to P-14); Categorize
Analyze and evaluate	6.4.3 Risk analysis; 6.4.4 Risk evaluation	11 Assesses Severity of Risk; 12 Prioritizes Risks	Assess	Categorize; Prepare P-14 system-level risk assessment
Treat and respond	6.5 Risk treatment	13 Implements Risk Responses	Respond	Select; Implement; Authorize (R-3 course of action)
Verify controls	Not a separate step; part of 6.4.3 analysis factors and 6.6	16 Reviews Risk and Performance	Monitor	Assess
Monitor and report	6.6 Monitoring and review; 6.7 Recording and reporting	18 to 20 Information, Communication, and Reporting	Monitor	Monitor
Portfolio and aggregation	Implicit in 5.3 integration	14 Develops Portfolio View	Tier 1 and Tier 2	Not covered; feeds Tier 1 through SP 800-39

Two gaps show up. The RMF has no portfolio step: nothing in SP 800-37 aggregates system risk into an enterprise picture, which is why NIST IR 8286 exists to connect cybersecurity risk registers to ERM. And the enterprise frameworks have no explicit control-verification step: ISO 31000 treats control effectiveness as an input to analysis, and COSO ERM leaves testing to the Internal Control framework. That is why RCSA vs Risk Assessment vs Control Testing treats control testing as a third activity rather than a phase of assessment.

How to pick one: the selection checklist

Work through the questions in order. Each answer points to a primary framework; the last column says what to add.

How to pick one: the selection checklist

#	Question	If yes	If no	What to add
1	Does a regulator or supervisor expect a named framework? (US federal system: RMF under FISMA; bank: Basel PSMOR; Australian financial institution: CPS 230)	Adopt the named framework for that scope; it is not optional	Continue	A generic umbrella (ISO 31000) for everything the named framework does not cover
2	Is the board's main interest strategy, appetite and performance, reported in a form the audit committee already knows?	COSO ERM 2017	Continue	ISO 31000's clause 6 process for the risk function's work
3	Do you run ISO management systems (27001, 22301, 9001) whose risk clauses reference ISO 31000?	ISO 31000 as umbrella; map COSO principles to it if the board wants them	Continue	IEC 31010 for technique selection
4	Do you need to authorize information systems, evidence control selection per system, or sell to US federal customers?	NIST RMF for the system estate, with SP 800-53 baselines	Continue	SP 800-39 Tier 1 and 2 decisions, supplied by the umbrella
5	Do decisions on insurance, control investment or vendor exit turn on a currency figure?	Open FAIR for those risks	Skip	Keep the qualitative register as the system of record; store FAIR outputs on the rows that justify them
6	Do you operate in more than one jurisdiction or sector with different named frameworks?	ISO 31000 umbrella with a common taxonomy; map each overlay to it	Continue	How to Build a Common Risk and Control Taxonomy
7	Do you have fewer than five people in risk and no dedicated security team?	ISO 31000 alone, plus NIST SP 1314 if you have systems to secure	Continue	Grow into COSO ERM's reporting principles when the board asks for a portfolio view
8	Can you afford the documentation the RMF produces per system (plans, assessments, POA&Ms, authorization packages)?	RMF as written	Use NIST CSF 2.0 or ISO/IEC 27005 for the security layer and reserve the RMF for systems that need authorization	NIST CSF 2.0 and Connected GRC

Whatever the answers, three things are non-negotiable because every framework here asks for them: a written appetite or criteria statement before assessment starts (ISO 31000 5.2 and 6.3.4; COSO principle 7; RMF Task P-2; Basel Principle 4); named accountability for each risk (ISO 31000 5.4.3; COSO principle 2; RMF Task P-1; Basel Principle 5); and a monitoring and reporting cycle that reaches the board (ISO 31000 6.6 and 6.7; COSO principles 16 and 20; RMF Monitor step; Basel Principle 8). See Risk Appetite vs Risk Tolerance vs Impact Tolerance and How to Build a Risk Appetite Dashboard for Executives.

Combining frameworks: ISO 31000 as the umbrella

The pattern that works in most organizations has three layers, and it is the pattern NIST's own tiering implies.

Layer 1: ISO 31000 as the enterprise umbrella. Use clause 5 to write the risk management policy: leadership commitment, roles, resources and the design decisions (taxonomy, scales, appetite, cadence). Use clause 6 as the process every risk owner follows regardless of risk class. Where the board prefers COSO's language, map the twenty principles to the ISO clauses; the Performance component maps near one-to-one and the governance and reporting principles slot into clauses 5.2, 5.3 and 6.7. Sector overlays map into the same umbrella as requirements.

Layer 2: NIST RMF for the system estate. Run the seven steps per system with SP 800-53 baselines, and treat the umbrella's appetite and criteria as the Tier 1 input the Prepare step expects (Task P-2: establish a risk management strategy that includes a determination of risk tolerance). Feed authorization decisions, open plans of action and milestones, and monitoring results back to the enterprise register through a common taxonomy, which is what NIST IR 8286 describes. If most systems do not need a formal authorization, use NIST CSF 2.0 for the security program and reserve the RMF for the systems that do.

Layer 3: Open FAIR for the few risks that need a number. Keep the qualitative register as the system of record and run FAIR on the rows where a decision turns on money. Record the loss distribution beside the qualitative rating with the date and analyst. Do not convert the whole register; the data and analyst time do not exist for hundreds of risks, and ISO 31000 clause 6.4.3 allows a combination of methods.

The connective tissue is one taxonomy and one set of records. A risk from a Basel-driven RCSA, a system risk from an RMF assessment and a FAIR-quantified cyber scenario must resolve to the same categories, appetite thresholds and control library, or the board sees three programs instead of one. How to Map NIST, ISO, SOC 2, SOX, CRI, and Internal Policies Without Creating Control Chaos and SOC 2 vs ISO 27001 vs NIST cover the control side of the same problem.

Common mistakes

1. Adopting the RMF as the enterprise framework. It has no strategic, financial or conduct risk content and no portfolio step. Use it for systems and put something above it.
2. Treating ISO 31000 as a certification target. The standard says it is not intended for certification. "ISO 31000 certified" describes a person's training, not an organization.
3. Confusing COSO ERM with COSO Internal Control. SOX programs use the 2013 Internal Control framework. Boards that think their SOX work has delivered ERM have covered financial reporting risk only.
4. Choosing a framework before writing the appetite statement. Every framework here asks for criteria before assessment. Without them, any framework produces ratings nobody can evaluate.
5. Running FAIR on everything. The method needs calibrated estimators and loss data. Use it where a decision needs a currency figure and record the result on the qualitative register.
6. Separate programs per overlay. A Basel operational risk program, an RMF program and an ERM program with three taxonomies and three registers report three risk pictures. Map overlays into one umbrella.
7. Ignoring proportionality. ISO 31000 principle (c) is "customized"; Basel asks banks to account for nature, size, complexity and risk profile; NIST wrote SP 1314 for small enterprises. A five-person risk team adopting twenty COSO principles and 47 RMF tasks on day one will document rather than manage.

How SmartSuite does this

SmartSuite's Enterprise Risk Management (ERM) product is the umbrella layer in the combination above. The product page lists alignment with COSO ERM, ISO 31000, NIST RMF and the CRI Profile; the risk register, assessment models, mitigation tracking, key risk indicators, dashboards and workflow automation are configured to whichever vocabulary the organization has chosen, or to both mapped to one taxonomy. Assessment models support qualitative and quantitative scoring on the same risk record, so a FAIR loss distribution can sit beside a 5×5 rating on the rows that justify it.

The system layer connects through Control Framework & Regulatory Libraries, which holds framework requirements and control mappings so that an RMF Select step draws from the same control library the enterprise register links to; sector overlays are mapped once and reported against many. The first-line campaigns that Basel Principle 6 and COSO principle 10 describe run in Risk and Control Self-Assessment (RCSA), with inherent and residual views on the same risk, control and issue records.

For how the pieces fit into one program, see Enterprise Risk Management in a Connected GRC Program and the Enterprise Risk Management solution page.

FAQs

Is ISO 31000 certifiable? No. Clause 1 of ISO 31000:2018 states that the document is not intended for the purpose of certification. Certification bodies certify against requirements standards such as ISO/IEC 27001 or ISO 22301, both of which reference ISO 31000 for their risk clauses. An organization can align with ISO 31000 and say so; it cannot hold a certificate for it.

Is NIST RMF mandatory for private companies? No. US federal agencies apply it under FISMA and OMB Circular A-130, and contractors inherit it through their federal contracts. NIST states in SP 1314 that the RMF can be applied within any type of organization regardless of size or sector, and its 2024 small enterprise guide exists for that reason. Outside government it is a choice, usually made for systems that need a formal authorization.

What is the difference between COSO ERM and COSO Internal Control? COSO Internal Control — Integrated Framework (2013) covers internal control, including control over financial reporting, and is the framework SOX programs use. COSO Enterprise Risk Management — Integrating with Strategy and Performance (2017) covers risk to strategy and business objectives across the entity, in five components and twenty principles. They share a sponsor and a format; SOX requires only the first.

Can ISO 31000 and COSO ERM be used together? Yes, and many organizations do. COSO ERM's Performance component (principles 10 to 14) maps almost one-to-one onto ISO 31000's clause 6 process, and its governance and reporting principles map onto ISO 31000 clauses 5.2, 5.3 and 6.7. A common arrangement uses COSO's components for board oversight and reporting and ISO 31000's process for the risk function's day-to-day work.

Is FAIR a risk management framework? Not in the ISO 31000 sense. Open FAIR is a taxonomy and analysis method for expressing risk as probable loss frequency and magnitude in currency. It has no governance layer, appetite statement or register, so it sits inside the analysis step of whichever framework the organization uses. The Open Group publishes the two standards free and certifies individual practitioners, not organizations.

Which framework do regulators expect? It depends on the sector and jurisdiction. Banks in Basel Committee jurisdictions are expected to run an operational risk management framework that follows the twelve Principles for the Sound Management of Operational Risk; Australian financial institutions follow CPS 230; US federal systems follow the RMF. None of these regimes names ISO 31000 or COSO ERM as mandatory, but each assumes an enterprise framework exists for the named one to integrate with.

Sources

• ISO 31000:2018, Risk management — Guidelines, second edition, International Organization for Standardization, February 2018. Clauses 1, 3.1, 4, 5.1 to 5.7, 6.2 to 6.7; foreword on changes from the 2009 edition. Catalog: https://www.iso.org/standard/65694.html. Preview with scope, terms, principles and framework clauses: https://cdn.standards.iteh.ai/samples/65694/60673072317a4b96bd36efb910b68926/ISO-31000-2018.pdf. SmartSuite framework page: https://www.smartsuite.com/frameworks/iso-31000-risk-management-guidelines-2018
• NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, National Institute of Standards and Technology, December 2018, 183 pages. Sections 1.1, 2.1, 2.2, 3.1 to 3.7; Tasks P-1 to P-18, C-1 to C-3, S-1 to S-6, I-1 to I-2, A-1 to A-6, R-1 to R-5, M-1 to M-7. https://csrc.nist.gov/pubs/sp/800/37/r2/final (PDF: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf). SmartSuite framework page: https://www.smartsuite.com/frameworks/nist-sp-800-37-rev-2-risk-management-framework-rmf
• NIST, About the RMF, Risk Management Framework project page (seven-step descriptions). https://csrc.nist.gov/projects/risk-management/about-rmf
• NIST SP 1314, NIST Risk Management Framework (RMF) Small Enterprise Quick Start Guide, July 2024. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1314.pdf
• NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View, March 2011. Sections 2.1 (frame, assess, respond, monitor) and 2.2 (three tiers). https://csrc.nist.gov/pubs/sp/800/39/final (PDF: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf). SmartSuite framework page: https://www.smartsuite.com/frameworks/nist-sp-800-39-managing-information-security-risk
• COSO, Enterprise Risk Management — Integrating with Strategy and Performance, Executive Summary, Committee of Sponsoring Organizations of the Treadway Commission, June 2017. Five components (page 5) and twenty principles (page 9); relationship to the 2004 framework; availability of the full framework and compendium. https://www.coso.org/guidance-erm (PDF: https://www.coso.org/_files/ugd/3059fc_61ea5985b03c4293960642fdce408eaa.pdf). SmartSuite framework page: https://www.smartsuite.com/frameworks/coso-enterprise-risk-management-framework-2017
• The Open Group, Risk Taxonomy (O-RT) Standard, Version 3.1, C251, 22 May 2025 (supersedes C20B). https://publications.opengroup.org/c251
• The Open Group, Risk Analysis (O-RA) Standard, Version 2.1, C250, 22 May 2025 (supersedes C20A). https://publications.opengroup.org/c250
• The Open Group, Technical Standard: Risk Taxonomy, C081, January 2009 (definition of risk, section 5.2.1; factor decomposition, 5.2.2 to 5.2.8; forms of loss, 5.2.10). https://pubs.opengroup.org/onlinepubs/9699919899/toc.pdf
• The Open Group, Open FAIR Certification. https://www.opengroup.org/certifications/openfair
• Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, 31 March 2021, 23 pages. Introduction (history and reasons for revision; proportionality); section 3 paragraph 1 (definition); paragraph 6 (three lines of defense); Principles 1 to 12. https://www.bis.org/bcbs/publ/d515.htm (PDF: https://www.bis.org/publications/202103-guidelines-revisions-principles-sound-management-operational-risk.pdf)
• Bank for International Settlements, Financial Stability Institute, Principles for the sound management of operational risk — Executive Summary, 27 April 2023. https://www.bis.org/fsi/fsisummaries/psmor.htm
• NIST IR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), October 2020 (connecting system-level risk registers to the enterprise register). https://csrc.nist.gov/pubs/ir/8286/final

Related: GRC Foundation · What is enterprise risk management (ERM)? · What is integrated risk management (IRM)? · What is risk appetite? · What is the NIST Cybersecurity Framework? · CRI Profile