ISO 31000 risk management: principles, framework and process

ISO 31000:2018 is the international standard that provides guidelines on managing risk, built around a set of principles, a framework and a process that any organization can apply to any type of risk. It is produced by ISO/TC 262, the ISO technical committee for risk management, whose scope is "Standardization in the field of risk management" and whose page listed seven published standards and three under development on 23 October 2026 (ISO, no date).

The standard defines risk as the effect of uncertainty on objectives. That single definition shapes everything else in the document: risk is not confined to loss, hazard or threat, and risk management is not confined to a register maintained by a single department. This article sets out the scope of ISO 31000, the PECB credentials that attest personal competence in applying it, the principles, framework and process themselves, the assessment techniques catalogued in IEC 31010, and the standard's relationship with ISO 37301, ISO 22301 and the harmonized structure.

Standards Academy teaches ISO 31000 together with the risk governance principle of ISO 37000 (Clause 6.9), which was written in ISO/TC 309/WG 1 under the convenorship of Standards Academy's director. The governing body considers the effect of uncertainty on the organizational purpose; ISO 31000 gives management the method for doing so.

Scope and purpose of ISO 31000

ISO 31000:2018, Risk management. Guidelines, is the second edition of the standard, published in February 2018 and confirmed in 2023 (ISO, 2018). It applies to organizations of any size, sector or activity, and to any type of risk, whether the consequences are positive or negative. The purpose is practical: to help an organization identify, analyse, evaluate and treat risk; to integrate risk management into governance, strategy, planning and operations; and to improve decision-making under uncertainty.

Two features of the standard matter for anyone comparing it with other ISO documents. First, it is a guidelines standard. It contains no auditable "shall" clauses, and no accredited certification of an organization to ISO 31000 exists. Second, it is deliberately generic. The framework is tailored to the organization's context, objectives and risk profile. ISO 31000 describes what good risk management looks like without prescribing a single method.

Two companion documents complete the core set. IEC 31010:2019, developed jointly with IEC, provides guidance on risk assessment techniques (ISO, 2019), and ISO 31073:2022 supplies the vocabulary of risk management (ISO, 2022). Together the three cover guidelines, guidance and terminology.

A revision is in progress. On 23 October 2026, iso.org showed the 2018 edition at stage 90.92 ("International Standard to be revised") and ISO/CD 31000 under development at committee stage (30.60), with no expected publication date given. Organizations adopting the standard today work from the 2018 edition. The content of a committee draft is not final.

PECB credentials and training routes for risk management

Because ISO 31000 is not certifiable at organizational level, risk management certification in the ISO 31000 context means personal credentials. PECB operates a credential ladder that attests the competence of an individual to understand and apply the standard, and the right credential depends on the role the person holds.

The ISO 31000 Foundation credential confirms knowledge of the terminology, principles, framework and process. The ISO 31000 Risk Manager credential attests the ability to apply the standard in practice. The ISO 31000 Lead Risk Manager credential attests the competence to establish and lead an organization-wide risk management framework.

The table below maps roles to credentials and the corresponding ISO 31000 training route.

Candidates generally complete training, pass the relevant examination and, for the Risk Manager and Lead Risk Manager grades, submit evidence of experience. These credentials attest the competence of a person and confer no status on an organization.

Organizations and roles within scope

ISO 31000 was written to be applied by any organization: listed companies, public bodies, regulators, charities, joint ventures, projects and individual organizational units. A ministry assessing policy risk, a contractor assessing delivery risk on a single programme and a bank assessing enterprise-wide exposure can all use the same principles, framework and process, tailored to their own context.

Within an organization, several roles carry distinct responsibilities under the standard:

Governing bodies and top management, who are accountable for integrating risk management into governance and for demonstrating leadership and commitment.

Risk owners, the people with the accountability and authority to manage specific risks.

Risk managers and risk committees, who design, coordinate and report on the framework and process. The ISO 31000 Risk Manager role typically sits here, translating the standard into criteria, assessments and treatment plans.

Assurance and specialist functions, internal audit, compliance, legal, finance, information security, business continuity and operational management, who either rely on risk information or feed it.

Employees and external stakeholders involved in decisions where uncertainty affects objectives.

The breadth is deliberate. Because the standard defines risk as the effect of uncertainty on objectives, anyone who sets or pursues objectives is within scope. In practice, the credential ladder described above tracks this spread of roles: a Foundation-level understanding serves those who consume risk information, while the ISO 31000 Lead Risk Manager profile serves those who build and defend the framework in front of a board.

Principles, framework and process of ISO 31000

The standard has three components: principles, framework and process (ISO, 2018, Clauses 4 to 6). Each is set out below.

The eight principles

The principles describe what effective risk management looks like. Risk management should be integrated into all organizational activities; structured and comprehensive in approach; customized to the organization's context; inclusive of stakeholders; dynamic, responding to change; based on the best available information; attentive to human and cultural factors; and subject to continual improvement. The stated purpose of the whole discipline is the creation and protection of value.

The framework

The framework is the governance component. Its centre is leadership and commitment from the governing body and top management, surrounded by integration, design, implementation, evaluation and improvement. The framework is where risk management either becomes part of how the organization is run or remains a reporting exercise.

The process

The process is iterative and applies at strategic, operational, programme and project levels. Its elements are:

Communication and consultation with internal and external stakeholders.

Scope, context and criteria, defining what is being assessed and against which risk criteria.

Risk assessment, comprising risk identification, risk analysis and risk evaluation.

Risk treatment, selecting and implementing options.

Monitoring and review of the process and its outcomes.

Recording and reporting through appropriate mechanisms.

The vocabulary underpinning these components is standardized in ISO 31073:2022, which keeps terms such as risk source, likelihood, consequence and risk criteria consistent across the committee's publications (ISO, 2022).

Risk assessment techniques under IEC 31010

ISO 31000 names risk assessment as a step in the process but deliberately stops short of prescribing how to perform it. That is the job of IEC 31010:2019, a joint ISO and IEC guidance document listed under ISO/TC 262, which catalogues assessment techniques and explains how to select among them (ISO, 2019).

The techniques are organized by what they do within the assessment. There are techniques for eliciting views from stakeholders and experts, such as brainstorming and structured interviews; techniques for identifying risk, such as checklists, scenario analysis and failure mode and effects analysis; techniques for determining sources, causes and drivers of risk; techniques for analysing controls, such as bow tie analysis; techniques for understanding consequences and likelihood, such as fault tree analysis, event tree analysis, Monte Carlo simulation and Markov analysis; techniques for analysing dependencies and interactions; techniques that provide a measure of risk; techniques for evaluating the significance of risk; techniques for selecting between options, such as decision tree analysis; and techniques for recording and reporting.

Three examples illustrate the range. Bow-tie analysis maps a central event to its causes on one side and its consequences on the other, with barriers shown on each path, useful for communicating controls to non-specialists. Failure mode and effects analysis (FMEA) works through the ways a system, process or component can fail and rates each mode for severity, occurrence and detectability. Monte Carlo simulation models uncertainty quantitatively by sampling input distributions many times to produce a distribution of outcomes, which suits cost, schedule and financial exposure questions.

IEC 31010 is explicit that no single technique fits every decision. The choice depends on the nature of the decision, the information available, the complexity of the situation, the degree of uncertainty and the level of detail required. A mature IEC 31010 practice combines several techniques across the identification, analysis and evaluation stages.

Relationship with ISO 37301, ISO 22301 and the harmonized structure

ISO 31000 does not stand alone. Every ISO management system standard written to the harmonized structure, ISO 9001, ISO/IEC 27001, ISO 37301, ISO 22301 and the rest, contains Clause 6.1, which requires the organization to determine risks and opportunities and plan actions to address them. None of those standards explains how to do that. ISO 31000 is the reference for the method: its process of establishing criteria, assessing risk and treating it is the natural way to satisfy Clause 6.1 in any harmonized management system. That is why risk management competence travels so well across disciplines.

The boundaries with neighbouring standards still need to be kept clean.

ISO 37301 covers compliance management. It specifies requirements for a certifiable compliance management system, including the identification and evaluation of compliance obligations and compliance risks. ISO 31000 supplies the assessment method that a compliance function can use, but managing compliance risk under ISO 37301 is a distinct discipline with its own requirements and its own audit trail.

ISO 22301 covers business continuity. It specifies requirements for a certifiable business continuity management system focused on maintaining and recovering prioritized activities after disruption. ISO 31000 supports the identification and treatment of the threats that continuity planning responds to, but continuity planning, business impact analysis and recovery objectives belong to ISO 22301.

In each case, Clause 6.1 sets the obligation and ISO 31000 supplies the method. ISO 37000 adds the governing body's own duty: under its risk governance principle the governing body ensures that it considers the effect of uncertainty on the organizational purpose and the associated strategic outcomes (ISO, 2021, Clause 6.9), which is the level above Clause 6.1 of any management system.

Frequently asked questions

What does ISO 31000 provide that a risk register does not?

A risk register is a record. ISO 31000 is a discipline. The standard supplies eight principles, a governance framework anchored in leadership and commitment, and an iterative process covering communication, context, assessment, treatment, monitoring and reporting. A register documents identified risks, but says nothing about criteria, accountability, integration or improvement.

Can an organization be certified to ISO 31000?

No. ISO 31000 is a guidelines standard with no requirements clauses, so no accredited certification of an organization against it exists. Certification in this field applies to individuals. PECB credentials such as Risk Manager and Lead Risk Manager attest a person's competence to apply the standard.

What are the eight principles of ISO 31000?

Risk management should be integrated, structured and comprehensive, customized, inclusive, dynamic, based on the best available information, attentive to human and cultural factors, and continually improved. The principles sit under a single stated purpose: the creation and protection of value across the organization's activities and decisions.

How does ISO 31000 relate to Clause 6.1 of a management system standard?

Every harmonized management system standard requires, in Clause 6.1, actions to address risks and opportunities, without prescribing a method. ISO 31000 is the reference for that method: establishing scope, context and criteria, assessing risk through identification, analysis and evaluation, and treating it. One risk approach can hence serve several management systems.

Which credential suits a risk officer and which a head of risk?

A risk officer applying the process day to day fits the ISO 31000 Risk Manager credential. A head of risk designing and leading the framework fits the Lead Risk Manager credential.

Is ISO 31000 being revised?

Yes. On 23 October 2026, iso.org showed the 2018 edition at stage 90.92, meaning it is to be revised, with ISO/CD 31000 under development at committee stage. No expected publication date has been given, so the 2018 edition, confirmed in 2023, remains the current text.

References

International Organization for Standardization (2021) ISO 37000:2021 Governance of organizations. Guidance. Geneva: ISO. Available at: https://www.iso.org/standard/65036.html (Accessed: 23 October 2026).

International Organization for Standardization (2018) ISO 31000:2018 Risk management. Guidelines. Geneva: ISO. Available at: https://www.iso.org/standard/65694.html (Accessed: 23 October 2026).

International Electrotechnical Commission and International Organization for Standardization (2019) IEC 31010:2019 Risk management. Risk assessment techniques. Geneva: ISO. Available at: https://www.iso.org/standard/72140.html (Accessed: 23 October 2026).

International Organization for Standardization (2022) ISO 31073:2022 Risk management. Vocabulary. Geneva: ISO. Available at: https://www.iso.org/standard/79637.html (Accessed: 23 October 2026).

International Organization for Standardization (no date) ISO/TC 262 Risk management. Available at: https://www.iso.org/committee/629121.html (Accessed: 23 October 2026).