Put ISO 31000 risk management into daily practice

ISO 31000 is the international standard that provides guidelines for managing risk. Published by ISO, the current edition is ISO 31000:2018. It describes eight principles, a framework for integrating risk management into governance and operations, and a process for identifying, analysing, evaluating, treating, monitoring and reporting risk. It applies to any type of risk in any organisation and is not specific to an industry or sector.

No. ISO 31000 is a set of guidelines, not a requirements standard, so it is not intended for certification. Organisations use it to design and improve their risk management approach. If you need a certificate, management system standards such as ISO 27001 require a risk assessment and treatment process, and ISO 31000 is a widely used reference when designing that process.

Any organisation that wants a structured, consistent way of managing risk can use ISO 31000. It is voluntary and suits organisations of every size and sector. Boards, risk managers, internal audit and compliance teams commonly use it as the basis for enterprise risk management, risk appetite statements and risk registers, and to give a shared vocabulary for discussing risk across the business.

ISO 31000:2018 has three core parts. Clause 4 sets out the principles, with value creation and protection at the centre. Clause 5 describes the framework: leadership and commitment, integration, design, implementation, evaluation and improvement. Clause 6 describes the process: communication and consultation, scope, context and criteria, risk assessment, risk treatment, monitoring and review, and recording and reporting.

ISO 31000 provides general risk management guidance, while ISO 27001 is a certifiable standard for information security management systems. ISO 27001 requires organisations to assess and treat information security risks, and the ISO 31000 process of identification, analysis, evaluation and treatment is a common basis for that method. Using both lets information security risk sit within a wider enterprise risk approach.

ISO 31000:2018 replaced the 2009 edition with a shorter, simpler text. It places more emphasis on leadership by top management and on integrating risk management into all organisational activities. It reworked the principles and framework, and highlights the iterative nature of risk management, with the organisation's context and learning shaping how the process and framework are updated over time.

Start by securing leadership commitment and defining the scope, context and risk criteria, including risk appetite. Then identify, analyse and evaluate risks, choose treatment options and record treatment plans. Assign owners, monitor and review risks and controls regularly, and report results to decision makers. Because ISO 31000 is guidance, you adapt each step to your organisation's size and complexity.

Yes. OneClickComply supports ISO 31000 today. OneClickComply's risk register, control mapping, continuous monitoring and policy generation support the ISO 31000 process, and our in-house auditors can advise on applying it. As ISO 31000 is guidance, OneClickComply helps you apply it consistently rather than providing a certificate.