Run structured ISO 31010 risk assessments without the spreadsheets

ISO 31010 is an international standard, published jointly by IEC and ISO, that gives guidance on selecting and applying techniques for risk assessment. It supports ISO 31000 by explaining how risk identification, analysis and evaluation fit into the risk management process, and Annex B describes 31 techniques such as brainstorming, HAZOP, fault tree analysis, bow tie analysis and Monte Carlo simulation. The 2009 edition was replaced by IEC 31010:2019.

No. ISO 31010 is voluntary guidance, and the 2009 edition states that it is not intended for certification, regulatory or contractual use. Organisations use it to choose and justify risk assessment methods. However, a regulator, customer or auditor may expect a documented and repeatable risk assessment methodology, and ISO 31010 is a recognised reference for building one.

No. There is no certification scheme for ISO 31010 because it is a guidance standard, not a requirements standard. The 2009 edition explicitly says it is not intended for certification. Organisations that want certification usually certify a management system such as ISO 27001 or ISO 22301, and use ISO 31010 techniques to carry out the risk assessments those standards require.

ISO 31000 sets out the principles, framework and process for managing risk, while ISO 31010 focuses on one part of that process: risk assessment. ISO 31010 explains how to identify, analyse and evaluate risk and how to choose a suitable technique, taking into account resources, uncertainty and complexity. In short, ISO 31000 tells you what risk management involves and ISO 31010 helps you choose how to assess risk.

No. IEC/ISO 31010:2009 was withdrawn on 13 June 2019 and replaced by IEC 31010:2019, which restructures the guidance and revises the set of techniques. Assessments based on the 2009 edition remain useful, but organisations starting new work should refer to the 2019 edition. The 2009 clause numbering does not carry over directly to the newer edition.

ISO 27001 requires an information security risk assessment process but does not prescribe a specific technique. ISO 31010 can help you choose and document that technique, for example a consequence and likelihood matrix, scenario analysis or bow tie analysis. Using ISO 31010 does not by itself satisfy ISO 27001, but it gives your risk assessment methodology a recognised basis that auditors can follow.

Annex B of ISO 31010:2009 describes 31 techniques. They include look-up and supporting methods such as brainstorming, structured interviews, Delphi and checklists; analysis methods such as HAZOP, FMEA, fault tree analysis, event tree analysis, bow tie analysis and Markov analysis; and statistical methods such as Monte Carlo simulation and Bayesian analysis. Annex A compares how well each applies to identification, analysis and evaluation.

Yes. OneClickComply supports ISO 31010 today. You can use OneClickComply's risk register, control mapping and continuous monitoring to run structured risk assessments, and our audit team can advise on applying ISO 31010 techniques alongside frameworks such as ISO 27001 so your risk work stays consistent.