ISO 31000: ISO 31000 – Tutorial (about 60 minutes)

ISO 31000 is the international guideline for managing risk in any organisation: a set of principles, a framework for building risk management into how the organisation is led and run, and a repeatable process for finding, understanding and dealing with risks. Boards, executives, project managers, engineers, security and compliance teams, public bodies and charities use it as a common language for uncertainty, and many other standards build their own risk methods on it. After this tutorial you will be able to explain what ISO 31000 is (and is not), use its vocabulary correctly, describe its principles, framework and process, run a basic risk assessment and treatment cycle, and judge how well an organisation applies the guidance.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 31000:2018, Risk management — Guidelines, the second edition, published in February 2018 by ISO technical committee ISO/TC 262 (Risk management). It replaced the first edition, ISO 31000:2009, and ISO's catalogue records that it was reviewed and confirmed in 2023, so it remains valid. A third edition is being developed by ISO/TC 262 working group 10 (WG10) under the project name ISO/CD 31000 (ISO project 88574). The committee draft (CD) stage is complete: national standards bodies that mirror the ISO project list it at stage 30.99, "CD approved for registration as DIS", since 26 October 2026, and the committee reported in October 2026 that it is preparing the draft international standard (DIS), with publication of the new edition planned for 2028. No new edition has been published, and its final content may still change. This tutorial teaches the 2018 edition, which is what organisations use today. Verified 2026-10-29 from the ISO/TC 262 news pages, the ISO project record as mirrored by national standards bodies, and ISO's catalogue status as reported by secondary sources (the ISO catalogue itself blocks automated access).

Who this is for: engineers, IT service and operations staff, project and programme managers, security, quality, safety and compliance professionals, internal auditors, finance people and managers who have been asked to "do risk management the ISO 31000 way" and want to understand what that actually means. It is also useful if you work with a management-system standard such as ISO 9001, ISO/IEC 27001 or ISO 22301 and want a sound method for the risk parts of those standards.

Prerequisites: none. A general idea of how an organisation sets objectives, makes decisions and runs projects helps, but every risk term is explained when it first appears. No statistics or mathematics are needed.

By the end of this tutorial:

You will be able to explain the purpose of ISO 31000 and why it is a guidance document rather than a set of certifiable requirements.
You will be able to define the core vocabulary, including risk, risk source, event, consequence, likelihood, control and risk criteria.
You will be able to describe the eight principles, the five framework components around leadership and commitment, and the steps of the risk management process.
You will be able to carry out a simple risk assessment and choose and plan suitable risk treatment, including for opportunities.
You will be able to explain how organisations evaluate their risk management against ISO 31000, given that no certification of organisations exists.
You will be able to relate ISO 31000 to companion documents such as ISO 31073 and IEC 31010 and to frameworks such as COSO ERM and ISO/IEC 27005.

Lesson 1 – Origins, purpose and scope

Why a risk management guideline exists

Every organisation works towards objectives: deliver a product on time, keep patients safe, stay within budget, protect customer data, grow in a new market. Every one of those objectives is exposed to uncertainty. Suppliers fail, regulations change, staff leave, systems break, competitors move, and sometimes events turn out better than expected. Risk management is the deliberate, coordinated effort to understand that uncertainty and to act on it so that the organisation is more likely to achieve what it set out to do.

Before ISO 31000, many organisations had several unconnected approaches. Finance used one vocabulary for financial risk, engineering used another for hazards, IT security used a third, and project managers kept their own risk logs. Results could not be compared or combined, and senior managers struggled to see the organisation's real exposure. A single, generic guideline that any discipline could adopt solves this: it gives a shared language and a shared logic, while leaving room for each area to use its own techniques.

From AS/NZS 4360 to ISO 31000

ISO 31000 grew out of the Australian and New Zealand standard AS/NZS 4360, first published in 1995 and revised in 1999 and 2004, which had become widely used internationally. ISO built on that work and published the first edition, ISO 31000:2009, together with a revised vocabulary guide. The 2009 edition introduced the now familiar idea of three linked elements: principles, a framework and a process.

The 2018 revision kept that idea but made the text shorter and clearer. According to its foreword, the main changes were a review of the principles, now presented as the key criteria for success (the 2009 edition listed eleven principles; the 2018 edition has eight); a stronger emphasis on leadership by top management and on integrating risk management into the organisation, starting with governance; more attention to the iterative nature of risk management, in which new experience and knowledge feed back into the process; and streamlined content based on an open-systems view, so the guidance fits many different contexts.

Scope: who and what it covers

ISO 31000 is deliberately generic. It is meant for any organisation, public or private, large or small, of any sector, and for any activity, including strategic and operational decisions, projects, functions, products, services and assets. It can be applied at every level, from a board deciding on an acquisition to a team planning a software release. It does not belong to any industry and does not prescribe techniques, scales, software or forms. That breadth is both its strength and the reason beginners sometimes find it abstract: it tells you what good risk management looks like and how to organise it, not exactly which spreadsheet to fill in.

A guideline, not a requirements standard

The title says "Guidelines", and that word matters. ISO standards that contain requirements use "shall" and can be audited for conformity; ISO 9001 and ISO/IEC 27001 are examples. ISO 31000 uses "should" and "can": it recommends rather than requires. ISO states clearly that it is not intended for certification purposes. Organisations therefore do not get "ISO 31000 certified"; they align their practice with it, and they may have that alignment reviewed, as Lesson 5 explains. Keep this in mind whenever a vendor or consultant mentions an "ISO 31000 certificate" for a company.

What ISO 31000 is trying to achieve

The purpose of risk management, in ISO 31000's view, is the creation and protection of value. Risk management is not only about preventing losses. It improves performance, encourages innovation and supports the achievement of objectives. A team that understands its risks can take bolder decisions with confidence, because it knows what could go wrong and what it will do about it. This positive framing is one of the most important ideas to carry through the rest of the course.

Lesson 2 – Key concepts and vocabulary

Clear vocabulary is half the value of ISO 31000. When two departments use the same words for the same things, they can compare risks, combine them and escalate them sensibly. Clause 3 of the standard defines a small set of terms; the wider risk vocabulary is maintained in ISO 31073:2022 (Risk management — Vocabulary), which replaced the older ISO Guide 73. The definitions below are explained in plain words, not quoted from the standard.

Risk – ISO 31000 defines risk in five words as the "effect of uncertainty on objectives". An effect is a deviation from what was expected, and it can be positive, negative or both. Risk is therefore always tied to an objective: no objective, no risk.
Uncertainty – the state of having incomplete knowledge or understanding about an event, its consequence or its likelihood. Uncertainty is the raw material of risk; the objective gives it meaning.
Objective – something the organisation is trying to achieve. Objectives can be strategic, financial, operational, safety-related, environmental or about a project, and they exist at different levels.
Risk source – an element that, alone or combined with others, has the potential to give rise to risk. A legacy server with no vendor support, an inexperienced team or a volatile exchange rate can all be risk sources.
Event – the occurrence or change of a particular set of circumstances. An event can be one occurrence or several, can have several causes and consequences, and can even be something expected that does not happen.
Consequence – the outcome of an event that affects objectives. Consequences can be certain or uncertain, positive or negative, direct or indirect, and they can escalate through knock-on effects.
Likelihood – the chance of something happening, however it is described: in words, as a frequency, or as a probability. ISO 31000 prefers "likelihood" because in English "probability" is often read narrowly as a mathematical term.
Control – a measure that maintains or modifies risk. Controls include processes, policies, devices, practices and other actions. A control does not always work as intended, which is why its effectiveness must be checked.
Stakeholder – a person or organisation that can affect, be affected by, or perceive itself to be affected by a decision or activity. Customers, staff, regulators, suppliers, investors and local communities are typical stakeholders.
Risk management – the coordinated activities to direct and control an organisation with regard to risk. It covers both the arrangements (the framework) and the day-to-day work (the process).
Risk criteria – the terms of reference against which the significance of a risk is judged. They express how much and what type of risk the organisation is willing to take, and they come from its objectives, values, obligations and stakeholders' views.
Level of risk – the magnitude of a risk, usually expressed as a combination of consequences and their likelihood. Many organisations show it on a matrix, but ISO 31000 does not require any particular format.
Residual risk – the risk that remains after treatment. It can include risks that nobody has identified, so it must itself be understood, recorded and accepted or treated further.
Risk owner – a widely used practical term, also found in the risk vocabulary, for the person or entity with the accountability and authority to manage a particular risk.

How the terms fit together

The terms form a chain. A risk source can lead to an event; the event has consequences for an objective; each consequence has a likelihood; controls already in place change either the likelihood or the consequences; and the combination gives a level of risk that you compare against your risk criteria. ISO 31000 notes that risk is usually expressed in exactly these terms. When you write a risk description, try to name all the links: "Because our payment gateway depends on a single supplier (source), a supplier outage (event) could stop customer payments for several hours (consequence), reducing revenue and damaging trust (effect on objectives)."

Positive and negative effects

Because risk is a deviation from what is expected, the same uncertainty can produce gains as well as losses. A delayed regulation could cost money for a company that has already invested, or save money for one that has not. A new market could fail or exceed expectations. ISO 31000 does not separate "threats" and "opportunities" into two different systems; it asks you to consider both when you identify and treat risk. In practice many organisations keep negative risks and opportunities in the same register with different scales for consequences.

Risk appetite and tolerance

You will hear the terms risk appetite (the amount and type of risk an organisation is willing to pursue or retain) and risk tolerance (readiness to bear a risk after treatment). ISO 31000:2018 does not build its guidance around these words; it captures the same idea in risk criteria, which state how much and what type of risk the organisation will take. Frameworks such as COSO ERM use the appetite language heavily. When you work in an organisation that uses both, make sure the appetite statements and the risk criteria say the same thing.

Lesson 3 – Structure of the standard

The 2018 edition is short and easy to navigate. After the introduction and the three opening clauses (scope, normative references, and terms and definitions), the content sits in three main clauses that correspond to the three elements of ISO 31000.

Figure 1 – The three elements of ISO 31000: principles guide the framework, the framework enables the process, and lessons from the process improve the framework.

Clause 4 – Principles

The principles describe the characteristics of effective and efficient risk management. They sit around the central purpose of creating and protecting value, and they are meant to be used when designing the framework and when checking whether risk management actually works. Here they are, paraphrased:

Integrated – risk management is part of all organisational activities, not a separate exercise.
Structured and comprehensive – a systematic, complete approach gives consistent and comparable results.
Customized – the framework and process are tailored to the organisation's own context and objectives.
Inclusive – stakeholders are involved appropriately and in good time, so their knowledge, views and perceptions are considered.
Dynamic – risks emerge, change or disappear as the context changes, and risk management anticipates, detects and responds to those changes.
Best available information – inputs come from historical and current information and from expectations about the future, with their limitations and uncertainties made explicit.
Human and cultural factors – people's behaviour and the organisation's culture strongly influence every part of risk management.
Continual improvement – risk management gets better through learning and experience.

Think of the principles as design criteria and as a checklist for honest self-assessment. If your risk register is updated once a year, you are not dynamic. If only the risk team ever sees it, you are not inclusive. If your matrix was copied from another company, you may not be customised.

Clause 5 – Framework

The framework is the set of organisational arrangements that make risk management possible and keep it working: leadership, accountability, resources, policies, communication and the cycle of design, implementation, evaluation and improvement. ISO 31000 places leadership and commitment at the centre and arranges five components around it: integration, design, implementation, evaluation and improvement.

Figure 2 – The framework: top management leadership drives a cycle of integrating, designing, implementing, evaluating and improving risk management.

Leadership and commitment – top management and oversight bodies make sure risk management is integrated, issue a policy or statement, assign authority and accountability, provide resources and make sure the framework stays appropriate.
Integration – risk management becomes part of the organisation's purpose, governance, leadership, strategy, objectives and operations. The standard stresses that integration depends on understanding how the organisation is actually structured and governed.
Design – understanding the external and internal context, articulating the commitment, assigning roles and accountabilities, allocating resources, and establishing how communication and consultation will work.
Implementation – putting the design into practice with a plan that sets time and resources, identifies where and how decisions are made, and adjusts decision processes where needed.
Evaluation – periodically measuring the framework's performance against its purpose, plans, indicators and expected behaviour, and checking that it remains suitable for the organisation's objectives.
Improvement – adapting the framework to internal and external changes and continually improving its suitability, adequacy and effectiveness.

Notice that the framework is a cycle much like Plan-Do-Check-Act, but ISO 31000 does not use those labels or the Harmonized Structure clauses of management-system standards. That makes it easy to combine with a management-system standard without duplicating paperwork.

Clause 6 – Process

The process applies the organisation's policies, procedures and practices in a systematic way to every risk activity: talking with stakeholders, setting the context, assessing and treating risk, and keeping the work monitored, reviewed, recorded and reported. It is meant to be an integral part of management and decision-making, not a separate procedure run by specialists. Lesson 4 walks through it step by step. Its sub-clauses are:

6.2 Communication and consultation
6.3 Scope, context and criteria
6.4 Risk assessment (6.4.2 identification, 6.4.3 analysis, 6.4.4 evaluation)
6.5 Risk treatment (selecting options, preparing and implementing treatment plans)
6.6 Monitoring and review
6.7 Recording and reporting

The standard emphasises that although the process is described as a sequence, in practice it is iterative: you will return to earlier steps as you learn more, and different parts run at the same time.

Lesson 4 – How it works in practice

This lesson follows the risk management process from start to finish and explains what each step produces. Treat the sequence as a guide: real risk work loops, overlaps and is repeated whenever circumstances change.

Figure 3 – The ISO 31000 risk management process: context and criteria lead into assessment and treatment, surrounded by communication, monitoring and reporting.

Step 1 – Communication and consultation

Communication shares information so people understand risk and the reasons for decisions; consultation gathers information and views before a decision. Both run throughout the process, not only at the end. Good consultation brings different areas of expertise together, makes sure the views of stakeholders are considered when criteria are set and risks evaluated, and builds a sense of ownership among those who must carry out treatment. In practice this means workshops with the people who do the work, interviews with experts, briefings for decision-makers and clear, honest messages for staff and customers.

Step 2 – Scope, context and criteria

Before identifying anything, agree what you are looking at and how you will judge it. The scope states the activity, decisions and objectives covered, the time horizon, the tools and techniques to use, the resources and responsibilities, and the records to keep. The external and internal context describes the environment in which the organisation pursues its objectives: regulation, markets, technology, stakeholders, culture, capabilities, contracts and dependencies.

The risk criteria are the most neglected part of this step. They should say how consequences and likelihood will be described and measured, how the level of risk will be determined, how several risks combined will be considered, and what levels require action or escalation. Criteria come from the organisation's values, objectives, resources and obligations, and from stakeholders' views. They are set at the start but must be reviewed as the work proceeds. Without agreed criteria, two analysts can rate the same risk completely differently and nobody can say who is right.

Step 3 – Risk assessment

Risk assessment is the overall process of identification, analysis and evaluation. ISO 31000 asks that it is done systematically, iteratively and collaboratively, using the knowledge and views of stakeholders and the best available information.

Risk identification finds, recognises and describes risks that might help or prevent the organisation from achieving its objectives. Relevant, current information matters. Look widely: sources and causes you can see and those you cannot, possible gains as well as losses, weaknesses and strengths, changes in the context and early signs of new risks, what your assets are worth, how events would affect objectives, how far you can trust the information you have, and how timing matters. Typical techniques include structured workshops, checklists from previous incidents, process walkthroughs, interviews, scenario analysis and techniques catalogued in IEC 31010. The output is a list of well-described risks, each linked to the objective it affects. A risk should be identified whether or not its source is under the organisation's control.

Risk analysis builds understanding of each risk's nature and characteristics, including its level where appropriate. It looks at uncertainties, risk sources, consequences, likelihood, events, scenarios, controls and how effective those controls are. In practice that means asking how likely the events and their outcomes are, how bad and how widespread the outcomes could be, how interconnected and fast-changing the situation is, whether the existing controls really work, and how much confidence the results deserve. Analysis can be qualitative (descriptive scales), quantitative (numbers, models, simulations) or a combination. Divergent opinions, biases and the quality of information should be recorded, because they affect how far the results can be trusted.

Risk evaluation supports decisions by comparing the results of analysis with the risk criteria to decide where action is needed. The outcomes can be: do nothing further; consider treatment options; undertake further analysis to understand the risk better; keep existing controls in place; or reconsider the objectives. Decisions take account of the wider context and the actual and perceived consequences for stakeholders. Evaluation results are recorded, communicated and validated at the right level of the organisation.

Step 4 – Risk treatment

Risk treatment selects and implements options for addressing risk. It is iterative: formulate and select options, plan and implement them, assess whether they worked, decide whether the remaining risk is acceptable, and if not, take further treatment.

Figure 4 – Risk treatment is a loop: options are chosen and implemented until the residual risk is acceptable against the criteria.

ISO 31000 lists treatment options that are not mutually exclusive and are often combined:

avoiding the risk by deciding not to start or continue the activity that gives rise to it;
taking or increasing the risk in order to pursue an opportunity;
removing the risk source;
changing the likelihood;
changing the consequences;
sharing the risk, for example through contracts or by buying insurance;
retaining the risk by an informed decision.

Two points deserve attention. First, "taking or increasing risk" is a legitimate treatment: if a risk is really an opportunity, the right response may be to invest more in it. Second, sharing a risk does not share accountability. Insurance can pay for a loss, and a contract can oblige a supplier to act, but the organisation is still accountable to its customers and regulators for the outcome, and the sharing arrangement can create new risks of its own (for example, the insurer refusing a claim).

Selecting options means balancing the potential benefits for objectives against costs, effort and disadvantages, and taking account of obligations, voluntary commitments and stakeholders' views. Some treatments are justified even when they are not economically optimal, for example to protect life or meet a legal duty. Treatment can also introduce new risks, which must be identified and managed. Decision-makers and stakeholders should be told about the nature and extent of the residual risk.

A treatment plan states why the options were chosen and the expected benefits, who is accountable for approving and implementing it, the actions, resources and constraints, performance measures, monitoring and reporting arrangements, and when actions are expected to start and finish. Treatment plans should be integrated into the organisation's normal management processes, such as project plans, budgets and change management, rather than living in a separate spreadsheet.

Step 5 – Monitoring and review

Monitoring and review assure and improve the quality and effectiveness of the process design, implementation and outcomes. They include ongoing monitoring (for example, key risk indicators on a dashboard), periodic review (quarterly risk reviews), and checks after incidents and changes. Responsibilities should be clearly defined. Results feed back into the context, the criteria, the risk assessments and the treatment plans; this is where the dynamic principle comes to life.

Step 6 – Recording and reporting

Documenting and reporting the process and its results lets people across the organisation see what was done and found, gives decision-makers the information they need, helps the risk work improve, and supports the people who oversee it. What to record, and how long to keep it, depends on how the information will be used, how sensitive it is, and the context. Reporting is part of governance and should be tailored to each audience: a board needs a concise view of the most significant risks and trends, while a team needs the detail of its own actions. Typical artefacts are a risk policy, risk criteria, a risk register, treatment plans and periodic risk reports, but ISO 31000 does not mandate any particular document.

Roles in practice

ISO 31000 asks top management to assign authority, responsibility and accountability at appropriate levels, but does not prescribe titles. Common practice is: the governing body sets direction and oversees; top management owns the framework and the most significant risks; risk owners in the business manage individual risks; a small risk function coordinates, provides methods and challenges assessments; and internal audit gives independent assurance. Many organisations describe this split as "three lines", a model published by the Institute of Internal Auditors, which fits well alongside ISO 31000.

Lesson 5 – Assessment, certification and compliance

No certification of organisations

Because ISO 31000 is a guideline, there is no accredited certification scheme for organisations against it. An accredited certification body cannot issue an ISO 31000 management-system certificate in the way it does for ISO 9001 or ISO/IEC 27001. If a company claims to be "ISO 31000 certified", ask what was actually assessed and by whom; usually the honest claim is that its risk management is "aligned with" or "based on" ISO 31000, perhaps confirmed by an independent review.

How organisations evaluate their risk management

The lack of certification does not mean the lack of assessment. The framework itself requires evaluation, and organisations use several approaches:

Self-assessment against the principles and framework – a structured questionnaire or workshop asking, for each principle and component, what evidence shows it is in place and working.
Internal audit – internal auditors review the design and effectiveness of the framework and process, test samples of risk assessments and treatment plans, and report to the audit committee or board.
Maturity assessment – a maturity model rates risk management from basic to advanced on several dimensions, giving a roadmap for improvement. ISO 31000 has no official maturity levels; models come from professional bodies, consultancies or the organisation itself.
Independent external review – a consultancy or another qualified party gives an opinion on alignment with ISO 31000, often before a major change or at the request of a board.
Regulatory and contractual oversight – some regulators and public-sector policies reference ISO 31000 as good practice, and supervisors may examine whether a regulated firm's risk arrangements are adequate.

What an evaluator looks for

A good evaluation goes beyond the existence of documents. Evaluators ask whether top management actually uses risk information in decisions; whether risk criteria are defined, approved and used consistently; whether risk descriptions link sources, events, consequences and objectives; whether existing controls are tested rather than assumed effective; whether treatment plans have owners, dates and resources and are tracked; whether risks are reviewed when the context changes; whether stakeholders are consulted; and whether lessons from incidents and near-misses lead to improvement. Each of these maps back to a principle, a framework component or a process step, which makes ISO 31000 a convenient assessment yardstick.

Certification of people

Separate from organisations, several training and personnel-certification bodies, such as PECB and the G31000 Risk Institute, offer courses and certificates for individuals (for example, risk manager or lead risk manager titles) based on ISO 31000. These certify a person's knowledge, not the organisation's practice, and they are not issued by ISO. Check the scheme owner, the exam format and whether the certificate needs renewal before choosing one.

ISO 31000 inside certifiable standards

Many certifiable management-system standards require the organisation to address risks and opportunities. ISO 9001 talks about risk-based thinking; ISO/IEC 27001 requires an information security risk assessment and treatment process; ISO 22301 requires a risk assessment for business continuity; ISO 45001 and ISO 14001 require their own risk and opportunity processes. None of them requires ISO 31000, but ISO 31000 is a common and well-accepted method for meeting those requirements. In such audits, the certification body checks the requirements of the certifiable standard; your ISO 31000-based method is the evidence you present.

Lesson 6 – Worked example

To tie the lessons together, follow a fictional company, Kestrel Bookings, a software-as-a-service provider with about 450 staff. Kestrel runs an online appointment-booking platform used by around 2,000 clinics in three countries. Its strategic objectives for the next two years are to keep platform availability at 99.95 %, enter a fourth country, and pass a demanding customer security review. The new chief executive has asked for risk management "along ISO 31000 lines" after a long outage last year surprised the board.

Step 1 – Leadership and commitment

The board approves a two-page risk management policy. It states why Kestrel manages risk (to protect clinics and patients who rely on the service and to support growth), who is accountable (the chief executive for the framework, executives as risk owners for their areas), and how often the board will review the top risks (quarterly). The board names the chief operating officer as the executive sponsor and funds a part-time risk coordinator. This is the leadership and commitment at the centre of the framework.

Step 2 – Integration and design

Instead of creating a separate risk calendar, Kestrel attaches risk work to existing rhythms: quarterly business reviews, the annual strategy and budget cycle, the product roadmap, architecture reviews and the change advisory board. The coordinator maps the context: external factors (health-data regulation in each country, a dependence on one cloud provider, competitors offering cheaper booking tools, a tight labour market for engineers) and internal factors (fast growth, a small security team, a strong engineering culture that dislikes paperwork).

The executives agree risk criteria. Consequences are rated on a five-point scale across four dimensions: clinic and patient impact, financial impact, regulatory impact and reputation. Likelihood uses a five-point scale with plain-language descriptions and indicative frequencies. The criteria state that any risk with a "major" or "severe" consequence for patients needs an executive owner and a treatment plan regardless of likelihood, that risks above a stated level go to the board, and that opportunities use the same likelihood scale with a separate benefit scale.

Step 3 – Risk identification

The coordinator runs four short workshops with engineers, support staff, sales, finance and legal, plus interviews with two large clinic customers. Each risk is written as a chain from source to effect. Among the twenty-six risks identified are:

R1 – Because the platform runs in a single cloud region, a regional outage could stop bookings for all clinics for several hours, breaching availability commitments and harming patients who miss care.
R2 – Because privileged access to production is broad and poorly reviewed, a compromised engineer account could lead to a breach of patient appointment data, triggering regulatory action.
R3 – Because two senior engineers hold most knowledge of the billing system, their departure could delay invoicing and new-country pricing.
O1 – Because a large hospital group in the fourth country is unhappy with its current supplier, an early partnership could accelerate market entry and revenue.

Step 4 – Risk analysis and evaluation

For each risk, the risk owner and the coordinator review existing controls and how well they work. For R1, the team finds that automated backups exist but restoring into another region has never been tested, so the control is weaker than assumed. They rate the consequence for clinics as major and the likelihood as possible, giving a level above the board threshold. For R2, a recent access review shows forty engineers with standing production access; the consequence is severe for patients and regulators, the likelihood possible. R3 is moderate. O1 is likely and would bring a significant benefit.

The team records that confidence in the R1 rating is limited because the cloud provider's own figures are general, and it notes a disagreement: operations staff rate the likelihood higher than the product team. Rather than averaging the views away, the coordinator records both and asks for a short analysis of last year's outage reports. Evaluation against the criteria puts R1 and R2 on the board's list, R3 in the executive register with a treatment plan, and O1 on the board's list as an opportunity to pursue.

Step 5 – Risk treatment

For R1, the chief technology officer, as risk owner, considers several options: accept the current exposure (rejected, since it breaks the criteria), move to an active-active multi-region design (strong but expensive and slow), or set up warm standby in a second region with tested failover and a clinic communication plan (cheaper, faster, reduces consequences). Kestrel chooses the warm-standby option, which mainly changes the consequences, and also renegotiates its cloud contract to obtain service credits, which shares some of the financial effect. The treatment plan names the owner, budget, milestones, a quarterly failover test as the performance measure, and a reporting line to the quarterly business review.

For R2, the security lead removes standing production access, introduces just-in-time privileged access with approval and logging, and adds phishing-resistant multi-factor authentication. These actions change the likelihood. Because the change could slow incident response, the team identifies a new risk (delayed emergency fixes) and treats it with a documented break-glass procedure. For R3, the engineering manager pairs junior engineers with the two experts and documents the billing system. For O1, the board decides to take more risk: it approves an early pilot with the hospital group, with a clear exit clause, an extra data-protection review and a budget ceiling.

Step 6 – Monitoring, review and reporting

Kestrel adds four key risk indicators to its operations dashboard: time since last successful failover test, number of staff with standing production access, open treatment actions past due, and single-person knowledge areas. The quarterly business review covers the top risks and the status of treatment plans; the board receives a two-page summary of the significant risks, their trends and the residual risk it is being asked to accept. Six months later the first failover test reveals a configuration gap, which is fixed and logged as a lesson learned; the R1 rating is updated. When the fourth country publishes new data-residency rules, the context and O1 are reassessed within two weeks.

Step 7 – Evaluating and improving the framework

After a year, internal audit reviews the framework against ISO 31000's principles. It finds good integration with planning and change management and good leadership support, but weak inclusion of customer-support staff, inconsistent use of the opportunity scale, and some treatment plans without measurable outcomes. Kestrel adds a support representative to quarterly reviews, gives a short training session on writing risk descriptions and measures, and simplifies the opportunity scale. Kestrel does not seek certification, because none exists; it tells its customers that its risk management is aligned with ISO 31000 and was independently reviewed by internal audit, and it uses the same method to support its ISO/IEC 27001 risk assessment for the customer security review.

Lesson 7 – Relationship to other standards and frameworks

ISO 31000 sits at the centre of a family of risk documents and is referenced by many other standards. Understanding these relationships helps you avoid duplication and pick the right tool for a job.

Figure 5 – ISO 31000 draws on a shared vocabulary and catalogue of techniques, and underpins specialised guidance and the risk parts of certifiable management systems.

The ISO 31000 family

ISO 31073:2022 provides the risk management vocabulary and replaced ISO Guide 73:2009. IEC 31010:2019 describes a wide range of risk assessment techniques, such as structured interviews, checklists, scenario analysis, bow-tie analysis, failure modes and effects analysis, fault tree analysis and Monte Carlo simulation, and helps you choose among them; ISO 31000 tells you what to achieve, IEC 31010 offers ways to do it. ISO/TC 262 has also published topic guidance that applies ISO 31000 to particular areas, including legal risk (ISO 31022), travel risk (ISO 31030) and emerging risks and resilience (ISO 31050).

Comparison with related standards and frameworks

Standard or framework	Owner	Type	Focus	Relationship to ISO 31000
ISO 31000:2018	ISO (TC 262)	Guideline, not certifiable	Generic risk management for any organisation and activity	The reference point
IEC 31010:2019	IEC and ISO	Guidance on techniques	How to choose and use risk assessment techniques	Supports the assessment step of the ISO 31000 process
ISO/IEC 27005:2022	ISO and IEC	Guidance	Information security risk management	Applies ISO 31000 concepts to information security and supports the ISO/IEC 27001 risk requirements
COSO ERM (2017)	COSO	Framework, not certifiable	Enterprise risk management integrated with strategy and performance, five components and twenty principles	Similar aims; stronger focus on strategy, appetite and governance; many organisations map one to the other
ISO 22301:2019	ISO	Requirements, certifiable	Business continuity management systems	Requires business-continuity risk assessment; ISO 31000 is a common method for it
ISO 9001:2026	ISO	Requirements, certifiable	Quality management systems	Requires actions to address risks and opportunities without prescribing a method; ISO 31000 can provide one
NIST Risk Management Framework (SP 800-37)	NIST	Framework for information systems	Security and privacy risk for systems, with defined steps from preparation to continuous monitoring	Narrower scope and more prescriptive; compatible in logic

Choosing between them

Use ISO 31000 as the umbrella method and language for the whole organisation. Use IEC 31010 when you need a specific technique. Use domain guidance such as ISO/IEC 27005 when a specialised area needs more detail, keeping the same criteria and vocabulary so that results can be rolled up. If your board already uses COSO ERM, you do not need to choose: the two are broadly compatible, and you can map COSO's appetite and governance language to ISO 31000's criteria and framework. When you implement a certifiable management-system standard, use your ISO 31000 process to meet its risk requirements rather than inventing a second method.

Looking ahead

The revision currently under way at ISO/TC 262 grew out of a committee task group (TG5) whose findings, published by ISO/TC 262 in August 2024, called for more guidance on the principles, on implementing the framework and building a risk-aware culture, on topics such as risk appetite, metrics, control effectiveness, opportunities and emerging risks, and for practical examples. Those are recommendations for the drafting work, not confirmed content of the next edition. The core ideas of this course (risk as the effect of uncertainty on objectives, principles, framework and process) are very likely to remain, but check the published text when the third edition appears.

Common pitfalls and best practices

Common pitfalls

Risk management as a side project – a risk register maintained by a specialist and reviewed once a year, unconnected to strategy, budgets, projects or change decisions. It looks compliant and changes nothing.
No agreed risk criteria – teams score risks on a matrix without shared definitions, so ratings are inconsistent and escalation is arbitrary.
Vague risk descriptions – single words such as "cyber" or "staff" instead of a clear chain from source to event to consequence to objective, which makes analysis and treatment impossible.
Assuming controls work – listing controls without testing them, as in an untested backup restore, which leads to an understated level of risk.
Ignoring opportunities – treating risk management only as loss prevention and missing the chance to pursue favourable uncertainty deliberately.
Treating insurance or outsourcing as making the risk disappear – forgetting that accountability stays with the organisation and that the arrangement itself creates new risks.
Claiming certification – advertising an "ISO 31000 certificate" for the organisation, which misleads customers and damages credibility with informed reviewers.

Best practices

Start with leadership – get top management to approve a short policy, set criteria and use risk information in real decisions before building elaborate tools.
Attach risk work to existing processes – planning, budgeting, project gates, architecture reviews and change management, so that integration happens naturally.
Write risks as chains – source, event, consequence and affected objective in one or two sentences, with a named owner.
Test controls and treatments – measure effectiveness with indicators, drills and audits, and update ratings when tests reveal gaps.
Consult widely and early – include front-line staff and, where appropriate, customers and suppliers; record disagreements instead of hiding them.
Keep reporting short and audience-specific – a board summary of significant risks and trends, a detailed register for owners.
Evaluate and improve the framework itself – use the principles as a yardstick at least yearly, and act on what you find.

Summary and key takeaways

ISO 31000:2018 is the current edition of the international risk management guideline; a third edition is in development at ISO/TC 262 and has not yet been published.
It is guidance for any organisation and activity, written with "should" rather than "shall", and organisations cannot be certified against it.
Risk is the effect of uncertainty on objectives; effects can be positive or negative, and risk is described through sources, events, consequences and likelihood.
The standard has three linked elements: eight principles that serve value creation and protection, a framework centred on leadership and commitment, and an iterative process.
The process runs from scope, context and criteria through identification, analysis and evaluation to treatment, with communication, monitoring, review, recording and reporting throughout.
Treatment options include avoiding, taking or increasing risk for an opportunity, removing the source, changing likelihood or consequences, sharing and retaining; sharing never removes accountability.
Organisations assess their alignment through self-assessment, internal audit, maturity models and independent review; individuals can hold personnel certificates from training bodies.
ISO 31000 is the umbrella for IEC 31010, ISO/IEC 27005 and other specialised guidance, and a sound method for the risk requirements of certifiable standards.

Reflection questions

Pick one objective of your own team. Write two risks for it as full chains from source to effect, one negative and one positive, and say who should own each.
Does your organisation have written risk criteria? If not, what would you propose for consequence and likelihood scales, and who should approve them?
Which of the eight principles is weakest in your organisation today, and what evidence would convince an internal auditor that it had improved?
Choose a risk your organisation has insured or outsourced. What part of the risk and what accountability remain with you, and what new risks did the arrangement create?
Where in your existing planning, project or change processes could a short risk step be added so that risk management becomes integrated rather than a separate exercise?