IEC 31010: IEC 31010 – Tutorial (about 60 minutes)

IEC 31010 is the international guidance document that explains how to choose and use techniques for assessing risk, from simple brainstorming and checklists to fault trees, bow ties, Monte Carlo simulation and cost/benefit analysis. Risk managers, safety and reliability engineers, quality and compliance staff, project managers and analysts use it to pick a method that fits the decision in front of them instead of reaching for the same tool every time. After this tutorial you will be able to explain what IEC 31010 is and how it supports ISO 31000, describe how a risk assessment is planned, carried out and reviewed, recognise the main families of techniques, and justify a sensible choice of techniques for a real situation.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is IEC 31010:2019, Risk management — Risk assessment techniques, edition 2.0, published on 13 June 2019. It was prepared by IEC technical committee 56 (Dependability) together with ISO technical committee 262 (Risk management) and is published as a joint "double logo" IEC/ISO standard. It cancelled and replaced the first edition, IEC/ISO 31010:2009, which is withdrawn. The ISO catalogue records the 2019 edition at stage 90.60, meaning a systematic review was held and closed in September 2024, and the IEC webstore gives a stability date of 2027, the date until which the committee expects the content to stay unchanged; around then it decides whether to confirm, amend or revise the standard. No revision project or draft third edition has been published, so the 2019 edition is the one to use. Europe adopts it unchanged as EN IEC 31010:2019, and national standards bodies publish their own adoptions of the same text. Verified 2026-10-29 on the IEC webstore entry for IEC 31010:2019, the ISO catalogue entry and the publicly available preview of the standard.

Who this is for: engineers, operations and reliability staff, quality, safety, security and compliance professionals, internal auditors, project and programme managers and anyone who has been asked to "do a proper risk assessment" and wants to know which methods exist, what each is good for and how to run an assessment that a manager, auditor or regulator can trust. It is especially useful if you already work with ISO 31000 or a management-system standard such as ISO 9001, ISO 14001, ISO 45001 or ISO/IEC 27001 and need a sound method for the risk parts of those standards.

Prerequisites: none. A general idea of how organisations set objectives and make decisions helps. A few techniques involve probability, but this tutorial explains the ideas in plain words and no mathematics is required.

By the end of this tutorial:

You will be able to explain the purpose and scope of IEC 31010 and why it is guidance rather than a set of certifiable requirements.
You will be able to use its core vocabulary, including uncertainty, likelihood, consequence, control, model, verification and validation.
You will be able to describe the steps for implementing a risk assessment, from planning to recording and reporting.
You will be able to name the ten families of techniques in Annex B and give typical examples and uses of each.
You will be able to choose and combine techniques that fit the purpose, the available information and the resources of an assessment.
You will be able to judge the quality of a risk assessment and recognise common misuses such as over-reliance on risk matrices.
You will be able to relate IEC 31010 to ISO 31000, ISO 31073 and technique-specific standards such as those for FMEA, HAZOP and fault trees.

Lesson 1 – Origins, purpose and scope

Why a catalogue of techniques is needed

Every organisation makes decisions under uncertainty. Should a factory install a new production line? Is a software release safe to ship? Which supplier should a hospital trust with its sterile equipment? How much contingency does a construction project need? In each case people want to understand what could happen, how likely it is, how bad or good the outcome could be, and which option leaves them in the best position. Risk assessment is the work of answering those questions in a structured way.

The trouble is that there is no single best method. Over the last century different industries invented their own tools. Aerospace and nuclear engineers developed fault trees and event trees to understand how complex systems fail. The chemical industry created hazard and operability studies to examine process designs. Food producers built hazard analysis and critical control points to keep products safe. Bankers developed value at risk to describe possible financial losses. Project managers adopted Monte Carlo simulation for cost and schedule forecasts. Social scientists and planners refined Delphi studies and interviews to gather expert judgement. Each tool works well in its home territory, and many work well far outside it, but people who are new to risk work rarely know what exists, what each tool can and cannot do, or how to judge whether it was applied properly.

IEC 31010 fills that gap. It is a guide to the toolbox. It explains the general considerations that apply whatever technique you use, gives a structured way to choose, and then summarises a wide range of individual techniques, each with its uses, inputs, outputs, strengths and limitations, plus pointers to more detailed references.

From 2009 to 2019

The first edition appeared in 2009, alongside the first edition of ISO 31000, as a supporting standard that described techniques for the assessment part of the risk management process. When ISO 31000 was revised in 2018, IEC 31010 was revised too. The 2019 edition changed in three important ways. First, it gives much more guidance on how to plan an assessment, manage information and models, and verify and validate results, rather than just listing tools. Second, it increases the number and range of techniques, adding methods from areas such as finance, privacy and futures studies. Third, it stops repeating the principles and process already explained in ISO 31000 and instead refers to them, so the two documents now divide the work cleanly.

What it covers and what it does not

The scope of IEC 31010 is guidance on selecting and applying techniques for assessing risk in a wide range of situations. The techniques help people make decisions where outcomes are uncertain, provide information about particular risks, and support a wider process for managing risk. The document is generic: it can be used by a multinational, a hospital, a city council or a small engineering firm, and for strategic, project, operational, safety, environmental, financial or information risks.

It is important to be clear about what IEC 31010 is not. It is not a management-system standard with "shall" requirements that an auditor checks. It does not tell you which technique you must use, does not set risk acceptance levels, and does not describe how to treat risk once it is understood. Treatment, the wider framework and the overall process belong to ISO 31000. The individual technique summaries are introductions, not full methods; for a technique such as FMEA or fault tree analysis there are dedicated IEC standards that give the full procedure.

Who uses it

The introduction of the standard names several audiences: people who carry out or manage risk assessments, people who write sector guidance about how risk should be assessed in their field, and decision makers who commission assessments, read their results or must pick techniques for a particular need. That last group matters. A manager who has never built a fault tree can still use IEC 31010 to ask good questions: why was this technique chosen, what data did it rely on, how uncertain are the results, and were they checked?

Lesson 2 – Key concepts and vocabulary

IEC 31010 relies on the vocabulary of ISO 31000 and the risk management vocabulary guide (its normative references cite ISO Guide 73:2009, which ISO has since replaced with ISO 31073:2022). It adds a small number of terms of its own and explains core concepts about uncertainty and risk in clause 4. The following terms are the ones you need to read and discuss risk assessments confidently. The wording below is a plain-language explanation, not the official definitions.

Risk – the effect of uncertainty on objectives. The effect is a deviation from what was expected and can be positive, negative or both, so risk assessment covers opportunities as well as threats.
Uncertainty – a state of incomplete knowledge or understanding. It has several sources, for example natural variability (the same process giving different results each time), incomplete or imprecise data, lack of knowledge (we simply do not know enough yet), and vague or ambiguous language (people interpret the same words differently).
Likelihood – the chance of something happening, however it is expressed: in words, as a probability, or as a frequency over a period. The term is deliberately broad so that qualitative and quantitative descriptions both fit.
Consequence – the outcome of an event that affects objectives. One event can have several consequences of different sizes, some immediate and some delayed.
Risk source – anything that alone or in combination has the potential to give rise to risk, such as a hazard, a weak supplier or a new regulation.
Control – a measure that maintains or modifies risk, such as a procedure, an alarm, a design feature, a contract clause or a training programme. Controls can fail or be less effective than people assume.
Opportunity – a combination of circumstances expected to be favourable to objectives.
Risk assessment – the overall process of risk identification, risk analysis and risk evaluation, as described in ISO 31000. IEC 31010 techniques support each of these steps.
Risk criteria – the terms of reference against which the significance of a risk is judged, derived from objectives, context, laws and stakeholder views. Clause 6 asks assessors to review these criteria before starting.
Model – a simplified representation of a system or situation used to explore what might happen, from a simple spreadsheet to a large simulation. Every model rests on assumptions that must be understood.
Verification – checking that an analysis has been carried out correctly, for example that calculations are free of errors and a model has been built as intended.
Validation – checking that the model and its results are a good enough representation of reality for the decision they support.
Sensitivity analysis – varying inputs and assumptions to see which of them change the result most, so that effort can go into the inputs that matter.
Qualitative, semi-quantitative and quantitative – three ways of expressing results: descriptive words and categories, numerical scores on defined scales, or actual values such as probabilities, frequencies and money.

Uncertainty is the starting point

Clause 4 makes a point that beginners often miss: risk assessment is really about understanding uncertainty. If we knew exactly what would happen there would be no risk to assess. Some uncertainty can be reduced by collecting data or doing research; some, such as the natural scatter in a manufacturing process, cannot be removed and must be described instead. A good assessment states what kind of uncertainty is present and how it affects the confidence anyone should place in the results.

Risk has many characteristics

The standard also stresses that a risk is rarely described by one number. A risk can have several sources, several possible consequences of different sizes, and effects that depend on how controls perform. Risks interact: one event can trigger others, and several small risks can combine into a large one. Some consequences are sudden, some build slowly. People also perceive risk differently according to their values and experience. These characteristics explain why IEC 31010 offers so many techniques, because different techniques capture different aspects.

Figure 1 – IEC 31010 supplies the techniques for the identification, analysis and evaluation steps of the ISO 31000 risk management process.

Lesson 3 – Structure of the standard

IEC 31010:2019 has seven main clauses followed by two large informative annexes and a bibliography. Because the standard is guidance, the clauses explain and recommend rather than impose. The overview below paraphrases the structure; it is not a substitute for reading the document.

The main clauses

Clauses 1 to 3 set out the scope, the normative references (which include the risk management vocabulary, ISO Guide 73) and a short list of additional terms.
Clause 4, Core concepts, explains uncertainty and the characteristics of risk described in Lesson 2.
Clause 5, Uses of risk assessment techniques, describes when techniques help: to understand what risks exist or understand one risk in depth, to compare or optimise options that each carry risk, and to feed a risk management process that leads to treatment. Assessments can serve decisions of any size, from a board's strategic choice to a shift supervisor's daily judgement.
Clause 6, Implementing risk assessment, is the heart of the 2019 edition. It covers planning the assessment, managing information and developing models, applying techniques, reviewing the analysis, applying results to support decisions, and recording and reporting. Lesson 4 walks through it.
Clause 7, Selecting risk assessment techniques, gives the factors to consider when choosing techniques and stresses that several may be needed.

Annex A – categorising techniques

Annex A helps you narrow the field. It describes characteristics that distinguish techniques, such as the purpose they serve, the kind of decision and level of the organisation they suit, the time horizon, the information and expertise they need, whether results are qualitative or quantitative, and the effort involved. It then tabulates the techniques against those characteristics and shows which steps of the ISO 31000 process each one typically supports. The tables are indicative: they point you towards candidates, and you still have to judge fit.

Annex B – the techniques

Annex B describes more than forty techniques, grouped into ten families according to what they are mainly used for. Each description follows a similar pattern: an overview, its use, its inputs, its outputs, its strengths and limitations, and references. The families are:

Eliciting views from stakeholders and experts – brainstorming, the Delphi technique, the nominal group technique, structured or semi-structured interviews and surveys.
Identifying risk – checklists, classifications and taxonomies; failure modes and effects analysis (FMEA) and its criticality extension (FMECA); hazard and operability (HAZOP) studies; scenario analysis; and the structured what-if technique (SWIFT).
Determining sources, causes and drivers of risk – the cindynic approach and Ishikawa (fishbone) analysis.
Analysing controls – bow tie analysis, hazard analysis and critical control points (HACCP) and layers of protection analysis (LOPA).
Understanding consequences and likelihood – Bayesian analysis, Bayesian networks and influence diagrams, business impact analysis, cause-consequence analysis, event tree analysis, fault tree analysis, human reliability analysis, Markov analysis, Monte Carlo simulation and privacy or data protection impact analysis.
Analysing dependencies and interactions – causal mapping and cross impact analysis.
Providing a measure of risk – toxicological risk assessment, value at risk (VaR) and conditional value at risk (CVaR, also called expected shortfall).
Evaluating the significance of risk – the ALARP and SFAIRP approaches, frequency-number (F-N) diagrams, Pareto charts, reliability centred maintenance and risk indices.
Selecting between options – cost/benefit analysis, decision tree analysis, game theory and multi-criteria analysis.
Recording and reporting – risk registers, the consequence/likelihood matrix (also called a risk matrix or heat map) and S-curves.

Many techniques serve more than one purpose. FMEA, for example, identifies failure modes but also rates their effects; Monte Carlo results are usually reported as S-curves. The grouping tells you a technique's main use, not its only use.

Figure 2 – The ten families of techniques in Annex B, grouped here by the stage of work they mainly support.

A closer look at some widely used techniques

You do not need to master every technique, but you should recognise the common ones and know what question each answers.

Brainstorming encourages a group to generate ideas freely before judging them. It is quick and cheap but can be dominated by confident voices and may miss what nobody in the room knows.
Delphi technique gathers expert judgement in several anonymous rounds. After each round a facilitator feeds back a summary, experts reconsider, and views often converge. Anonymity reduces the influence of rank and personality, and experts can be in different places.
Nominal group technique has people write ideas silently first, then share them one at a time, discuss them, and rank or vote. It gives quieter people an equal voice.
Checklists, classifications and taxonomies capture past experience as lists of known risks or risk categories. They are fast and consistent but can make people stop thinking about anything not on the list.
FMEA and FMECA take a system, process or product apart element by element and ask how each element can fail, what the effect would be and how the failure would be detected. FMECA adds a ranking of how critical each failure mode is. The detailed method is in IEC 60812.
HAZOP examines a design, usually a process plant or a procedure, section by section. A trained team applies guidewords such as "no", "more", "less" or "reverse" to parameters like flow, pressure or temperature to find deviations from the design intent, then considers causes, consequences and safeguards. IEC 61882 gives the full method.
Scenario analysis builds plausible descriptions of possible futures to explore how risks might develop, which is useful for strategy and long time horizons.
SWIFT is a lighter, facilitated team workshop that uses "what if" prompts, often combined with a checklist, to identify risks in a system, process or change. It needs less preparation than HAZOP.
Cindynic approach, from a French school of thought on the sciences of danger, looks for intangible sources of risk by comparing the objectives, values, rules, data and models of different stakeholders and finding gaps (deficits) and conflicts (dissonances) between them.
Ishikawa analysis organises possible causes of an outcome into categories, drawn as the bones of a fish, to make sure no major group of causes is forgotten.
Bow tie analysis draws one unwanted event in the middle, its causes on the left with the controls that prevent it, and its consequences on the right with the controls that limit them. It is excellent for explaining controls to non-specialists.
HACCP identifies hazards in a process, especially food production, and defines critical control points where a hazard can be prevented, eliminated or reduced, with limits, monitoring and corrective actions.
LOPA is a semi-quantitative method, common in process safety, that estimates how often a hazardous scenario could occur by combining the frequency of an initiating cause with the chance that each independent protection layer fails.
Fault tree analysis starts from an undesired top event and works downward through logic gates (AND, OR) to the combinations of basic events that could cause it, and can be quantified. IEC 61025 gives the method.
Event tree analysis starts from an initiating event and works forward through the success or failure of each safeguard to a set of possible outcomes and their frequencies.
Bayesian analysis updates a prior estimate of likelihood as new evidence arrives; Bayesian networks extend this to many linked variables.
Business impact analysis examines how disruption would affect critical activities over time and what resources are needed to recover them, and is central to business continuity work.
Monte Carlo simulation represents uncertain inputs as probability distributions, samples them many thousands of times through a model, and builds up a distribution of possible outcomes.
Value at risk states the loss that will not be exceeded at a chosen confidence level over a set period; conditional value at risk describes the average loss in the cases that do exceed it.
ALARP (as low as reasonably practicable) is a way of judging tolerability: risks must be reduced unless the cost, time and effort of further reduction would be grossly disproportionate to the benefit. SFAIRP (so far as is reasonably practicable) is the related term used in some health and safety laws.
Multi-criteria analysis compares options against several weighted criteria when money alone cannot capture what matters.
Risk register records identified risks, their analysis, owners and planned actions; S-curves show the cumulative probability of outcomes, such as the chance of finishing below each possible cost.

Lesson 4 – How it works in practice: implementing a risk assessment

Clause 6 describes how to run an assessment so that its results are fit for purpose. The steps below are presented in order, but in reality they overlap and repeat: new information found while applying a technique may send you back to rethink the scope or the model.

Figure 3 – The implementation steps of clause 6, with the feedback loops that make assessment an iterative activity.

Step 1 – Plan the assessment

Planning is where most poor assessments go wrong, because people jump straight to a favourite tool. IEC 31010 asks you to settle several things first:

Purpose and scope. What decision or activity will the assessment inform, who will use the results, which parts of the organisation, system or time period are in scope, and what is excluded?
Context. What internal and external factors matter, such as regulations, the organisation's objectives, the state of existing controls and the history of incidents?
Stakeholders. Who has knowledge, who will be affected and who must accept the results? Involving them early brings in information and builds trust in the outcome.
Objectives. Which objectives could be affected? Risk only has meaning relative to what someone is trying to achieve.
Human, organisational and social factors. Judgements made by people are prone to biases such as overconfidence, anchoring on the first number mentioned, groupthink and the influence of senior people. Plan how to reduce them, for example with anonymous input, independent facilitation or structured elicitation.
Criteria for decisions. Review the criteria that will be used to judge significance or to choose between options. Are they clear, are they consistent with the organisation's attitude to risk, and do they fit the techniques planned?

Step 2 – Manage information and develop models

Assessments are only as good as their information. This step covers collecting data (from records, measurements, literature, experts and stakeholders), checking its quality and relevance, and analysing it to find trends, patterns and relationships. Where a model is used, the standard asks that its structure match the purpose, that its assumptions and limits be recorded, that it be checked before its results are relied on, and that inputs reflect the uncertainty in the data rather than single convenient values. A simple model that people understand is often better than a complex one nobody can check.

Step 3 – Apply risk assessment techniques

Clause 6.3 groups the analytical work into activities that mirror the families in Annex B: identifying risk; determining sources, causes and drivers; investigating how effective existing controls really are; understanding consequences and likelihood; analysing interactions and dependencies; and understanding measures of risk. Not every assessment needs every activity. A quick review of a small office move might need only identification and a rough judgement of likelihood and consequence; a safety case for a chemical plant might need all of them in depth.

Two points deserve emphasis. First, the effectiveness of controls should be examined, not assumed. A procedure that exists on paper but is rarely followed does not reduce risk much. Second, when describing consequences you should consider the range of possible outcomes, not just the worst case or the most likely case, and you should look at how risks interact, because combined or cascading effects can be far larger than any single risk suggests.

Step 4 – Review the analysis

Before results are used they should be reviewed. Verification checks that the work was done right: formulas, logic and data entry are correct. Validation checks that the right work was done: the model and its outputs reflect reality closely enough for the decision, for example by comparing with past events or expert opinion. Uncertainty and sensitivity analysis show how much confidence the results deserve and which assumptions drive them. Finally, assessments need monitoring and review over time, because the context, the controls and the available information all change.

Step 5 – Apply results to support decisions

The standard distinguishes two broad kinds of decision. The first is about the significance of a risk: is it acceptable as it stands, does it need treatment, and how urgently? Tools such as ALARP judgements, F-N diagrams and risk matrices help here, always against the agreed criteria. The second is about selecting between options, each of which carries its own risks and benefits: which design, supplier, investment or treatment is best? Cost/benefit analysis, decision trees and multi-criteria analysis help here. In both cases the decision maker should understand the uncertainty in the results and the assumptions behind them, not just a headline rating.

Step 6 – Record and report

The assessment process and its outcomes should be recorded so that the work can be understood, checked, repeated and updated. A useful report states the purpose and scope, the stakeholders involved, the criteria, the techniques used and why they were chosen, the data and assumptions, the results with their uncertainty, the limitations, and the conclusions and recommendations. It should be written for its audience: a board needs a different level of detail from an engineering team, but both need to know how confident they can be.

Choosing techniques (clause 7)

Clause 7 brings the choice together. Factors to weigh include the purpose of the assessment and the needs of decision makers, the type and range of risks, the potential size of the consequences (a bigger decision justifies more effort), the expertise, time and money available, the availability and quality of information, whether the assessment will need to be updated often, and any regulatory or contractual requirement to use a particular method. The standard encourages using more than one technique, because each sees only part of the picture, and it warns against making the analysis more complicated than the decision needs.

Figure 4 – A practical path for selecting techniques that follows the factors described in clause 7.

Lesson 5 – Assessment, certification and compliance

No certification against IEC 31010

IEC 31010 is a guidance standard. It contains recommendations, not auditable requirements, so there is no accredited certification of organisations "to IEC 31010", and claims of being "IEC 31010 certified" should be treated with caution. Neither ISO nor any of the IEC conformity assessment systems (such as IECEE or IECEx, which certify products and equipment) offers a certification scheme for it. Some training providers include the standard in risk management courses and issue certificates of attendance or personal credentials, but these show that a person has studied the material, not that an organisation's assessments are sound.

Where IEC 31010 matters for compliance

Although nobody certifies against it, IEC 31010 often sits behind compliance work. Management-system standards such as ISO 9001, ISO 14001, ISO 45001, ISO 22301 and ISO/IEC 27001 require organisations to determine and address risks without prescribing a method; IEC 31010 is a recognised source of methods for meeting those requirements. Sector standards and regulators frequently expect particular techniques, for example HAZOP and LOPA in process safety under IEC 61511, FMEA and fault trees in functional safety and automotive work, HACCP in food safety, data protection impact assessments under privacy law, and business impact analysis in business continuity. In those settings the sector document sets the requirement, and IEC 31010 explains the technique and its limits.

How the quality of an assessment is judged

Because there is no certificate, the quality of risk assessment is judged by the people who rely on it: internal auditors, external auditors of a management system, regulators, insurers, customers and independent reviewers. IEC 31010 gives them a sound basis for questions. Typical questions are:

Was the purpose clear, and did the scope match the decision being made?
Were the right people involved, and were biases managed?
Were the risk criteria defined and reviewed before the analysis?
Why were these techniques chosen, and were they applied by competent people in the way their methods describe?
What data and assumptions were used, and are they recorded?
Were results verified and validated, and was sensitivity to key assumptions explored?
Do the conclusions follow from the analysis, and is uncertainty communicated honestly?
Is the assessment kept up to date as conditions change?

A reviewer who finds a well-presented heat map but no record of criteria, data or assumptions has found a weak assessment, however polished it looks. Conversely, a short qualitative assessment can be entirely adequate if it suits a small decision and its limits are stated.

Competence

Many techniques need trained people. A HAZOP needs an experienced, independent leader and a team that knows the design; a fault tree or Markov model needs someone who understands the logic and the data; a Delphi study needs a careful facilitator. The technique descriptions in Annex B make clear that results depend heavily on the knowledge and skill of the people applying them. Part of judging an assessment is judging whether the people who did it were competent for the method chosen.

Lesson 6 – Worked example: a dairy adds a new filling line

To see how the pieces fit together, follow a fictional mid-sized dairy, "Meadowgate Dairy", that plans to install a new high-speed yoghurt filling line with an automated, network-connected control system. The board must decide within three months whether to approve the project, which of two equipment designs to buy and which safeguards to fund. The quality and safety manager is asked to lead a risk assessment using IEC 31010 as the guide.

1. Planning

The manager writes a one-page plan. The purpose is to inform three decisions: approve the line or not, choose between design A (cheaper, manual cleaning) and design B (more expensive, automated clean-in-place), and select safeguards. The scope covers the line from the arrival of yoghurt to sealed, labelled pots, including cleaning, changeovers between products and the control system, but not the wider plant. Stakeholders include production, maintenance, quality, food safety, IT, the equipment suppliers, a major retail customer and the insurer. Objectives at stake are food safety, worker safety, output, cost and reputation.

The manager also reviews the criteria. Meadowgate already uses a five-level consequence scale and a five-level likelihood scale. The team agrees that any food safety hazard capable of harming consumers must be controlled at a critical control point regardless of its rating, that worker injury risks must be reduced as far as reasonably practicable, and that commercial risks will be compared using cost and multi-criteria analysis. To reduce bias, the plan states that the equipment supplier will be consulted but will not take part in rating risks, and that an independent facilitator will run the workshops.

2. Information and models

The team gathers the suppliers' technical files, incident records from the existing lines, allergen and product-change schedules, maintenance data, the retail customer's requirements and industry guidance. They note gaps: there is no failure data for the new filler, so they will rely on supplier data and expert judgement and will treat those values as uncertain.

3. Applying techniques

Eliciting views and identifying risk. A half-day SWIFT workshop with production, maintenance, quality and IT staff works through prompts such as "what if the wrong product is filled into the wrong pots?" and "what if the control system loses its network connection?", supported by a checklist of food-industry risks. Because some operators are reluctant to speak in front of managers, the facilitator also runs short one-to-one interviews with night-shift staff, who raise the risk of cleaning chemicals being left in pipework after a rushed changeover.

Food safety hazards. The food safety team applies HACCP to the new process flow. They identify biological, chemical, physical and allergen hazards at each step and confirm two critical control points: the heat treatment upstream (already controlled) and a new metal detection step after sealing. They define critical limits, monitoring frequency and corrective actions for each.

Equipment failures. Maintenance engineers carry out an FMEA of the filler. For each component, such as dosing pumps, seal heaters, the lid applicator and sensors, they list how it can fail, what the effect would be and how the failure would be detected. Seal heater failure stands out because a weak seal may not be visible and could let product spoil.

Controls for the most serious event. For the event "allergen-containing product reaches pots labelled allergen-free", the team builds a bow tie. On the left are causes such as an incomplete clean between products, the wrong label roll being loaded and a recipe-selection error in the control system. Between each cause and the event they show prevention controls: validated cleaning, label verification by barcode scan, and recipe locks. On the right are consequences such as consumer harm, a product recall and loss of the retail contract, with mitigation controls such as batch traceability and a recall plan. Examining the bow tie, they realise that operators can override the barcode label check during busy changeovers, so the control is weaker than it looks; they add an override log reviewed by a supervisor each shift.

Figure 5 – The bow tie built by the dairy: causes and prevention controls above the central event, mitigation controls and consequences below.

Likelihood and consequence. For the risk of an unplanned stoppage of the whole line, the engineers build a simple fault tree combining failures of the filler, the conveyor and the control system, using supplier reliability data with wide ranges. The finance analyst then runs a Monte Carlo simulation of first-year output for each design, sampling stoppage durations, cleaning times and demand, and presents the results as S-curves showing the probability of meeting the output target.

4. Reviewing the analysis

A colleague from another site checks the fault tree logic and the spreadsheet formulas (verification) and finds one AND gate that should have been an OR gate, which is corrected. The team compares the simulated stoppage rates with those of a similar line at a sister company (validation) and finds them plausible. Sensitivity analysis shows that the result depends most on the cleaning time for design A; if manual cleaning takes longer than assumed, design A misses its output target in most simulated years.

5. Supporting the decisions

For significance, the HACCP critical control points are accepted as mandatory, and the worker-safety risks found in the SWIFT workshop are reviewed against the "as far as reasonably practicable" criterion; guarding on the lid applicator is added because its cost is small compared with the injury risk it reduces. For selecting between options, the team uses multi-criteria analysis with weighted criteria for food safety, output reliability, cost, cleaning-chemical risk and cyber exposure. Design B scores best despite its higher price, mainly because automated cleaning reduces both allergen risk and the sensitivity to cleaning time. A short cost/benefit analysis of an X-ray inspection system versus the planned metal detector shows that X-ray would also catch some non-metal foreign bodies, but the benefit does not yet justify the cost; the decision is recorded so that it can be revisited if incidents change the picture.

6. Recording and reporting

The risks, owners, controls and actions go into the line's risk register. The board receives a six-page report: purpose and scope, who was involved, criteria, the techniques used and why, key assumptions and data gaps, results including S-curves and the bow tie, the recommendation for design B with specific safeguards, and a statement of the main uncertainties. A heat map summarises the register, but the report explains that the ratings are judgements on ordinal scales and should not be added up or compared to two decimal places. The plan schedules a review after commissioning, when real failure and cleaning data will replace estimates.

What the example shows

Meadowgate did not pick one technique and force everything through it. It used different tools for different questions, matched effort to the size of each risk and decision, checked the analysis before relying on it and told decision makers how confident they could be. That is the practical meaning of applying IEC 31010.

Lesson 7 – Relationship to other standards and frameworks

IEC 31010 sits in a family of risk documents. Understanding the neighbours helps you know which one to open for which question.

Standard or framework	What it provides	How it relates to IEC 31010
ISO 31000:2018 Risk management – Guidelines	Principles, framework and the overall risk management process	The parent guideline. IEC 31010 supplies techniques for the assessment steps of its process and does not repeat its concepts.
ISO 31073:2022 Risk management – Vocabulary	Standard definitions of risk management terms	Replaced ISO Guide 73, which IEC 31010:2019 cites; use it for consistent terminology.
IEC 60812 (FMEA and FMECA), IEC 61025 (fault tree analysis), IEC 61882 (HAZOP), IEC 62502 (event tree analysis), IEC 61165 (Markov techniques)	Full procedures for individual techniques	IEC 31010 summarises the technique and points to these documents for detailed application.
IEC 61508 and IEC 61511 (functional safety)	Requirements for safety-related systems and process safety instrumented systems	Require hazard and risk analysis; techniques such as HAZOP, LOPA and fault trees described in IEC 31010 are commonly used to meet them.
ISO 14971 (medical device risk management)	Requirements for a risk management process for medical devices	A sector-specific process; teams draw on techniques like FMEA and fault trees to perform its analysis.
ISO/IEC 27005 (information security risk)	Guidance on information security risk management	Applies ISO 31000 thinking to information security; IEC 31010 techniques such as interviews, scenarios and matrices can support it.
COSO Enterprise Risk Management framework	An enterprise risk framework linked to strategy and performance	A widely used alternative to ISO 31000 at enterprise level; the same assessment techniques can be used within it.

The simple rule is this: ISO 31000 tells you how risk management should work as a whole; IEC 31010 helps you choose and use the techniques for assessing risk; technique-specific standards tell you exactly how to carry out a particular method; and sector standards or regulations tell you what you are required to achieve in a given industry.

Common pitfalls and best practices

Common pitfalls

Choosing a technique because it is familiar or required by habit, before the purpose of the assessment and the decision it supports are clear.
Treating a colour-coded risk matrix as precise measurement: multiplying ordinal scores, adding them across risks, or ranking risks by tiny differences.
Assuming existing controls work as designed without checking how effective they are in practice.
Reporting a single "most likely" figure and hiding the range of possible outcomes and the uncertainty behind it.
Letting the most senior or most confident person drive group judgements, so that biases go unchallenged.
Building complex models that nobody else can check, or using quantitative tools without adequate data.
Assessing risks one by one and ignoring how they interact or cascade.
Treating the assessment as a one-off document that is never updated when the context changes.

Best practices

Start every assessment with a short written plan covering purpose, scope, stakeholders, objectives and decision criteria.
Match the effort and complexity of techniques to the size of the decision and the information available.
Combine complementary techniques, for example a workshop to identify risks, a structured analysis for the most serious ones and a clear reporting format.
Use structured elicitation, such as anonymous rounds or silent idea generation, where expert judgement is important and bias is likely.
Verify calculations and validate models against real experience, and run sensitivity analysis on key assumptions.
Record data sources, assumptions, limitations and the reasons for technique choices alongside the results.
Communicate uncertainty honestly and tailor reports to the audience.
Use competent people for specialised techniques and consult the technique-specific standards when applying them.

Summary and key takeaways

IEC 31010:2019 is the joint IEC/ISO guidance on selecting and applying risk assessment techniques; it is current, and its review status should be rechecked as the 2027 stability date approaches.
It supports the identification, analysis and evaluation steps of ISO 31000 and leaves principles, framework and treatment to that standard.
Risk assessment is fundamentally about understanding uncertainty, and a good assessment says how confident its results are.
Clause 6 sets out the implementation steps: plan, manage information and models, apply techniques, review, support decisions, and record and report.
Annex B describes more than forty techniques in ten families, from eliciting expert views to recording and reporting; Annex A helps you shortlist them.
Technique choice depends on purpose, decision size, information, expertise, resources and any regulatory requirement, and several techniques are often combined.
There is no organisational certification to IEC 31010; the quality of an assessment is judged by its clarity, evidence, verification, validation and honest reporting.
Risk matrices are useful summaries but are easily misused; they do not replace analysis.

Reflection questions

Think of a recent decision at your workplace that involved risk. What was its purpose, who were the stakeholders, and which two techniques from Annex B would have helped most, and why?
Your organisation rates all risks on a five-by-five matrix. What information would you add to its risk reports so that decision makers understand the uncertainty behind each rating?
Choose a critical process you know well. Which existing controls do people assume are effective, and how could you test that assumption?
Where in your organisation could group judgements be distorted by seniority or groupthink, and which elicitation technique would you use to reduce that effect?
If an auditor asked to see evidence that one of your risk assessments was fit for purpose, what records could you show today, and what is missing?