ISO 31000: the guideline for risk management

ISO 31000 is the international guideline for risk management. The standard describes principles, a framework and a process with which any organisation can recognise, assess and control risks. The current version is ISO 31000:2018 , titled “Risk management - Guidelines”.

ISO 31000 cannot be certified. It is a guideline with recommendations, not a list of requirements that an auditor can test against. You still use it often: as a basis for the risk part of standards that can be certified, such as risk management in ISO 9001 and the risk analysis for ISO 27001. In the Netherlands, NEN publishes the standard.

ISO 31000 defines risk as “the effect of uncertainty on objectives”. A risk can therefore turn out negative or positive. That is broader than the everyday meaning of “what could go wrong”.

Can you be certified for ISO 31000?

No, an organisation cannot obtain an ISO 31000 certificate. The guideline uses the word “should” and not “shall”. There is therefore nothing to audit against. A certification body that offers an ISO 31000 certificate for your company does not provide an accredited certificate. You can check how on checking a certificate.

Personal certificates do exist. Training providers offer courses with an exam, such as ISO 31000 Risk Manager. That says something about the knowledge of an employee, not about your organisation.

Question	Answer
Is ISO 31000 a requirements standard?	No, it is a guideline
Can your organisation be certified?	No
Is there a personal certificate?	Yes, through training providers
Is ISO 31000 mandatory?	No, it is not legally required anywhere
Why use it then?	As a proven approach to the risk requirements in other standards

How is ISO 31000 structured?

ISO 31000 has three building blocks. The principles say why, the framework says how you organise it, and the process says what you do.

Building block	Clause	Content
Principles	4	Eight characteristics of good risk management, such as integrated, structured, customised and continually improving
Framework	5	Leadership and commitment at the centre, with integrating, designing, implementing, evaluating and improving around it
Process	6	Communication and consultation, establishing context, assessing and treating risks, monitoring and reporting

The framework resembles the PDCA cycle: design, implement, evaluate and improve. That is why ISO 31000 fits well with any management system built on the High Level Structure.

The ISO 31000 risk process step by step

Clause 6 is the part you use most in practice. The process looks like this.

Communication and consultation

Involve the people who know the risk or are affected by it. This runs through all the other steps.

Scope, context and criteria

Decide what the analysis covers and when a risk is acceptable. In practice, that limit is often called risk appetite.

Identify risks

Look for what could happen, what would cause it and what the consequence would be for your objectives.

Analyse risks

Determine likelihood and consequence, for example with a risk matrix.

Evaluate risks

Compare the outcome with your criteria. Which risks need action, and which do you accept?

Treat risks

Choose a measure: avoid, reduce, share (for example by insuring or outsourcing) or deliberately accept.

Monitor and review

Check whether measures work and whether there are new risks.

Record and report

Record the outcomes and discuss them, for example in the management review.

Example: applying ISO 31000 in a small installation company

An installation company with 25 employees wants a risk analysis for ISO 9001 that goes further than a loose list. It uses the ISO 31000 process as the structure for its risk register.

Step	Elaboration
Context	Goal: deliver projects on time and within budget. Scope: all installation projects
Criteria	A score above 12 on a 5x5 matrix requires a measure within one month
Risk	Supplier of heat pumps cannot deliver on time
Cause	Single supplier, long lead times in the market
Analysis	Likelihood 4, consequence 4, score 16
Evaluation	Above the limit, so treat it
Treatment	Qualify a second supplier and include lead times in quotations
Monitoring	Review lead times per supplier every quarter
Reporting	In the annual management review

The difference from a loose risk list is that the criteria are set in advance. The company therefore no longer debates for each risk whether it is “serious enough”.

How do you use ISO 31000 alongside certifiable standards?

ISO 31000 does not replace any requirement. You use it to fill in the risk requirements of other standards well.

Standard	Clause	How ISO 31000 helps
ISO 9001	6.1	Structure for risks and opportunities, without the standard prescribing a method
ISO 27001	6.1.2 and 6.1.3	Basis for the risk assessment; the supporting guideline ISO 27005 builds on ISO 31000
ISO 45001	6.1.2	Risk process alongside the hazards and risks for ISO 45001
ISO 22301	8.2	Risk assessment alongside the business impact analysis
ISO 13485	7.1	For product risks, the own standard ISO 14971 applies, with a similar logic

For the techniques themselves, such as a bowtie analysis or an FMEA, ISO 31000 refers to the accompanying standard IEC 31010.

Common mistakes when using ISO 31000

Saying you are ISO 31000 certified. That is not possible. Say that your risk management is set up in line with ISO 31000.
Only using the matrix. Without criteria set in advance, every score becomes a discussion.
Forgetting opportunities. ISO 31000 looks at uncertainty in both directions.
A separate risk project. The first principle is that risk management is integrated into your normal work, not a separate document.
Too much theory for a small company. Use the process as a framework, not as a mandatory report structure.