ISO 31000 risk management, made practical
A plain way to find, rate and treat risk across the business, and keep the evidence in one place.
Official sources
Use these official places to read the text and find the latest version.
Official website
ISO explains the standard and links to the paid document and related guides.
Visit iso.org/iso-31000-risk-management ↗Get the document
The standard is sold by ISO and by national standards bodies. It is short, about 20 pages.
Open the official page ↗Works alongside
ISO 27001 and ISO 23894 build on it. COSO ERM covers similar ground.
Browse all frameworks →What ISO 31000 is
ISO 31000 is the international guide to managing risk of any kind: financial, operational, security, legal. It describes principles, a framework for your organisation and a process to follow.
It cannot be certified against, so nobody can audit you to it. That makes it a good backbone for the risk work behind other standards.
How ISO 31000 got to where it is today
The milestones that changed what organisations have to do.
First edition
ISO 31000:2009 is published, based on the Australian and New Zealand risk standard.
Second edition
Shorter and clearer. Puts leadership first and stresses that risk management is part of everyday decisions.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
Risk is handled differently in every team.
Another standard you follow asks for a risk process.
Leadership wants one view of the top risks.
You need a risk method that is simple and repeatable.
What it asks of you
The requirements fall into six areas.
Leadership and commitment
Management owns risk and sets the appetite.
Scope and context
Decide what you are assessing and what matters.
Risk assessment
Identify, analyse and evaluate risks.
Risk treatment
Choose how to reduce, share, accept or avoid each risk.
Monitoring and review
Check that treatments work and risks have not changed.
Communication and records
Keep people informed and keep a record.
ISO 31000 in 3 parts, 8 topics and 30 guidance points
A general guideline for managing any kind of risk. It sets out eight principles, a framework to embed risk management in the organisation, and a repeatable process for assessing and treating risks. It is guidance, not a certifiable standard.
8 topics · 30 guidance points
PRPrinciples (Clause 4)The ideas that make risk management effective and valuable.1 topic · 8 guidance points
PR-coreEight principlesWhat good risk management looks like in practice.8 guidance points
- Cl. 4 principle 1
Risk management is integrated into all organisational activities.
What you do
- Include risk checks in planning, projects and budgets
- Avoid a separate risk exercise run in isolation
- Cl. 4 principle 2
Risk management is structured and comprehensive, giving consistent and comparable results.
What you do
- Use one method and scale across teams
- Cover all significant areas of the business
- Cl. 4 principle 3
Risk management is customised to the organisation's context and objectives.
What you do
- Scale effort to your size and sector
- Do not copy a large company's process unchanged
- Cl. 4 principle 4
Risk management is inclusive, involving stakeholders at the right times.
What you do
- Consult staff, customers and suppliers on key risks
- Record who was involved
- Cl. 4 principle 5
Risk management is dynamic, responding to emerging, changing and disappearing risks.
What you do
- Review the register after major changes
- Add new risks as they appear
- Cl. 4 principle 6
Risk management uses the best available information, and acknowledges its limits.
What you do
- Use data, incidents and expert judgement
- Note uncertainty and assumptions
- Cl. 4 principle 7
Human behaviour and culture affect every part of risk management.
What you do
- Encourage open reporting without blame
- Consider how incentives shape risk-taking
- Cl. 4 principle 8
Risk management is continually improved through learning and experience.
What you do
- Capture lessons from incidents and near misses
- Update method and controls from them
Evidence to keep
- Risk policy
- Risk register
- Board or management reports
FWFramework (Clause 5)How leadership builds risk management into governance, strategy and daily work.3 topics · 11 guidance points
FW-leadLeadership and integrationTop-level commitment and embedding risk management in how the organisation runs.2 guidance points
- Cl. 5.2
Leadership shows commitment, aligns risk with objectives and culture, and makes sure resources and accountability exist.
What you do
- Issue a risk policy signed by top management
- Add risk to leadership meeting agendas
- Cl. 5.3
Risk management is integrated into governance, strategy, planning and every other organisational process.
What you do
- Link risk to strategic planning and project gates
- Assign risk responsibilities in each function
Evidence to keep
- Leadership statement
- Governance charter
- Integration plan
FW-designDesign of the frameworkUnderstanding the organisation and setting out how risk will be managed.5 guidance points
- Cl. 5.4.1
The organisation's external and internal context is examined before designing the framework.
What you do
- Review market, legal, contractual and internal factors
- Refresh when the business changes
- Cl. 5.4.2
Leadership articulates its commitment to risk management in a policy or statement.
What you do
- Publish and communicate the policy
- State why risk is managed and how
- Cl. 5.4.3
Roles, authorities, responsibilities and accountabilities for risk are assigned and communicated.
What you do
- Name risk owners for each risk
- Define who may accept risk
- Cl. 5.4.4
Suitable resources are allocated to risk management.
What you do
- Provide people, time, tools and training
- Budget for treatment actions
- Cl. 5.4.5
Communication and consultation approaches are established to support the framework.
What you do
- Set a regular reporting rhythm
- Create a route for staff to raise risks
Evidence to keep
- Context analysis
- Risk management policy
- RACI matrix
- Resource plan
- Communication plan
FW-runImplementation, evaluation and improvementPutting the framework into practice, checking it and improving it.4 guidance points
- Cl. 5.5
The framework is implemented with a plan, timing, and decision processes aligned to the organisation's arrangements.
What you do
- Roll out in phases with owners and dates
- Brief managers on their duties
- Cl. 5.6
The framework's performance is measured against its purpose and checked for suitability.
What you do
- Define indicators and review yearly
- Review results with leadership
- Cl. 5.7.1
The framework is adapted as external and internal change occurs.
What you do
- Update policy and criteria after changes
- Record versions
- Cl. 5.7.2
The framework is continually improved in suitability, adequacy and effectiveness.
What you do
- Act on review findings
- Track improvement actions to closure
Evidence to keep
- Implementation plan
- Framework review report
- Improvement actions
PRCProcess (Clause 6)The repeatable steps for identifying, analysing, treating and monitoring risk.4 topics · 11 guidance points
PRC-setupCommunication, scope, context and criteriaPreparing the ground before assessing risks.4 guidance points
- Cl. 6.2
Communication and consultation with stakeholders run throughout the process.
What you do
- Plan who is told and consulted at each step
- Keep records of feedback
- Cl. 6.3.2
The scope of the risk management activity is defined.
What you do
- State objectives, boundaries and links to other activities
- Note what is out of scope
- Cl. 6.3.3
External and internal context is defined for the activity.
What you do
- Identify factors such as regulation, technology and culture
- Keep the list current
- Cl. 6.3.4
Risk criteria are defined: the amount and type of risk the organisation will or will not take, and how significance is judged.
What you do
- Create likelihood and impact scales
- Define the risk appetite and tolerance levels
Evidence to keep
- Consultation records
- Scope statement
- Risk criteria document
- Context analysis
PRC-assessRisk assessmentFinding, understanding and judging risks.3 guidance points
- Cl. 6.4.2
Risks are identified, including their sources, events and consequences.
What you do
- Run workshops, reviews and incident analysis
- Log each risk with an owner
- Cl. 6.4.3
Risks are analysed to understand their nature, likelihood, consequences and existing controls.
What you do
- Rate each risk using the agreed scale
- Capture confidence in the rating
- Cl. 6.4.4
Analysis is compared with the criteria to decide what action is needed.
What you do
- Rank risks and flag those above tolerance
- Record decisions made
Evidence to keep
- Risk register
- Analysis workshop notes
- Risk evaluation results
PRC-treatRisk treatmentChoosing and carrying out actions to change risk.2 guidance points
- Cl. 6.5.2
Treatment options are selected by balancing benefits against cost, effort and any adverse effects.
What you do
- Compare options such as avoid, reduce, share and accept
- Document the reasons for choices
- Cl. 6.5.3
Treatment plans state actions, owners, resources, timing and how progress is reported.
What you do
- Assign owners and due dates
- Track residual risk after treatment
Evidence to keep
- Treatment plan
- Control implementation records
- Residual risk acceptance
PRC-followMonitoring, review, recording and reportingKeeping the process alive and visible.2 guidance points
- Cl. 6.6
Monitoring and review take place at planned stages of the process.
What you do
- Set review dates and key risk indicators
- Check controls work as intended
- Cl. 6.7
The process and its outcomes are documented and reported to suitable stakeholders.
What you do
- Produce regular risk reports
- Keep records proportionate to need
Evidence to keep
- Monitoring reports
- Review minutes
- Risk reports to management
Nothing matches. Clear the search or pick another part.
Outcomes and implementation examples are from ISO 31000:2018 Risk management - Guidelines, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Set the policy
Agree who owns risk and how much you will accept.
- 2
Define your scoring
Pick a simple scale for likelihood and impact.
- 3
Build the register
List risks with an owner for each.
- 4
Treat the top risks
Plan actions, dates and owners.
- 5
Review on a schedule
Re-score every quarter or after big changes.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Leadership and commitment | Risk policy and appetite statement |
| Scope and context | Scope records |
| Risk assessment | Risk register with scoring |
| Risk treatment | Treatment plans with owners and dates |
| Monitoring and review | Review reminders and dashboards |
| Communication and records | Reports and audit trail |
Free ISO 31000 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Risk policy (sample)
- Risk register starter
- Scoring scale
- Quarterly review checklist
Share or cite this page
Writing about ISO 31000? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/iso-31000/">ISO 31000 explained in plain English - Optimus CyberX</a>Common questions
Can we be certified to ISO 31000?
No. ISO 31000 is guidance, not a set of requirements, so there is no certificate. It is a good backbone for risk work behind certifiable standards.
How is it different from ISO 27001?
ISO 27001 is about information security and is certifiable. ISO 31000 covers risk of every kind.
Do small businesses need it?
It is useful at any size. Keep the method light.
Do we need special software?
No, but a shared register with owners and reminders makes it stick.
Related frameworks
See how ready you are for ISO 31000
Answer questions across every area. We email you a report showing where you comply and where you do not.