ISO31000

ISO 31000, Risk management – Guidelines, is an international standard published by the International Organization for Standardization (ISO). The standard, first released in 2009 and updated as ISO 31000:2018, provides principles, a framework, and a process for managing risk within any organization. It is designed to be used by organizations of all sizes, sectors, and locations, and it is not itself a certifiable management system, but a guide to embedding risk management into governance, strategy, planning, and operations.

Risk is defined as the effect of uncertainty on objectives, and risk management aims to reduce threats and exploit opportunities. The standard outlines principles such as value creation, integration with governance, involvement of stakeholders, tailoring to the organization, dynamic responsiveness to change, reliance on the best available information, and continual improvement.

The framework within ISO 31000 covers leadership and commitment, integration into organizational processes and culture, design of the risk management framework, implementation, evaluation, and continual improvement. The process component describes steps to manage risk: establish the context, conduct risk assessment (identification, analysis, evaluation), risk treatment, and ongoing monitoring, review, and communication/consultation. The standard is designed to be compatible with other management system standards and to guide the design and operation of an organization’s risk management activities rather than prescribe specific methodologies.