CyphrQ
Menu

ISO 31000 Risk Management Explained: Principles and Process

ISO 31000:2018 is risk management guidance, not a certificate. What its principles, framework and process cover, and how it sits above ISO/IEC 27005.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

ISO 31000:2018 is ISO's general guidance on managing risk, for any organisation and any kind of risk. It is not a certification standard: no auditor issues an "ISO 31000 certificate". It gives you a shared vocabulary and a way of working, built from principles, a framework and a process, that other standards, including ISO/IEC 27005 for information security, build on.

This article sits in the ISO standards subtopic and covers one standard. If you need the information security version, read the ISO/IEC 27005 explainer after this one.

What is ISO 31000 and who publishes it?

ISO 31000 is published by the International Organization for Standardization (ISO) and its page is the official ISO 31000:2018 listing. The same catalogue record appears on ISO's committee site, and the national listing comes from the Estonian standards body.

What those pages show:

  • Edition 2, published 14 February 2018, titled as risk management guidelines.
  • Prepared by ISO/TC 262, Risk management. It replaced ISO 31000:2009, which is withdrawn.
  • Status: published. The committee page says a 2023 review confirmed it as current. It also shows the stage code 90.92 ("to be revised") and lists ISO/CD 31000, a committee draft, as the planned replacement under development.
  • 16 pages. It is a short document.
  • Not certifiable. The page describes it as not a certifiable risk management standard.

That mix of "confirmed current" and "to be revised" looks contradictory on the page itself. The practical reading: the 2018 edition is the one in force today, and a new edition is being worked on. I found no published newer edition. Cite the year when you refer to it, and check the ISO page before you rely on it.

What does ISO 31000 cover?

ISO's scope summary says it sets out principles and guidelines for risk management, covering how to identify, analyse, evaluate, treat, monitor and communicate risks. The Estonian listing adds that it can be customised to any organisation and its context. The text is paid content, so I describe it in my own words and do not reproduce it.

A risk, in plain terms, is the effect of uncertainty on your objectives. It can be good or bad. Security work tends to focus on the bad side, but a risk register that ignores opportunity is half a register.

The standard has three parts that fit together:

  • Principles say what good risk management looks like.
  • A framework says how to build it into the organisation: governance, roles, resources and routines.
  • A process is the repeatable work you do on a given decision, project or system.

The framework's clause list was not read for this post, so it is described only in general terms. Check a licensed copy before you plan around its exact components.

What are the eight principles of ISO 31000?

North Carolina State University's enterprise risk management programme, in a page summarising the 2018 standard, lists the eight principles. Risk management should be:

  1. Integrated across the organisation.
  2. Structured and comprehensive.
  3. Customised to the organisation.
  4. Inclusive of stakeholders' knowledge and views.
  5. Dynamic, responding to risks that change over time.
  6. Based on the best available information.
  7. Shaped by human and cultural factors.
  8. Subject to continual improvement.

That is a university summary, not ISO's own wording. The point worth remembering is the first one: risk management that lives only in the security team, or only in an annual workshop, is not what the standard describes.

What are the steps of the ISO 31000 risk process?

The same NC State page lists six steps:

  1. Communication and consultation. Talk to the people affected, at every step.
  2. Scope, context and criteria. Decide what you are assessing and how you will judge risk.
  3. Risk assessment, made of identification, analysis and evaluation.
  4. Risk treatment. Choose and carry out responses.
  5. Monitoring and review.
  6. Recording and reporting.

Who uses ISO 31000, and can you be certified against it?

You cannot be certified against ISO 31000. It is guidance, not a set of requirements for an auditable management system. ISO's own catalogue page says so directly, which is the strongest source you can give a customer who asks.

That is why it spreads so widely. Because there is nothing to pass, it is used by organisations of every size and by people in finance, operations, projects, safety, compliance and security. It can serve as the shared reference behind an enterprise risk register that security risks then feed into.

People can still take training. DNV, a certification and assurance company, runs a one-day ISO 31000 foundation course covering the key elements of ISO 31000:2018 and the risk governance process. Its page does not say the course leads to a certificate, and any such credential would be personal, not an organisational certification.

How does ISO 31000 relate to ISO/IEC 27005 and other standards?

  • ISO/IEC 27005 adapts ISO 31000's approach to information security risk and supports ISO/IEC 27001. The ISO/IEC 27005 explainer covers the security-specific process and approaches.
  • ISO/IEC 27001 is the security standard you can actually be certified against. It asks you to assess and treat risk; 31000 gives the general logic that 27005 then specialises. The SOC 2 vs ISO 27001 comparison shows how that audit looks from outside.
  • ISO/IEC 42001, the AI management system standard, has its own risk and impact assessment needs, covered in how ISO/IEC 42001 certification works.
  • NIST CSF 2.0 is a separate, US framework that also treats risk as central. The NIST CSF 2.0 explainer compares it with the ISO family.

The layering is simple to hold in your head. ISO 31000 is the general guideline. ISO/IEC 27005 narrows it to information security. ISO/IEC 27001 is the certifiable system that uses that risk work. ISO's catalogue also lists companion documents from the same programme, such as a risk management vocabulary and risk assessment techniques; look those up on the ISO site, because their pages were not read for this post.

How does adopting ISO 31000 work in practice?

There is no audit stage, because there is no certificate. You adopt it, and what gets examined is the quality of your risk work: by your own internal audit, your board, a customer questionnaire, or an auditor of a different standard who asks to see your risk process.

A realistic path:

  1. Agree a short risk policy. Who owns risk, what the board expects, how often you report.
  2. Define criteria. Scales for likelihood and consequence in business terms, and the level at which a risk needs a named senior owner.
  3. Run the process once on something real. A project, a supplier or a system, not an abstract workshop.
  4. Record and report. One register, with owners and dates.
  5. Review after change and on a schedule.
  6. Improve. Note what the first cycle taught you and adjust the method.

Going deeper: for security and IT teams

Where it sits in an ISMS. If you run ISO/IEC 27001, an auditor will not ask whether you follow ISO 31000. They will ask for a defined risk assessment method, results, treatment decisions and evidence the work repeats. ISO 31000 is useful because it shows your security risk method is one instance of an organisation-wide approach rather than a security-only invention. Name the edition (ISO 31000:2018) in your risk method so the link is explicit.

Make scope, context and criteria a document, not a meeting. This step is easy to compress. Write down the objectives the risk is measured against, the internal and external context, the risk owners, and the criteria for acceptable risk. Without it, two assessors will score the same scenario differently, and you cannot reproduce your own register.

Evidence a reviewer will ask for:

  • An approved risk management policy or method with the date, owner and edition referenced.
  • A risk register with scenario text, owner, current controls, rating against the criteria and the treatment decision.
  • Treatment plans with owners, dates and status.
  • Minutes or dated versions showing monitoring and review after significant change.
  • Records of who accepted residual risk, and that they had authority over it.
  • Evidence of consultation: who outside the security team (finance, legal, operations, the service owner) contributed.

Treatment is more than controls. The process step is "risk treatment", not "add controls". Record the full option set: avoid the activity, reduce likelihood or consequence, share or transfer (insurance, contract), or retain with approval. The 27005 explainer covers why a security-only reading can lean too heavily on controls.

Link strategic and operational risk. A security risk register is usually a child of an enterprise one. Agree a mapping of rating scales so that "high" in security means the same as "high" in finance. Where scales cannot be aligned, record the translation rule. Without that alignment, a board cannot compare security risk with other risks.

In practice: a cloud move without an effective risk assessment. On 6 August 2020 the US Office of the Comptroller of the Currency assessed an $80 million civil money penalty against Capital One, N.A. and Capital One Bank (USA), N.A. The OCC cited the bank's "failure to establish effective risk assessment processes" before migrating significant IT operations to the public cloud. It also cited the "failure to correct the deficiencies in a timely manner". The standard breached was 12 C.F.R. Part 30, Appendix B, the interagency information security guidelines. In ISO 31000 terms, the gap sat at the start of the process: assessment before a major change, then monitoring and review to close what it found.

In practice: a court on what "adequate" risk management means. In 2022 the Federal Court of Australia found that RI Advice Group, a financial services licensee, "failed to have adequate risk management systems to manage its cybersecurity risks" (ASIC media release 22-104MR; judgment [2022] FCA 496). The cyber incidents occurred at its authorised representatives between June 2014 and May 2020. The court ordered the firm to engage a cybersecurity expert to identify further measures, and to pay A$750,000 towards ASIC's costs. Justice Rofe wrote that "It is not possible to reduce cybersecurity risk to zero, but it is possible to materially reduce cybersecurity risk". That is the logic of risk treatment and residual risk: the test was whether the firm had systems to reduce risk to a defensible level, not whether incidents happened.

Common weaknesses, described generally.

  • A written method that the register does not follow.
  • Risk assessed once a year with no trigger for change.
  • No consultation: the register reflects only the security team's view.
  • Risk acceptance signed by someone without authority over the risk.
  • Reporting that lists risks but never records what decision was made.

Monitoring signals. Feed the register from vulnerability data, incident trends, supplier changes, audit findings and near misses. Vulnerability scores can feed the likelihood rating without replacing judgement; CVSS vs EPSS vs KEV explains each score.

Revision watch. ISO's committee page lists a replacement, ISO/CD 31000, under development. Add a review item to your risk method to check the edition each year, and avoid quoting clause numbers in internal documents without stating the edition.

Questions to ask. Does our security risk method cite a parent policy? Can a second assessor reproduce our ratings from the written criteria? Who accepted each residual risk? Which edition are we working to?

What was not verified. The standard's text was not read for this post, so clause numbers and the framework's component list should be checked against a licensed copy. The principle and process lists come from a university summary of the 2018 edition.

Learn more

Key takeaways

  • ISO 31000:2018 (edition 2, February 2018) is general risk management guidance. It is not certifiable.
  • It has three parts: principles, a framework to embed risk management, and a repeatable process.
  • ISO's committee page shows the 2018 edition as current and a replacement under development; check before citing.
  • ISO/IEC 27005 narrows it to information security and supports ISO/IEC 27001.
  • No audit exists for 27005 or 31000 themselves; people examine your risk records, owners and reviews.
  • Write criteria down, consult beyond security, and record who accepted residual risk.

Sources