Better decisions
Risk considered at the point where decisions are made.
Implementation & guidance
ISO 31000 Risk Management
Current edition: ISO 31000:2018 · guidelines
The international guidelines for managing risk in any organisation. ISO 31000 sets out principles, a framework and a process that integrate risk management into governance, strategy and decision-making.
What the guidance covers
Principles, framework and process
ISO 31000 is built around three parts that work together.
Principles
Integrated, structured, customised, inclusive, dynamic, based on best information, human factors, continual improvement.
Leadership and commitment
Top management integrates risk into governance and accountability.
Framework design
Roles, mandates, resources and communication for risk management.
Scope and criteria
Context and risk criteria set for each decision or activity.
Risk assessment
Risk identification, analysis and evaluation.
Risk treatment
Options selected and treatment plans implemented.
Monitoring and review
Risks and controls monitored as conditions change.
Recording and reporting
Risk information reported to support decisions.
Why organisations implement it
What an ISO 31000 framework delivers
Board confidence
A consistent picture of risk across the organisation.
One risk language
Common criteria shared by finance, operations, safety and IT.
Supports certifiable systems
Feeds the risk requirements of ISO 9001, ISO/IEC 27001, ISO 22301 and others.
Regulatory support
A recognised basis for risk governance expectations.
Proportionate effort
Risk management scaled to the organisation.
How we work
Path to an integrated risk framework
One AEC methodology from first assessment to an integrated framework, delivered by registered lead auditors.
- AssessCurrent risk practices and governance reviewed
- DesignFramework, criteria, roles and risk register designed
- ImplementProcess run across priority areas
- TrainLeaders and risk owners trained
- VerifyReview of risk reporting and controls
- SustainFramework integrated into management systems and governance
Framework design
We design an ISO 31000 framework and run the first risk cycle with you.
Typically 2 to 3 monthsFramework review
We review your enterprise risk management against ISO 31000.
Typically 1 to 2 monthsIntegration
We give your management systems one consistent risk process.
Typically 1 to 3 months
How it is recognised
Guidelines, applied within your management systems
ISO 31000 is a set of guidelines and is not certifiable. Its principles and process are applied within certifiable management systems such as ISO 9001, ISO/IEC 27001, ISO 22301 and ISO 37301, which accredited certification bodies certify.
Practical
Guidance turned into a risk process your teams use.
Certifiable route
Where certification is needed, the route is the relevant management system standard.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO 31000 by industry
Finance · enterprise and operational risk
Government · public sector risk governance
Power & utilities · asset and operational risk
Healthcare · clinical and organisational risk
Related standards
Questions
ISO 31000 FAQ
Can we be certified to ISO 31000?
No. ISO 31000 is a set of guidelines. Organisations apply it within certifiable management systems or as the basis for enterprise risk management.
How does ISO 31000 relate to ISO 9001 or ISO/IEC 27001?
Those standards require risk-based planning. ISO 31000 provides a consistent way to do it, so the same risk process can serve several management systems.
Is ISO 31000 the same as COSO ERM?
They are different frameworks with similar aims. Many organisations use elements of both; we help you align them.
How long does it take to put a framework in place?
A framework and first risk cycle typically take 2 to 3 months. Embedding it across the organisation takes longer and continues through management review.
Build a risk framework that works
Tell us your organisation, current risk practices and management systems. We reply with a proposal covering framework design and integration.
Certification, where sought, is carried out by independent, accredited certification bodies. AEC prepares organisations and does not guarantee audit outcomes.