ISO 31000
Get Started
What Is ISO 31000?
ISO 31000:2018 is part of the broader ISO 31000 family of risk management standards. These standards are designed to be widely applicable across industries, sectors, and business types, providing a framework of best practices and guidance for organisations implementing risk management principles.
The ISO 31000 Family
ISO 31000, like many other ISO standards, represents a family of risk management standards. The ISO 31000 series currently includes:
- ISO 31000:2018 – Principles and guidelines for implementing risk management
- ISO/IEC 31010:2009 – Techniques for risk assessment
- ISO Guide 73:2009 – Risk management vocabulary
- ISO/IEC 31010 – Technical guidelines for risk assessment
Principles for ISO 31000 Risk Management
Organizations that have implemented ISO 14001: 2015 EMS benefit from the following:
- Generate value for the organisation
- Integrate with organisational processes
- Support effective decision-making
- Address and explain uncertainty
- Be systematic, structured, and efficient
- Rely on the best available information
- Be necessary and adaptable
- Consider human and cultural factors
- Promote transparency and participation
- Be dynamic, iterative, and responsive to change
- Facilitate continuous improvement within the organisation
- Provide a clear framework of reference
- Encourage leadership and commitment
Framework
The ISO 31000 framework is based on the Plan-Do-Check-Act (PDCA) cycle, commonly used in the design of management systems. However, the standard clarifies that the framework is not meant to prescribe a management system. Instead, it is intended to help organisations integrate risk management into their existing management processes, allowing flexibility in how the framework is applied.
Key components of the ISO 31000 framework include:
- Policy and Governance: Establishes the mandate and demonstrates organisational commitment to risk management
- Program Design: Develops the overall structure for managing risks on an ongoing basis
- Implementation: Puts the risk management program and structure into action
- Monitoring and Review: Oversees the performance and effectiveness of the risk management system
- Continual Improvement: Enhances the performance of the management system over time
Risk management process
The risk management process involves the systematic application of policies, procedures, and practices to identify, analyse, and evaluate risks through structured risk assessment.
Risk Identification includes:
Tangible and intangible sources of risk
Opportunities, strengths, weaknesses, and threats (SWOT analysis)
Internal and external context and any changes affecting it
General indicators of potential threats
Organisational assets and resources
Risk Analysis involves:
Assessing the likelihood of possible events and their consequences
Determining the severity of consequences
Considering time-related factors
Evaluating existing controls and their effectiveness
Accounting for complexity
Risk Evaluation:
Compare analysis results against predefined risk criteria
Decide on actions, such as taking no action, addressing the risk, conducting further analysis, maintaining current controls, or revisiting objectives
This entire process should be documented, communicated, and validated across the organisation to ensure effective risk management.
Risk Treatment
The purpose of risk mitigation is to choose and implement strategies that reduce risks. Risk reduction is an ongoing process that involves:
Developing and selecting risk responses based on an understanding of their costs, potential impacts, consequences, and the stakeholders affected.
Benefits for the organisation
- Employees and customers experience increased safety and confidence
- Ensures that risk management processes are effective
- Promotes a preventive culture within the organisation
- Supports continuous improvement of the management system
- Enhances understanding of the importance of identifying, analysing, monitoring, and managing risks at every stage
- Helps identify threats, weaknesses, opportunities, and strengths throughout processes
- Supports compliance with legal and international standard requirements
- Establishes a reliable, decision-focused strategy for planning and operations
Benefits ISO 31000 for stakeholders
- Stakeholders' security
- Enhances effectiveness during emergencies
- Defines clear actions to address potential threats or risks
- Improves financial management and builds trust with economic stakeholders
Market Benefits
- Enhances credibility and reputation
- Builds trust and ensures security
- Strengthens competitiveness
- Helps prevent potential losses
What is the Relationship Between ASIS SPC.1-2009 & Business Continuity
The close release of ISO 31000 and the ASIS SPC.1 Organizational Risk standard raised some questions. Since both provide structured frameworks, organisations may wonder whether the two are equivalent or interchangeable, and how they relate to business continuity.
Although both standards shape management systems and provide structured approaches, SPC.1 has a narrower focus, defining Organizational Resilience primarily in terms of security, preparedness, and continuity.
In contrast, ISO 31000 offers a broader and more comprehensive perspective. From this viewpoint, business continuity is considered just one aspect of the overall risk management program outlined by ISO 31000, addressing specific risks such as process, resource, and technology availability. Therefore, organisations should treat business continuity as a subset within the wider risk management framework of ISO 31000.
