ISO 31000 is an international guidance standard that sets out principles, a framework and a process for managing risk in organisations of any size and sector. It defines risk as the "effect of uncertainty on objectives"; that effect can be negative, but it can also be positive. According to the International Organization for Standardization (ISO), the current version is ISO 31000:2018, which was reviewed and confirmed in 2023.
The standard is being renewed: according to the ISO catalogue, the draft third edition, ISO/DIS 31000, was registered as a Draft International Standard on 3 November 2026 and is in the enquiry phase with ISO members; until the new edition is published, the 2018 edition applies. The techniques for assessing risk are covered in a separate document, IEC 31010, published in 2019.
In short:
- ISO 31000 is a set of guidelines, not requirements; according to ISO it cannot be used for certification.
- The process consists of communication and consultation, scope and context, risk assessment, risk treatment, monitoring and review, and recording and reporting.
- IEC 31010 groups the techniques for the assessment step into 10 categories; HAZOP, FMEA, bow-tie analysis and the risk matrix are among them.
What is ISO 31000, and can you get certified to it?
ISO 31000 is developed by ISO/TC 262, ISO's technical committee on risk management. According to its scope, the document is not industry- or sector-specific and can be used throughout the life of an organisation and in any activity, including decision-making at all levels. It defines risk management as coordinated activities to direct and control an organisation with regard to risk.
Certification is the most common question. ISO's catalogue page is clear: ISO 31000 provides good-practice guidelines but is not a certifiable risk management standard. "ISO 31000 certificates" can therefore only refer to individual training certificates; organisations are not certified against this standard.
According to the foreword, the 2018 edition, which replaced the 2009 edition, reviewed the principles that are the key criteria for success, highlighted top management leadership and the integration of risk management into governance, and put more emphasis on the iterative nature of the process. ISO's brochure adds that some terms were moved to a separate vocabulary document, ISO Guide 73.
What are the steps of the ISO 31000 risk management process?
Clause 6 of the standard describes the process. According to the table of contents, the steps are:
| Step | Content |
|---|---|
| Communication and consultation | Exchanging information with stakeholders and seeking their views |
| Scope, context and criteria | Defining the scope, external and internal context, defining risk criteria |
| Risk assessment | Risk identification, risk analysis, risk evaluation |
| Risk treatment | Selecting treatment options, preparing and implementing treatment plans |
| Monitoring and review | Regular checks of the process and its outcomes |
| Recording and reporting | Documenting results and communicating them to those concerned |
The process does not work on its own. Clause 5 describes the framework it sits in: leadership and commitment, integration, design (understanding the organisation and its context, assigning roles and authorities, allocating resources), implementation, evaluation and improvement. This is why the "scope, context and criteria" step matters: if the organisation does not define up front which risks are acceptable, later evaluation turns into an interpretation that varies from person to person.
A note on terms: "risk assessment" is the overarching step covering identification, analysis and evaluation, while "risk evaluation" is only its last link. Keeping the two clearly separate in internal documents avoids confusion, especially when documents are translated.
Which risk assessment techniques does IEC 31010 include?
According to the International Electrotechnical Commission (IEC) catalogue, IEC 31010:2019 gives guidance on selecting and applying techniques for assessing risk that help decision-making under uncertainty; it is published as a double-logo standard with ISO. The second edition, published on 13 June 2019, replaced the first edition of 2009; the number and range of techniques were increased, and the concepts covered in ISO 31000 are no longer repeated. The document runs to 264 pages.
Annex B summarises the techniques in 10 groups by purpose; the table of contents lists 41 technique headings under these groups:
| Group | Example techniques |
|---|---|
| Eliciting views from stakeholders and experts | Brainstorming, Delphi, nominal group, structured interviews, surveys |
| Identifying risk | Checklists, FMEA/FMECA, HAZOP, scenario analysis, SWIFT |
| Determining sources and causes | Ishikawa (fishbone), cindynic approach |
| Analysing controls | Bow-tie, HACCP, LOPA |
| Understanding consequences and likelihood | Bayesian analysis, business impact analysis, event tree, fault tree, human reliability analysis, Markov, Monte Carlo |
| Analysing dependencies and interactions | Causal mapping, cross impact analysis |
| Providing a measure of risk | Toxicological risk assessment, value at risk (VaR), conditional VaR |
| Evaluating the significance of risk | ALARP/SFAIRP, F-N diagrams, Pareto charts, reliability centred maintenance, risk indices |
| Selecting between options | Cost/benefit analysis, decision tree, game theory, multi-criteria analysis |
| Recording and reporting | Risk registers, consequence/likelihood matrix (risk matrix), S-curves |
One detail stands out: the risk matrix sits not among the analysis techniques but in the recording and reporting group. In other words, the matrix is not a substitute for analysis but a way of presenting its results.
How do you choose the right risk assessment technique?
Clauses 6 and 7 of IEC 31010 call for planning the assessment before choosing a technique: defining purpose and scope, understanding the context, engaging stakeholders, considering human, organisational and social factors, and reviewing decision criteria. Then come collecting information and modelling, verifying results, and uncertainty and sensitivity analysis. Tables in Annex A show which step of the ISO 31000 process each technique fits.
The practical questions below are not quoted from the standard but offered as a starting point:
- What is the question? Finding new risks, estimating the likelihood of a known one, or choosing between two options?
- Is there data? With little numerical data, expert-based techniques fit better; with rich data, probabilistic models do.
- Who will take part? Techniques like HAZOP need a multidisciplinary team; if one cannot be formed, a structured checklist is more realistic.
- Who will receive the result? A risk register and matrix suit a board; a fault tree or event tree suits engineering.
Conclusion: is ISO 31000 a procedure or a management language?
ISO 31000 does not hand an organisation a ready-made form; it gives a common language for how risk is discussed, who decides and how the process loops back. IEC 31010 completes the "how do we measure it" side. With the 2018 edition still valid and the third edition at draft stage, this is a good time to review existing risk procedures. A practical first step is to write down the organisation's risk criteria and record, for each risk, which technique was chosen and why. For a worked example, see the article on hazard analysis and the risk matrix.
ISO 31000 risk management is part of Orient Global's corporate training catalogue; details are on the trainings page.
#interimmanagement #forwarddeployedengineering #iso31000 #riskmanagement #iec31010