Whitepapers
MIN READ
ISO 31000 is an international standard issued in 2009 by ISO (International Organization for Standardization), and it is intended to serve as a guide for the design, implementation and maintenance of risk management.
All types and sizes of organizations face internal and external factors and influences that make it uncertain whether and when they will achieve their objectives. The effect this uncertainty has on an organization’s objectives is risk.
Risk is involved in any activity of an organization. ISO 31000:2009 describes a systematic and logical process, during which organizations manage risk by identifying it, analyzing and then evaluating whether the risk should be modified by risk treatment in order to satisfy their risk criteria.
Risk management can be applied to an entire organization, at its many areas and levels, at any time, as well as to specific functions, projects and activities.
ISO 31000 provides principles and generic guidelines to assist organizations in establishing, implementing, operating, maintaining and continually improving their risk management framework.
It is not specific to any industry or sector, so it can be used by any public, private or community enterprise, association, group or individual. This standard can be applied throughout the life of an organization, and to a wide range of activities, including strategies and decisions, operations, processes, functions, projects, products, services and assets.
This standard is not intended to promote uniformity of risk management across organizations. The design and implementation of risk management plans and frameworks will need to take into account the varying needs of a specific organization, its particular objectives, context, structure, operations, processes, functions, projects, products, services, or assets and specific practices employed.
Risk management is defined as a set of coordinated activities to direct and control an organization with regard to risk.
This figure shows the relationships between the risk management principles, framework and process
ISO 31000 is organized into the following main clauses:
Clause 3: Principles
Clause 4: Framework
Clause 5: Process
Each of these key activities is listed below.
In order to have an effective risk management, an organization has to comply with these 11 principles.
ISO 31000 states that the success of risk management will depend on the effectiveness of the management framework providing the foundations and arrangements what will embed it throughout the organization at all levels.
The framework:
This clause describes the necessary components of the framework for managing risk and the way in which they interrelate in an iterative manner.
Mandate and commitment: Management of the organization needs to demonstrate a strong and sustained commitment to risk management by defining risk management policy, objectives, ensuring legal and regulatory compliance, ensuring necessary resources are allocated to risk management, communicating the benefits of risk management to all stakeholders.
Design of framework for managing risk: Before the implementation, the organization must design a framework for managing risk. This includes:
ISO 31000 can be easily linked with other Risk Management standards, like ISO Guide 73:2009 – Risk management vocabulary, and ISO/IEC 31010:2009 – Risk management – Risk assessment techniques. ISO/IEC 31010 is a supporting standard for ISO 31000 and provides guidance on selection and application of systematic techniques for risk assessment.
Based on the ISO 31000 framework, the ISO 27005 standard explains in detail how to conduct a risk assessment and a risk treatment, within the context of information security.
As with all major undertakings within an organization, it is essential to gain the backing and sponsorship of executive management. By far the best way to achieve this, rather than through highlighting the negative aspects of not having risk management, is to illustrate the positive gains of having an effective risk management framework in place.
Risk management allows an organization to ensure that it knows and understands the risks it faces. The adoption of an effective risk management process within an organization will have benefits in a number of areas, examples of which include:
Making the decision to implement a risk management framework based on ISO 31000 is often a very simple one, as the benefits are well documented. By following a structured and effective methodology, an organization can be sure to cover all minimum practices required for the implementation of risk management programme.
There is no single blueprint for implementing ISO 31000 that will work for every company, but there are some common steps that will allow you to balance the often conflicting requirements and prepare you for a successful certification audit.
PECB has developed a framework for risk management. It is called “PECB Risk Management Framework” and is based on applicable best practices.
The certified ISO 31000 Risk Manager credential is a professional certification for professionals needing to demonstrate the competence to implement, maintain and manage a risk management program according to ISO 31000.
Share
Beyond Recognition
©2025 Professional Evaluation and Certification Board. All rights reserved.
