Implementation walkthrough
How to implement ISO 31000: video walkthrough
A walkthrough of implementing enterprise risk management on ISO 31000:2018, with a framework the board owns and a process managers actually use.
Key takeaways
- ISO 31000 is guidance, not a certifiable standard.
- Leadership owns the framework and approves the risk criteria.
- The first risk assessment cycle is run with the process owners who make decisions.
- Reporting must reach the people who decide, or the framework has no effect.
- Internal audit or an independent review checks the framework; no certificate is issued.
Guidance for decision-makers, not a certificate
ISO 31000 is the international guideline for managing risk. It defines risk as the effect of uncertainty on objectives and sets out three things: the principles that make risk management effective, a framework for building it into governance and decision-making, and a process for identifying, analysing, evaluating, treating, monitoring, recording and reporting risks. It applies to any type of risk, in any organisation, at any level, from a board setting strategy to a project team choosing a supplier.
It contains guidance, not requirements, so there is no audit checklist and no certificate. It is written for the people who make decisions rather than for a compliance function, which means the test of an implementation is whether risk information changes decisions. This short film walks through how that framework is put in place.
Designing and running the framework
Define what the framework needs to cover: the entities, functions, projects and decision types in scope, the obligations that expect a framework, and what the board wants to see. A gap analysis compares existing registers, criteria, roles and reporting with the ISO 31000 framework and process, keeps what works and agrees actions, owners, dates and resources.
Then design the framework with leadership: a risk management policy or statement, risk criteria approved at the top, roles and accountabilities, and the reporting that will reach decision-makers. The first risk assessment cycle is run with process owners, risks are treated and monitored, and the first reporting cycle shows whether the framework works. There is no certification body in this route: your own leadership judges the result, with internal audit and, if you choose, an independent review as the check.
Sterling's expert and experienced consultants design the framework with your leadership and run the first cycle with your teams under Sterling OS™, with the risk register held in Effivity. The decisions on criteria, appetite and treatment remain yours.
ISO 31000 at a glance
- Purpose
- Enterprise risk management: principles, a framework and a process for managing any risk to your objectives, so decisions are taken with the uncertainty understood
- Relevant to
- Organisations of any size, sector or ownership; boards, executives, risk and compliance functions and any team that decides under uncertainty
- Edition
- ISO 31000:2018, the second edition, confirmed by ISO in 2023; a third edition is in preparation at committee-draft stage, with no publication date announced
- Certification
- None. ISO 31000 provides guidelines, not requirements, and cannot be used for certification; the framework is evaluated by your management, internal audit and, if you choose, an independent reviewer
- Sterling's role
- Framework design with your leadership, the process run with your teams, Effivity, training and the first reporting cycle, then Sustain™
- Cost and timing
- Total investment for an ISO 31000-based enterprise risk management framework depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
ISO 31000: questions people ask
Can an organisation be certified to ISO 31000?
No. ISO 31000 provides guidelines, not requirements, and ISO states that it cannot be used for certification purposes. A provider offering an "ISO 31000 certificate" is offering a document of its own design. What an organisation can have is a framework aligned with ISO 31000, evidence that the process operates and, if it wants one, an independent review of both.
What is the difference between ISO 31000 and a management system standard such as ISO 9001 or ISO/IEC 27001?
ISO 9001 and ISO/IEC 27001 are requirements standards: they use "shall", they are audited clause by clause and an accredited body can certify conformity. ISO 31000 describes how to manage risk well. The management system standards require actions to address risks and opportunities but leave the method to you; ISO 31000 supplies that method.
Can a small business implement ISO 31000?
Yes. The guideline is customised to the organisation's context and applies to any size. A small business usually needs a one-page policy, criteria its owner can explain, a register of the risks that could stop the business and a quarterly review, not an enterprise risk department.
Is ISO 31000 mandatory?
No law requires it in general. Regulators, lenders, governance codes and large customers increasingly expect a documented risk framework, and ISO 31000 is the most widely referenced way to show one, but the guideline is voluntary. Many organisations adopt it with no external demand, because they want fewer surprises and better decisions.
Does Sterling issue any ISO 31000 certificate?
No. Sterling designs and builds the framework with you, trains your people and supports the first reporting cycle. Sterling Academy issues training certificates to individuals who complete its courses; those show personal competence, not certification of the organisation, which does not exist for ISO 31000.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 31000
Start with the ISO 31000 page, or go straight to the guide you need.
On the ISO 31000 page
More videos: Governance, risk and resilience
- How to implement ISO 37301Implementation walkthrough · 3 min 15 s
- ISO 37301 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22301Implementation walkthrough · 3 min 24 s
- ISO 22301 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 37001Implementation walkthrough · 3 min 14 s
- ISO 37001 requirements explainedTwo-minute brief · 2 min
- ISO 37500 guidance explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 31000 risk management with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice