Two-minute brief
ISO 31000 guidelines explained: video brief
A two-minute brief on the three layers of ISO 31000:2018, principles, framework and process, and why it contains no requirements to certify against.
Key takeaways
- ISO 31000 contains guidance, not requirements, and cannot be certified.
- Eight principles centre risk management on creating and protecting value.
- The framework fits risk management into governance and leadership.
- The process runs from context and criteria through assessment and treatment to reporting.
- Risk is defined as the effect of uncertainty on objectives.
Three layers: principles, framework, process
ISO 31000 contains no requirements in the auditing sense: there is no shall to comply with. Instead it describes effective risk management in three layers. Clause 4 states the principles, clause 5 describes the framework that fits risk management into governance, leadership and the organisation's activities, and clause 6 describes the process applied to decisions, projects, functions or the whole enterprise. This short film walks through the three.
The principles are eight characteristics of effective risk management, centred on the creation and protection of value: integrated, structured and comprehensive, customised, inclusive, dynamic, based on the best available information, attentive to human and cultural factors, and continually improving. In practice they become a short statement of how the organisation intends to manage risk, used to test every design choice rather than framed on a wall.
ISO names regulated sectors such as financial services, healthcare and energy, public bodies, and project and engineering firms among its main users.
The framework and the process in practice
The framework starts with leadership and commitment: top management and oversight bodies own risk management, align it with strategy and objectives, set the criteria and make sure the resources and accountability exist. It continues through integration into the organisation's activities, design, implementation, evaluation and improvement of the framework itself.
The process sets the scope, context and criteria, then assesses risk through identification, analysis and evaluation, treats it, monitors and reviews it, and records and reports it, with communication and consultation throughout. ISO 31000:2018 is the second edition, confirmed by ISO in 2023, and a third edition is in preparation. Because it is guidance, it cannot be used for certification; your own governing body decides what good looks like, with internal audit as the check.
The test of an implementation is therefore practical: whether risk information reaches the people who decide, in time to change the decision, rather than whether a register exists.
ISO 31000 at a glance
- Purpose
- Enterprise risk management: principles, a framework and a process for managing any risk to your objectives, so decisions are taken with the uncertainty understood
- Relevant to
- Organisations of any size, sector or ownership; boards, executives, risk and compliance functions and any team that decides under uncertainty
- Edition
- ISO 31000:2018, the second edition, confirmed by ISO in 2023; a third edition is in preparation at committee-draft stage, with no publication date announced
- Certification
- None. ISO 31000 provides guidelines, not requirements, and cannot be used for certification; the framework is evaluated by your management, internal audit and, if you choose, an independent reviewer
- Sterling's role
- Framework design with your leadership, the process run with your teams, Effivity, training and the first reporting cycle, then Sustain™
- Cost and timing
- Total investment for an ISO 31000-based enterprise risk management framework depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
ISO 31000: questions people ask
Can an organisation be certified to ISO 31000?
No. ISO 31000 provides guidelines, not requirements, and ISO states that it cannot be used for certification purposes. A provider offering an "ISO 31000 certificate" is offering a document of its own design. What an organisation can have is a framework aligned with ISO 31000, evidence that the process operates and, if it wants one, an independent review of both.
What is the difference between ISO 31000 and a management system standard such as ISO 9001 or ISO/IEC 27001?
ISO 9001 and ISO/IEC 27001 are requirements standards: they use "shall", they are audited clause by clause and an accredited body can certify conformity. ISO 31000 describes how to manage risk well. The management system standards require actions to address risks and opportunities but leave the method to you; ISO 31000 supplies that method.
Can a small business implement ISO 31000?
Yes. The guideline is customised to the organisation's context and applies to any size. A small business usually needs a one-page policy, criteria its owner can explain, a register of the risks that could stop the business and a quarterly review, not an enterprise risk department.
Is ISO 31000 mandatory?
No law requires it in general. Regulators, lenders, governance codes and large customers increasingly expect a documented risk framework, and ISO 31000 is the most widely referenced way to show one, but the guideline is voluntary. Many organisations adopt it with no external demand, because they want fewer surprises and better decisions.
Does Sterling issue any ISO 31000 certificate?
No. Sterling designs and builds the framework with you, trains your people and supports the first reporting cycle. Sterling Academy issues training certificates to individuals who complete its courses; those show personal competence, not certification of the organisation, which does not exist for ISO 31000.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 31000
Start with the ISO 31000 page, or go straight to the guide you need.
On the ISO 31000 page
More videos: Governance, risk and resilience
- How to implement ISO 37301Implementation walkthrough · 3 min 15 s
- ISO 37301 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22301Implementation walkthrough · 3 min 24 s
- ISO 22301 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 37001Implementation walkthrough · 3 min 14 s
- ISO 37001 requirements explainedTwo-minute brief · 2 min
- ISO 37500 guidance explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 31000 risk management with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice