ISO 31000 · Risk management guidelines

ISO 31000 risk management consulting for decisions made with the risks in full view.

Build enterprise risk management on ISO 31000:2018 with a framework your board owns and a process your managers actually use. Sterling's expert and experienced consultants design the framework with your leadership, run the first risk assessment cycle with your process owners and stay with you until risk information is part of every decision, in 60+ countries. ISO 31000 is guidance, not a certifiable standard: there is no certificate to chase, only a capability to build. We ensure our clients put the standard in place successfully.

Book a free discovery call Start the free ISO 31000 readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced enterprise risk management consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling works with you to put the framework in place; there is no certificate to issue

ISO 31000 at a glance

Purpose: Enterprise risk management: principles, a framework and a process for managing any risk to your objectives, so decisions are taken with the uncertainty understood
Relevant to: Organisations of any size, sector or ownership; boards, executives, risk and compliance functions and any team that decides under uncertainty
Edition: ISO 31000:2018, the second edition, confirmed by ISO in 2023; a third edition is in preparation at committee-draft stage, with no publication date announced
Certification: None. ISO 31000 provides guidelines, not requirements, and cannot be used for certification; the framework is evaluated by your management, internal audit and, if you choose, an independent reviewer
Sterling's role: Framework design with your leadership, the process run with your teams, Effivity, training and the first reporting cycle, then Sustain™
Cost and timing: Total investment for an ISO 31000-based enterprise risk management framework depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months

8,100+ client engagements in 60+ countries.

ISO 31000 client experience

What it is

What is ISO 31000 and what is it used for?

ISO 31000 is the international guideline for managing risk. It defines risk as the effect of uncertainty on objectives and sets out three things: the principles that make risk management effective, a framework for building it into governance and decision-making, and a process for identifying, analysing, evaluating, treating, monitoring, recording and reporting risks. It applies to any type of risk, in any organisation, at any level, from a board setting strategy to a project team choosing a supplier.

Two features set it apart. It contains guidance, not requirements, so there is no audit checklist and no certificate. And it is written for the people who make decisions rather than for a compliance function: its own introduction says it is for use by people who create and protect value in organisations by managing risks, making decisions, setting and achieving objectives and improving performance. The test of an implementation is therefore a question, not a document count: when a significant decision was taken last quarter, was the risk information in the room?

Current edition. ISO 31000:2018, published in February 2018, is the second edition and replaced ISO 31000:2009. Compared with the first edition it reviewed the principles, put leadership by top management and integration with governance at the front of the framework, stressed the iterative nature of the process and streamlined the content into a sixteen-page document. ISO reviewed and confirmed the 2018 edition in 2023, so it remains current. A third edition is in preparation by ISO/TC 262 and stood at committee-draft stage in March 2026, with no publication date announced; because ISO 31000 is guidance, a new edition brings no certificate transition, only a review of what your framework should adopt. IEC 31010:2019 is its companion on risk assessment techniques. ISO 31000 explained: principles, framework and process

Who it is for

Who needs ISO 31000 risk management?

ISO 31000 is written for organisations of all types and sizes, and ISO names regulated sectors such as financial services, healthcare and energy, public bodies, and project and engineering firms among its main users. In practice the trigger is rarely the standard itself. Organisations come to Sterling for ISO 31000-based risk management from four starting points:

The board or a regulator wants a risk framework it can rely on. Directors are asked to confirm that the principal risks are identified and managed, a regulator or lender expects a documented framework, and the current answer is a spreadsheet nobody has reviewed since it was made.
Risk lives in silos. Information security has one register, safety another, finance a third and the projects none. Each uses different scales, so nothing can be compared or escalated, and the executive has no single picture of what could stop the strategy.
Your certified management systems each ask for risk, and each answers differently. ISO 9001, ISO/IEC 27001, ISO 22301, ISO 45001 and ISO 14001 all require actions to address risks and opportunities; one ISO 31000 method beneath them removes duplicate work and contradictory ratings.
Something went wrong that the register never mentioned. A supplier failure, a data breach, a project overrun or a market shift arrived unassessed. You want a process that anticipates and detects change rather than one that records last year's worries.

The intended benefit is better decisions and fewer surprises, with evidence of both. Results depend on leadership using the information and on the process continuing, not on the existence of a framework document.

Business benefits

How ISO 31000 improves decisions and protects value

A risk framework earns its place when it changes what the organisation decides to do. We start from the decisions that matter most to you, such as entering a market, committing capital or selecting a critical supplier, and build the framework so that those decisions carry a risk view by default.

Decisions taken with the uncertainty understoodRisk criteria agreed by leadership, so managers know what can be accepted and what must be escalated before they commit.
One picture for the boardPrincipal risks, their owners, the treatments in progress and the trend, reported on one scale across every function instead of five incompatible registers.
Fewer surprisesA process that monitors change in the context and reassesses risks when the assumptions behind them move, not only at the annual workshop.
Better use of the money spent on controlsTreatments chosen against the criteria and the cost of each option, with residual risk stated, so controls that address nothing significant can be retired.
Certified systems that agree with each otherQuality, security, continuity, safety and environmental risks assessed on one method, so each standard's risk clause is answered once.
Confidence for lenders, regulators and customersA documented framework aligned with the international guideline, with records that show the process operating, ready for any due diligence or review.

Choose a few measures that reflect these outcomes, such as the share of major decisions that carried a risk assessment, treatment actions closed on time or incidents that had been foreseen. Review whether the framework is changing behaviour. A longer register is not a business result.

Principles, framework and process

What does ISO 31000 ask of an organisation?

Nothing, in the sense of a requirement: ISO 31000 contains no "shall". Instead it describes effective risk management in three layers. Clause 4 states the principles; clause 5 describes the framework that fits risk management into governance, leadership and the organisation's activities; clause 6 describes the process applied to decisions, projects, functions or the whole enterprise. The table is a plain-language map of the 2018 edition; your framework is designed against the guideline element by element, and your own governing body decides what good looks like for you.

Element	What it describes	What it looks like in practice
4 Principles	Eight characteristics of effective risk management, centred on the creation and protection of value: integrated, structured and comprehensive, customised, inclusive, dynamic, based on the best available information, attentive to human and cultural factors, and continually improving	A short statement of how the organisation intends to manage risk, used to test every design choice rather than framed on a wall
5.2 Leadership and commitment	Top management and oversight bodies own risk management, align it with strategy and objectives, set the criteria and make sure the resources and accountability exist	A risk management policy or statement signed by leadership, risk criteria approved at board level, and risk as a standing item on the executive agenda
5.3 Integration	Risk management is part of the organisation's purpose, governance, strategy, objectives and operations, not a parallel activity	Risk assessment built into planning, budgeting, project approval, procurement and change, with the decision record showing it
5.4 Design	Understand the external and internal context, articulate the commitment, assign roles, authorities, responsibilities and accountabilities, allocate resources and establish communication and consultation	A framework document that fits the organisation, a responsibility matrix, a budget and calendar, and defined channels for reporting risk up, down and across
5.5 Implementation	Put the framework into operation with a plan, clear decisions on who decides what, and the arrangements to keep it running	A plan with owners and dates, the process launched in the functions and projects in scope, and the first reporting cycle completed
5.6 Evaluation	Measure periodically whether the framework is still suitable and achieving its purpose	An annual framework evaluation, internal audit of the risk process, and a report to leadership on what to change
5.7 Improvement	Adapt the framework to external and internal change and improve it continually	Changes to criteria, scales, roles or tools recorded and communicated; lessons from incidents and near-misses fed back
6.2 Communication and consultation	Involve the right people at each step so that decisions rest on shared understanding and the relevant expertise	Workshops and interviews that reach the people who know the activity, and risk information communicated in a form they can act on
6.3 Scope, context and criteria	Define the scope of each application, understand the context and set the risk criteria, including the amount and type of risk the organisation may or may not take	Scales for likelihood and consequence, an escalation threshold, and criteria that reflect objectives and obligations rather than a generic matrix
6.4 Risk assessment	Identify risks (6.4.2), analyse their nature, likelihood, consequences and existing controls (6.4.3) and evaluate them against the criteria (6.4.4) to decide what needs action	A register with sources, causes and consequences stated, control effectiveness rated, and a documented decision for each risk: treat, tolerate, escalate or take the opportunity
6.5 Risk treatment	Select treatment options by weighing the objectives, the criteria and the costs, then prepare and implement treatment plans	Treatment plans with actions, owners, resources, dates and the expected residual risk, tracked to completion
6.6 Monitoring and review	Check the process and its outcomes throughout, so that the assessment, the treatments and the assumptions behind them stay valid	Key risk indicators, review dates on every risk, triggers that force reassessment, and a periodic review of the whole picture
6.7 Recording and reporting	Document the process and its outcomes and report to the people who need the information to decide	A risk report to management and the board that is decision-oriented, timely and accurate about what is not known

What does useful ISO 31000 evidence look like?

A framework document owned by leadership, approved risk criteria, a register that states causes, consequences and controls rather than one-word labels, treatment plans with owners, a monitoring calendar, the last framework evaluation and the reports that went to management and the board, with minutes that show risk information shaping a decision. We help identify the records your decisions need, without creating documents to fill folders, and they live in Effivity from the first workshop so the framework runs rather than sits.

ISO 31000 explained: principles, framework and process

Implementation route

How do you implement ISO 31000?

There is no certification body in this route. The framework is designed and put into operation, and your own leadership judges whether it works, with internal audit and, where you want one, an independent review as the check. Sterling designs and builds with you; the decisions on criteria, appetite and treatment are yours, and that ownership is what makes the framework worth having.

01
Define what the framework needs to cover.Confirm the entities, functions, projects and decision types in scope, the obligations that expect a framework, and what the board wants to see.
02
Gap analysis: review current practice against the guideline.The gap analysis compares existing registers, criteria, roles and reporting with the ISO 31000 framework and process, keeps what works and agrees actions, owners, dates and resources.
03
Design the framework and agree the criteria.Leadership sets the commitment, the risk criteria and the accountabilities; the process, scales, templates and reporting lines are designed to fit how decisions are made.
04
Run the process and treat the risks that matter.Risk assessment across the agreed scope with the people who know the work, treatment plans for what exceeds the criteria, and monitoring set for the rest.
05
Report, evaluate and address the findings.The first risk report goes to management and the board; internal audit and the framework evaluation test whether the process operated as designed, and gaps are closed with evidence.
06
Embed and review.Risk assessment becomes a standing input to planning, projects, procurement and change; indicators, review dates and the annual evaluation keep the framework current, and Sustain™ supports each cycle.

Check what you are being sold, not just the price. ISO 31000 provides guidelines rather than requirements and cannot be used for certification, so an "ISO 31000 certificate" is a document of the seller's own design. Ask instead how the framework will be designed, who in your leadership will own the criteria, and what will exist in daily work when the consultant leaves. How to choose a credible ISO 31000 provider · The certification buyer's checklist

Cost

How much does ISO 31000 implementation cost?

There is no useful universal price for enterprise risk management. A single-entity professional firm that wants a board-level framework and one annual cycle needs a different scope from a group with regulated subsidiaries, a project portfolio and five registers to reconcile. What we can promise is a proposal in which every component is visible and nothing is added later, with no certification fee, because none exists.

Cost component	What affects it
Consulting and implementation	Current maturity, the entities, functions and decision types in scope, the registers to reconcile, deliverables and how much of the work your team takes on (Design™ or Drive™)
Independent review, if you want one	There is no certification body and no certificate. If your board, a lender or a customer wants an independent opinion on the framework, that review is scoped and priced separately
Internal resources	Leadership time for decisions on criteria and appetite, risk-owner time for assessment and treatment, workshops, and changes to planning or approval processes
Software and learning	Included in a Sterling engagement: Effivity for the register, treatments, indicators and reporting, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	Annual framework evaluation, facilitated reassessments, refresher learning and adoption of the next edition under Sustain™

What moves the price

Number of entities, countries and decision-making levels in scope
Number of existing registers, scales and methods to reconcile
Whether a framework exists today, and how much of it leadership uses
The deadline, and how much of the work your team can carry
Regulatory expectations, group reporting requirements and languages

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, in writing
No certification fee; any independent review you choose identified separately
Effivity, training and Academy access itemised at no additional cost
Payment milestones tied to deliverables, not to the calendar
One all-inclusive proposal. No surprises, ever

Timeline

How long does ISO 31000 implementation take?

The realistic timeline depends on your starting point, how quickly leadership can decide on criteria and appetite, the number of functions and projects to assess and the reporting calendar you want to meet. It is measured in months, not days, typically three to six: the process has to run through one full cycle, from assessment to a report that reaches the board, before anyone can say the framework works. We build the plan around that first cycle, with milestones your team tracks in Effivity.

Phase	What determines the pace
Scope and gap analysis	Access to leadership, existing registers, policies and the records of recent decisions and incidents
Framework design and criteria	How quickly the board and executive can agree the commitment, the criteria and the accountabilities, and the approval route for the framework document
Risk assessment and treatment	The number of workshops, the availability of risk owners, the quality of information on existing controls and the treatment decisions that need budget
First reporting cycle and evaluation	The board calendar, the internal audit slot and the time needed to close the gaps the evaluation finds

If a regulator's date, a lender's condition or a board meeting sets the deadline, share it at the start. We will tell you what is achievable and which decisions cannot wait. A framework promised in weeks, before anyone has met your leadership, is not a project plan; it is a sales tactic.

Challenges

Common ISO 31000 implementation challenges

Most enterprise risk management programmes stall for the same five reasons. Each has a practical answer.

The register is a compliance artefact nobody uses to decide anything.

We start from the decisions, not from the template. Leadership sets the criteria in its own terms, risks are written as cause, event and consequence, and the report is built for the meeting where decisions are taken. A register that changes no decision is redesigned, not expanded.

Every function scores risk on a different scale.

Agree one set of criteria and consequence scales that all functions can map to, keep any technical detail the specialists need beneath it, and consolidate in one Effivity workspace so that security, safety, finance and projects report on the same page.

Leadership delegates risk to a manager and moves on.

The framework only works when leadership owns the criteria and receives the reports. We design the governance so that the owning decisions sit with the board and executive, and Design™ or Drive™ carries the operational work, so ownership costs them hours, not weeks.

Risk owners have no time for another process.

Integration means the assessment happens inside planning, project approval and procurement, where the owners already are, with templates that take minutes. Effivity records the assessment as the work is done, and review dates prompt rather than nag.

The framework was written for a certificate that does not exist.

If a previous provider sold an "ISO 31000 certified" framework, we review what is real, keep what works and rebuild the rest around the guideline: a policy leadership signs, criteria it approves, a process that reaches decisions and records that show it.

Your engagement

What your ISO 31000 engagement includes

Your agreed scope brings together everything a working risk framework and a prepared leadership team need. Most firms deliver a workshop and a template and leave you to make it operate; a Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.

Scope, gap analysis and implementation plan
Responsibilities, dates and decision owners agreed with leadership before the first workshop.
Framework design and documentation
The risk management policy, criteria, roles, process and reporting design, built with your leadership and process owners on Sterling's own template sets.
Effivity ISO & GRC software
Your register, treatments, indicators and reports run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for the people who will audit the framework, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Facilitated risk assessment and treatment planning
Workshops and interviews across the agreed scope, the first register built with the people who know the work, and treatment plans agreed with their owners.
First reporting cycle and framework evaluation
The first risk report to management and the board, an internal audit of the process and the framework evaluation, with gaps closed with evidence before handover.

ISO 31000 provides guidelines, not requirements; there is no certificate to issue and none is promised.

How we deliver

How Sterling supports your ISO 31000 implementation

Every ISO 31000 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Pick the level of support your internal capacity allows; the method, the software and the accountability do not change.

01
Design™Guided implementation: your team builds the framework with Sterling's structure, templates, workshops and coaching.
02
Drive™Fully managed consulting: Sterling consultants take on the agreed design, facilitation and documentation work with your leadership and risk owners.
03
Sustain™After the first cycle: facilitated reassessments, the annual framework evaluation, internal audits, refreshers and new-hire training, year after year.
04
Automate™The framework running in Effivity: register, treatments, indicators, audits, actions and reporting in one workspace.
05
Revise™Adoption of the third edition of ISO 31000 when published, and changes in scope, structure, regulation or appetite.

Before work starts we agree the engagement team, the weekly working session, the deliverables and who decides what. Progress is then reviewed against those commitments, so gaps show early rather than at the board meeting.

How Sterling OS™ works

Often combined with

Standards organisations pair with ISO 31000

Effivity · ISO 31000 risk software, included in every engagement

How Effivity helps you fulfil, automate and simplify the framework and process of ISO 31000:2018.

Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, is part of every Sterling ISO 31000 engagement. Your consultant configures the risk workspace within the agreed scope, so the context, criteria, register, treatment plans, indicators, internal audits and reports to management live in one place, the process runs in daily work and the board reads a live picture rather than a slide assembled the night before. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.

Included in every engagement See Effivity

Effivity: Context of the Organisation dashboard with issues, interested parties and scope — Effivity · Context of the Organisation dashboard

Leadership and commitment

Policy, criteria and accountabilities

The risk management policy with its approvals and distribution, the criteria and escalation thresholds leadership approved, and the roles and authorities for every risk, so ownership is visible rather than assumed.

Design

Context, stakeholders and scope

External and internal issues and the interested parties kept in one register with review dates, so the context that shapes the criteria stays current as the business changes rather than being rewritten before each evaluation.

Integration

Risk inside the processes that decide

Assessments attached to projects, suppliers, changes and objectives, so the risk view is created where the decision is made and the record shows it; the risk clauses of ISO 9001, ISO/IEC 27001 or ISO 22301 use the same method.

Scope, context and criteria

Scales and thresholds, applied consistently

Likelihood and consequence scales, categories and acceptance thresholds configured once and applied to every assessment, so ratings from different functions mean the same thing.

Risk assessment

Identification, analysis and evaluation

Risks captured with source, event, cause and consequence, existing controls rated, likelihood and impact assessed and the level compared with the criteria, with the treat, tolerate or escalate decision recorded against each.

Risk treatment

Treatment plans tracked to closure

Options selected, actions with owners, resources and dates, expected residual risk stated, and progress reported from the plan itself rather than a separate tracker.

Monitoring and review

Indicators, review dates and triggers

Key risk indicators, review dates on every risk and reassessment prompted by change, incidents or missed indicators, with internal audit findings and follow-up in the same workspace.

Recording and reporting

Reports for management and the board

Live dashboards by entity, function and category, the principal risk report generated from the register, and a management review that records its inputs, decisions and actions.

What this means at the review

Whoever reviews your framework, board, internal audit, regulator or independent reviewer, asks for the criteria, the current register, the treatment plans, the indicators, the last framework evaluation and the reports management received. In Effivity each is a screen, with dates, owners and evidence attached, not a folder assembled the week before the meeting. After the first cycle, Sustain™ runs in the same workspace, so every reassessment starts from a framework that never stopped.

Effivity for ISO 31000: the guide Effivity risk and opportunity module on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Your registers, scales and treatment plans migrated, not retyped
Admin and user training for your team
Modules for QMS, ISMS, BCMS, OHSMS and EMS when your certified systems share the method

ISO 31000 client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for ISO 31000 are available on request. The client feedback wall lists every letter by standard.

Programmes with ISO 31000 in scope

How an integrated risk programme runs.

All case studies

01
Enterprise risk management beneath certified systems
ISO 31000 is commonly implemented as the risk method for an integrated system covering ISO 9001, ISO/IEC 27001, ISO 22301 and ISO 45001. In such a programme leadership sets one set of criteria, every function assesses on the same scales, security, continuity, safety and quality risks sit in one register with their treatments, one internal audit covers the process and one report reaches the board, so each standard's risk clause is answered by the same evidence.
How integrated programmes run

Sterling Academy · ISO 31000 e-learning

Train every employee on ISO 31000, not just the risk team.

Sterling Academy delivers e-learning for the whole workforce and for the people who run the framework: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

ISO 31000 awareness for every employee, so risk is reported by the people who see it first
Practitioner courses for risk owners, the risk lead and the managers who chair reviews
Internal auditor training for the people who will audit the framework, as applicable to your standard, as part of the engagement
Learner progress by department and a training status report for the board and any reviewer
New hires trained as they arrive, so competence evidence is current at every evaluation
A Sterling consultant reachable when a learner needs one

Keep exploring

Explore more about ISO 31000

Watch a video on how to implement ISO 31000 here.
Watch a video on ISO 31000 guidelines here.

ISO 31000 resources

Services for ISO 31000

Why Sterling

Want ISO 31000 risk management that changes decisions? Come to Sterling.

Whether you are giving one board a framework it can rely on or aligning risk practice across subsidiaries in several countries, Sterling helps you establish one method with clear local ownership. We work through differences in regulation, reporting lines and appetite between entities, so the framework supports group decisions without flattening the risks each business faces.

Risk management in 60+ countries since 2003

Risk frameworks and the risk clauses of every major management system standard implemented for financial services firms, manufacturers, contractors, BPOs, technology companies and public bodies, with one engagement team accountable across every country you operate in.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with no certification fee because none exists and any independent review you choose identified separately. No surprises, ever.

A framework your people can use

Less documentation and maximum effect: criteria in plain terms, assessments that take minutes inside the processes people already run, and reports built for the meetings where decisions are taken.

Expert and experienced consultants

Consultants who have advised on management systems across sectors and countries since 2003, and who design your risk framework properly the first time, so the board's first report is one it can act on.

Sterling vs the rest: the full comparison Explore ISO 31000 client experience

The Sterling Promise

What our ISO 31000 implementation success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until your agreed ISO 31000 implementation outcome is achieved: the framework designed and approved, the process run across the agreed scope and the first report delivered to management and the board. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability rather than a framework document on a shelf.

The engagement identifies the guideline, scope, outcome and responsibilities. Your organisation supplies accurate information, decides the criteria and appetite and puts the agreed process into use. ISO 31000 carries no certification, so no certificate is promised; where you commission an independent review, its conclusions remain the reviewer's. Our commitment concerns the agreed consulting support, not a promise that no risk will ever materialise.

After implementation

What happens after ISO 31000 implementation?

The framework should keep working as strategy, markets, people and obligations change. Indicators are monitored, review dates fall due, new projects and changes are assessed as they arise, and the register is reassessed when the context moves. Once a year the framework is evaluated against its purpose and improved, and internal audit checks that the process operated as designed.

As the business grows, the framework should evolve with it. Under Sterling OS™ Sustain™ we facilitate the reassessments, prepare the framework evaluation and the board report with you, audit the process and train the people who join, so the framework stays alive between reporting cycles rather than being revived the week before one.

FAQs

Frequently asked questions about ISO 31000

Can an organisation be certified to ISO 31000?

No. ISO 31000 provides guidelines, not requirements, and ISO states that it cannot be used for certification purposes. A provider offering an "ISO 31000 certificate" is offering a document of its own design. What an organisation can have is a framework aligned with ISO 31000, evidence that the process operates and, if it wants one, an independent review of both.

What is the difference between ISO 31000 and a management system standard such as ISO 9001 or ISO/IEC 27001?

ISO 9001 and ISO/IEC 27001 are requirements standards: they use "shall", they are audited clause by clause and an accredited body can certify conformity. ISO 31000 describes how to manage risk well. The management system standards require actions to address risks and opportunities but leave the method to you; ISO 31000 supplies that method.

Can a small business implement ISO 31000?

Yes. The guideline is customised to the organisation's context and applies to any size. A small business usually needs a one-page policy, criteria its owner can explain, a register of the risks that could stop the business and a quarterly review, not an enterprise risk department.

Is ISO 31000 mandatory?

No law requires it in general. Regulators, lenders, governance codes and large customers increasingly expect a documented risk framework, and ISO 31000 is the most widely referenced way to show one, but the guideline is voluntary. Many organisations adopt it with no external demand, because they want fewer surprises and better decisions.

Does Sterling issue any ISO 31000 certificate?

No. Sterling designs and builds the framework with you, trains your people and supports the first reporting cycle. Sterling Academy issues training certificates to individuals who complete its courses; those show personal competence, not certification of the organisation, which does not exist for ISO 31000.

How does ISO 31000 relate to IEC 31010 and to COSO ERM?

IEC 31010:2019 is the companion standard on risk assessment techniques: guidance on selecting and applying methods for identifying, analysing and evaluating risk within the ISO 31000 process. COSO's Enterprise Risk Management framework, Integrating with Strategy and Performance (2017), is a separate framework that emphasises risk in strategy-setting and performance, expected by some parent companies, listings and regulators. The two are compatible: an organisation reporting under COSO can run the ISO 31000 process, and Sterling maps one to the other where required.

We already have risk registers for information security, safety and projects. Do we start again?

No. The gap analysis reviews what exists, keeps the assessments that are sound and reconciles the scales and criteria so that everything can be read together. Specialist methods, such as ISO/IEC 27005 guidance for information security or hazard assessment under ISO 45001, continue beneath common criteria and one report.

Can Sterling support ISO 31000 across countries or subsidiaries?

Yes. A group programme runs with one engagement team, one framework, one Effivity workspace and locally owned registers, with group criteria applied consistently and local differences in regulation and appetite recorded rather than ignored. Remote workshops, interviews and coaching cover most of the work; Sterling's regional offices keep travel short where in-person sessions with a board add value.

What do you need to prepare an ISO 31000 proposal?

The entities, functions and decision types to be covered, approximate headcount, what registers or policies exist today, which certificates you hold, who is asking for the framework, and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to write a risk policy first.

Before the first call

Prepare a useful ISO 31000 readiness brief

You do not need a risk policy before the first discussion. Bring a short account of how decisions are made and where risk information is missing. Seven questions are enough:

Who is asking for a risk framework: the board, a regulator, a lender, a parent company or a customer? Or, if nobody has asked, which decisions or surprises prompted the question?
Which entities, functions, projects and decision types should the framework cover, and which are outside it?
What risk registers, scales, policies or committees exist today, and who uses them?
Which management system certificates do you hold, and how does each currently handle its risk clause?
What did recent incidents, losses, overruns or near-misses tell you about what the current approach did not see?
Who in leadership can decide on criteria and appetite, and who can give time to assessment, treatment and review?
Is there a board date, a regulatory deadline or a reporting cycle to plan around?

These answers let us scope the work and prepare a realistic proposal. They prepare a discussion; they are not a scored assessment or a verdict on your framework.

Don’t be fooled by certification scams

If it comes with an ISO 31000 certificate, it is not ISO 31000.

ISO 31000 provides guidelines, not requirements, and ISO itself states that it cannot be used for certification. That has not stopped a market in "ISO 31000 certified" logos, ten-day risk frameworks and registers copied from another company's template. They cost less, until a director, a regulator or a customer's due diligence team asks what the certificate was assessed against.

How to choose a credible ISO 31000 provider

Walk away from any offer of an "ISO 31000 certificate" for your organisation. There is no accredited certification to ISO 31000; a document with that title is the seller's own creation and will not survive a check with any accreditation body.
Ask who in your leadership will set the risk criteria, and how. A provider that arrives with the criteria already filled in is selling a template, not a framework.
Ask how the risk assessment will reach the people who know the work, and how many workshops or interviews are planned. A register produced by a consultant alone describes the consultant's assumptions.
Identify who carries each task, what the board will receive and when, and what support exists when the first evaluation finds gaps.
Ask what your people will learn and what software the process will run in. No training and no system means the framework ends when the consultant leaves.
Be cautious of "ISO 31000 compliant in ten days" and one invoice for framework and certificate. A process has to run through a full cycle before anyone can say it works, and there is no certificate to invoice for.

All ten warning signs of shortcut certification

What a credible ISO 31000 implementation always involves

Leadership setting the commitment, the criteria and the accountabilities, in writing
Implementation time, in months not days, scaled to your scope and decision structure
Risk assessment with the people who know the work, on criteria that reflect your objectives
Treatment plans with owners, dates and residual risk, tracked to completion
A report that reaches management and the board and shapes a decision
Internal audit and an annual evaluation of the framework, with the changes recorded
No certificate, because ISO 31000 has none; an independent review only if you choose one

Sterling's position. Sterling does not certify, and ISO 31000 cannot be certified. We design the framework with your leadership, run the process with your people and prepare the evidence; whether it works is judged by your board, your internal audit and any independent reviewer you appoint. We do not sell certificates, and we tell you when an offer you have received is one. Accredited certification exists for requirements standards, recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA; a guideline sits outside it.

Holding or been offered an ISO 31000 certificate you are unsure about? Send it to us and we will tell you, at no charge, what it does and does not demonstrate.

Keep exploring

More on ISO 31000 and related standards

Every ISO 31000 guide

Plan your ISO 31000 risk management with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Implement ISO 31000-based enterprise risk managementUnderstand cost, scope and timingPut one risk method under our certified management systemsReview and strengthen an existing risk framework

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice