IEC 31010 implementation consulting for risk assessments that hold up when decisions are questioned.

What it is

What is IEC 31010 and what is it used for?

IEC 31010 is the international guide to risk assessment techniques. Where ISO 31000 explains how an organisation should manage risk overall, IEC 31010 answers the narrower, practical question that follows: when you need to identify, analyse or evaluate a particular risk, which method should you use, how should you run it and what can its output accurately tell you? It summarises techniques from structured interviews to fault tree analysis and Monte Carlo simulation, with references to fuller descriptions.

Its value lies in matching the method to the decision. A matrix is quick but cannot model a chain of failures in a process plant; a quantitative model is powerful but useless without data. IEC 31010 helps a team choose deliberately and check that the analysis is fit for the decision.

Current edition. IEC 31010:2019, published in June 2019, is the second edition and replaced the 2009 first edition. It is a double-logo standard developed by IEC TC 56 (Dependability) with ISO/TC 262 (Risk management). The owners describe three changes: more detail on planning, implementing, verifying and validating the use of techniques, a larger number and range of techniques, and the removal of concepts previously repeated from ISO 31000. No revision has been announced.

Who it is for

Who uses IEC 31010?

Engineers, project committees, security and privacy leads, food safety teams, treasury functions and internal audit all use IEC 31010. Organisations come to Sterling with it from four starting points:

• A customer or partner questions how you assess risk. A due diligence questionnaire asks which method sits behind your risk ratings; a documented, recognised basis answers it.
• A tender or contract specifies a named technique. Engineering and infrastructure work often calls for HAZOP studies, FMEA or bow tie analysis, run competently and recorded properly.
• A regulator or certification audit challenges your risk assessment. Safety, food, privacy and security regimes expect systematic, repeatable assessments, and a matrix filled in from memory rarely survives scrutiny.
• Group companies rate risk differently. Different methods and scales make group reporting add up numbers that mean different things; a common technique guide makes results comparable.

Requirements

What are the main IEC 31010 requirements?

Strictly, IEC 31010 contains guidance rather than requirements: it describes good practice without mandating it. Its structure, at title level, is below; the core sits in the clauses on implementing risk assessment and selecting techniques, with two informative annexes.

• Core concepts: uncertainty and risk, the ideas every technique rests on.
• Uses of risk assessment techniques: where techniques support decisions across an organisation.
• Plan the assessment: define the purpose, the decision, the scope and the resources before choosing a method.
• Manage information and develop models: gather reliable data, state assumptions and build adequate models.
• Apply risk assessment techniques: use the chosen methods to identify and analyse risk.
• Review the analysis: verify and validate the results, and test how sensitive they are to uncertain inputs.
• Apply results to support decisions: present the output so it informs whether and how to act.
• Record and report the process and outcomes: document the method, its limitations and the conclusions.
• Selecting risk assessment techniques: choose methods according to the purpose, the information available, the complexity and the resources.
• Annex A, categorisation of techniques: tables of each technique's characteristics and where it applies within the ISO 31000 process.
• Annex B, description of techniques: techniques grouped by purpose, from eliciting expert views to evaluating significance, choosing options and reporting.

Implementation route

How do you implement IEC 31010?

There is no audit to pass. Implementation means building the capability to choose and run techniques well and proving it on real decisions. Sterling guides or manages that work; the judgement on whether it is effective belongs to your management and internal audit, and to any regulator or certification body that later reviews your assessments.

1. 01
   Map the decisions that need risk assessment.List where risk is assessed today and what each decision needs from the analysis.
2. 02
   Gap analysis: compare current practice with the guidance.Review existing methods, scales and reports against IEC 31010, keep what works and agree actions and owners.
3. 03
   Select the techniques and write the toolkit.Choose a proportionate set of methods, for example brainstorming and SWIFT for identification, bow tie analysis for controls and a consequence/likelihood matrix for reporting, with guidance on when each applies.
4. 04
   Run facilitated assessments on live decisions.Apply the methods with the people who know the work, review the analysis for soundness and report the results to the decision owners.
5. 05
   Review, train and sustain.Internal audit tests the toolkit, facilitators are trained and reassessment triggers set, with Sustain™ supporting each cycle.

Check the route before you sign. IEC 31010 has no certification scheme, so a document called an "IEC 31010 certificate" carries no accredited standing. Ask who will facilitate the techniques and what experience they have with each method. Where you also need certification to a related standard such as ISO/IEC 27001 or ISO 45001, confirm the certification body's accreditation under the Global ACI arrangement directly with the accreditation body. The certification buyer's checklist

Cost

How much does IEC 31010 implementation cost?

Cost follows the decisions covered and the depth of analysis they need: three workshop methods cost far less than HAZOP studies and fault tree analysis on complex installations. Every proposal shows each component and one all-inclusive proposal.

Timeline

How long does IEC 31010 implementation take?

Most organisations need two to four months, as an estimate: long enough to choose the techniques, write the toolkit and run the first facilitated assessments through to a decision. Quantitative methods and multi-site programmes take longer. Milestones are tracked in Effivity.

If a tender, project gate or audit sets the date, tell us at the outset and we will say what is realistic.

Your engagement

What your IEC 31010 engagement includes

Every engagement runs on Sterling OS™, with two alternative support levels: Design™, where we guide your team, or Drive™, where we manage the work and facilitate the assessments. Sustain™ follows the first cycle; Automate™ is Effivity.

• Decision mapping, gap analysis and plan

  Scope, owners and dates agreed before any workshop is booked.

• Risk assessment technique toolkit

  Methods, worksheets, scales and selection guidance built on Sterling's own templates and fitted to your decisions.

• Effivity ISO & GRC software (Automate™)

  Registers, assessments and actions in Effivity from the start, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Facilitated assessments on live decisions

  Guided or led by us, with every result reviewed before release.

• Internal audit and Sustain™

  A check that the toolkit is followed, then support for reassessments.

Sterling does not certify, and there is no IEC 31010 certificate; any certification to a related standard is decided by an independent, accredited certification body.

Often combined with

Standards organisations pair with IEC 31010

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.