Quick reference
Memory aid
Principles (why) → Framework (set up) → Process (do it). Context → Identify → Analyze → Evaluate → Treat → Monitor.
TL;DR
ISO 31000 provides a universal risk management approach: establish context, identify risks, analyze and evaluate them, treat the important ones, and monitor continuously. It's flexible by design — scale it to your organization's needs.
What Is ISO 31000?
A universal risk management standard with three parts: principles (why), a framework (how to set up), and a process (how to do it) — applicable to any type of risk in any organization.
ISO 31000 provides a pragmatic, principles-based approach to risk management. It defines eight principles that describe what effective risk management looks like, a framework for integrating risk management into the organization, and a six-step process for identifying, analyzing, evaluating, and treating risks. Unlike COSO, it is intentionally flexible and non-prescriptive, allowing organizations to adapt it to their context. It is not a certifiable standard — it provides guidance rather than requirements.
ISO 31000 Risk Management Process
The iterative risk management process at the core of ISO 31000, supported by continuous communication and monitoring.
Scope, Context & Criteria
Define the parameters for risk management
Risk Identification
Find, recognize, and describe risks
Risk Analysis
Comprehend the nature and level of risk
Risk Evaluation
Compare against criteria to determine treatment
Risk Treatment
Select and implement options to address risk
Origin & context
Developed to provide a universal, non-certifiable risk management standard that could be applied across all industries and risk types. Revised in 2018.
Core Components
Principles
Eight principles describing the characteristics of effective risk management.
Example
Risk management should be 'integrated' — part of all organizational activities, not a separate function.
Framework
The organizational infrastructure for implementing risk management: leadership, integration, design, implementation, evaluation, and improvement.
Example
An organization integrates risk considerations into its project approval process, budgeting cycle, and performance reviews.
Process
The practical steps for managing risk: communicate, establish context, assess risks, treat risks, monitor, and report.
Example
A project team identifies risks through brainstorming, analyzes their likelihood and impact, evaluates which need treatment, and implements mitigations.
Risk Assessment
The core analytical steps: identify what could happen, analyze how likely and how severe, evaluate which risks need treatment.
Example
A supply chain team identifies 40 potential risks, analyzes each for probability and impact, and prioritizes the top 10 for treatment.
ISO 31000 has been adopted as a national standard by many countries and is one of the most widely used risk management standards. Unlike management system standards such as ISO 9001, it is intentionally non-certifiable, designed as guidance rather than requirements.
When to Use ISO 31000
Project risk management
Problem it solves: Projects lack a systematic approach to identifying and managing risks.
Real-world application
A construction firm adopts ISO 31000 to standardize risk management across all projects, so cost and schedule risks are identified and owned before work begins.
Cross-industry risk management
Problem it solves: Industry-specific frameworks don't apply to diverse organizations.
Real-world application
A conglomerate with operations in manufacturing, retail, and services uses ISO 31000 as the common risk management framework across all divisions.
SME risk management
Problem it solves: Small and medium enterprises need a practical, scalable risk framework.
Real-world application
A 50-person tech company applies ISO 31000 principles in a simplified way — monthly risk reviews with a simple register and clear ownership.
ISO 31000 defines risk as 'the effect of uncertainty on objectives' — not just negative events. This means opportunities are risks too, and should be managed proactively.
How to Apply ISO 31000: Step by Step
Before you start
- →Management commitment to risk management
- →Clear organizational objectives against which to assess risk
- →Basic understanding of the organization's risk landscape
Establish context and criteria
Define the scope, context, and risk criteria for your risk management activities.
Tips
- ✓Align risk criteria with organizational objectives
- ✓Consider internal and external context
Common mistakes
- ✗Skipping context-setting and jumping straight to risk identification
Risk identification
Identify risks that could affect the achievement of objectives, including sources, events, causes, and consequences.
Tips
- ✓Use multiple techniques: workshops, checklists, interviews, PESTEL
- ✓Include opportunities, not just threats
Common mistakes
- ✗Only identifying familiar risks; missing novel or systemic risks
Risk analysis and evaluation
Analyze the likelihood and consequences of each risk, then evaluate which risks need treatment based on your criteria.
Tips
- ✓Use both qualitative and quantitative methods
- ✓Consider risk interdependencies
Common mistakes
- ✗Over-relying on quantitative analysis without qualitative judgment
Risk treatment
Select and implement risk treatment options: avoid, reduce, share, or accept the risk.
Tips
- ✓Consider cost-benefit of each treatment
- ✓Assign clear ownership for each treatment
Common mistakes
- ✗Treating every risk equally rather than prioritizing based on evaluation
Monitor, review, and improve
Continuously monitor risks, review the effectiveness of treatments, and improve the process.
Tips
- ✓Use Key Risk Indicators for early warning
- ✓Conduct regular reviews, not just annual
Common mistakes
- ✗Setting up the process once and never reviewing it
Value & Outcomes
Primary benefit
Provides a flexible, internationally recognized framework for managing any type of risk systematically.
Additional benefits
- ✓Applicable to any organization size and sector
- ✓Creates a common risk language
- ✓Improves decision-making under uncertainty
What you'll learn
- →How to establish a risk management process
- →How to identify, analyze, and treat risks systematically
- →How to integrate risk management into organizational decision-making
Typical outcomes
Best Practices
📋 Preparation
- •Start with a risk management maturity assessment
- •Identify the most critical objectives to protect
🚀 Execution
- •Keep the process proportionate to the organization's size and complexity
- •Focus on risk ownership — every risk needs an owner
- •Communicate risk information to those who need it to make decisions
🔄 Follow-Up
- •Review the risk register at least monthly
- •Update risk assessments when significant changes occur
- •Learn from risk events through post-incident reviews
💎 Pro Tips
- •Don't over-engineer the process — a simple, well-used risk register beats a complex unused one
- •Make risk discussions a standing agenda item in management meetings
ISO 31000 is deliberately flexible. Don't try to implement every aspect at once. Start with the process, then build the framework around it.
Limitations & Pitfalls
Non-certifiable — cannot demonstrate compliance through certification
Mitigation: Use ISO 31000 as guidance alongside certifiable standards like ISO 27001 where certification is needed
Intentionally high-level — may need supplementation for specific risk domains
Mitigation: Combine with domain-specific standards (e.g., ISO 27005 for information security risk)
Where this comes fromInternational Organization for Standardization (ISO) introduced this (2009).
More Management Frameworks
Other frameworks in the Stratrix library.
Compliance Management Framework
A structured system for ensuring an organization meets all applicable legal, regulatory, and ethical requirements through policies, training, monitoring, and enforcement.
Risk & GovernanceCorporate Governance Framework
A system of rules, practices, and processes by which an organization is directed and controlled, balancing the interests of stakeholders including shareholders, management, customers, suppliers, and the community.
Risk & GovernanceFMEA
A systematic method for identifying potential failure modes in a product, process, or system, analyzing their effects, and prioritizing actions to prevent or mitigate failures.
Risk & GovernanceThree Lines Model
A governance model that structures an organization's risk management and assurance activities into three distinct lines: management controls, risk oversight functions, and independent assurance.
Risk & GovernanceMonte Carlo Simulation
A quantitative risk analysis technique that uses random sampling and probability distributions to model the range of possible outcomes for uncertain decisions, providing probability-based insights rather than single-point estimates.
Risk & GovernanceRisk Appetite Framework
A governance framework that defines how much risk an organization is willing to accept in pursuit of its objectives, providing boundaries for decision-making at all levels.
More from Stratrix
Test a decision, free
Set a live decision against the companies that made it before you.
AcquisitionsThe Distance TestDivestituresThe Divestiture TestDiversificationThe Diversification TestMake or buyThe Make-or-Buy TestAll Access
Every Casebook, three Strategy Packs a seat each year and the Analyst, for teams that face these decisions all year.
$1,999 a year · $499 a seatWhat is included →New analyses, by email
The defining moves in business, checked against the record, as they publish.
See ISO 31000 in the wild.
Follow ISO 31000 across the companies and lenses where it actually shaped the strategy — the decision, the rationale, and how it played out.