ISO 31000: principles, framework and process of risk management

ISO 31000 is the international standard providing guidelines for risk management: eight principles, a framework driven by leadership and a process that applies to every risk, in any organisation. It is the common reference for risk management, and specialised methods, from ISO 27005 to EBIOS Risk Manager, reuse its process. It has a feature that often surprises: it cannot be certified. Here is what it contains, how it differs from ISO 27005 and how to use it.

ISO 31000, titled “Risk management — Guidelines”, is meant for any organisation, whatever its size, activity or sector, and for every type of risk. It does not say which risks to manage or how to rate them: it describes a way of organising risk management so that it genuinely serves decisions.

• History: a first edition in 2009, then a second in 2018, shorter and focused on value creation, which ISO presented as a simplification. The 2018 edition was reviewed and confirmed in 2023.
• In France: AFNOR publishes it as NF ISO 31000 (June 2018), which replaced the 2010 version.
• Revision under way: a draft third edition is being worked on by technical committee ISO/TC 262, which handles risk management. Until it is published, the 2018 version remains the reference.

It rests on a very short definition of risk: the effect of uncertainty on objectives. That effect can be positive or negative, which makes risk management a decision-making tool as much as a protective one.

At the centre of the standard sits the purpose of risk management: creating and protecting value. Eight principles describe what makes a system effective. They work as a checklist: a system that ignores one of them works badly, even with an excellent rating method.

The framework describes how to embed risk management in the organisation. It puts leadership and commitment at the centre, surrounded by five activities that form a cycle:

• integration: building risk management into governance, strategy and operations;
• design: understanding the organisation and its context, stating commitment, assigning roles and responsibilities, allocating resources, organising communication;
• implementation: rolling the system out, with a plan, deadlines and decisions that genuinely take risk into account;
• evaluation: periodically measuring whether the system meets its objectives;
• improvement: adapting the system and fixing its weaknesses.

This is the most neglected part. Many organisations have a risk assessment process without a framework: no mandate from management, no named owners, no review. The roles this framework must allocate are covered in our articles on risk management and the risk manager.

The ISO 31000 process has six activities, as they appear in the standard's public table of contents:

1. Communication and consultation, throughout the process, with internal and external stakeholders.
2. Scope, context and criteria: what the exercise covers, the internal and external environment, and the criteria that will say whether a risk is acceptable.
3. Risk assessment, in three parts: identification, analysis (causes, consequences, likelihood, effectiveness of existing controls) and evaluation against the criteria.
4. Risk treatment: choosing options (avoid, reduce, share, retain, or take a risk to pursue an opportunity), then a treatment plan.
5. Monitoring and review, to check that the process and its results remain relevant.
6. Recording and reporting, to trace decisions and account for them.

This generic process is the one specialised standards and methods reuse. The diagram below shows how the three parts of the standard fit together, then how the same process is applied in each field.

The standard does not come alone. Two documents most often accompany it:

• ISO 31073:2022, the risk management vocabulary, which replaced the former Guide 73: risk, risk source, risk owner, risk appetite, residual risk;
• IEC 31010:2019, which presents risk assessment techniques: brainstorming, structured interviews, failure mode analysis, fault trees, bow-tie analysis, the severity and likelihood matrix and many more, with their strengths and limits.

These standards share vocabulary with management system standards, which makes it easier to bridge with ISO 27001, ISO 22301 or ISO 9001.

ISO/IEC 27005 applies the ISO 31000 process to information security. Its fourth edition, published in October 2022, is explicitly aligned with ISO 31000:2018 and ISO/IEC 27001:2022. The two standards do not compete: one sets the general framework, the other applies it to one field.

The French EBIOS Risk Manager method fits the same landscape: its guide states that it is compatible with ISO 31000:2018 and consistent with ISO/IEC 27005:2022. In practice, an organisation uses ISO 31000 for its overall system, then ISO 27005 or EBIOS RM for its security risk analyses, with the same scales, so that cyber risks feed into the company's risk map.

It is a frequent question, and the answer is clear: an organisation cannot be certified to ISO 31000. ISO says so itself: the standard provides guidelines, not requirements, so it is not intended for certification, though it can guide internal or external audit programmes. A certifiable standard such as ISO 27001 uses “shall” and sets verifiable requirements; ISO 31000 uses “should” and offers good practice.

Three confusions come up often:

• Personal certificates issued by training bodies (“ISO 31000 risk manager”) show that a person took a course and passed an exam, not that an organisation applies the standard.
• Management system certifications such as ISO 27001 (guide in French), ISO 22301 or ISO 9001 require a risk-based approach. ISO 31000 helps build it, but it is the certifiable standard that is audited.
• A third-party assessment against ISO 31000 is still possible, as an audit or a maturity review. It has value, but does not lead to an accredited certificate.