ISO 31000 in plain English

ISO 31000 is the most widely referenced risk management standard in the world — and one of the most often misunderstood. Here is what it actually asks you to do, what you produce at each step, and how a mid-size organisation can put it to work in a month.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 11 min read

What ISO 31000 is — and isn’t

ISO 31000 was first published in 2009 and revised in 2018. The 2018 edition is the one in force today. It is short — the core text is around a dozen pages — and deliberately generic: the same guidance applies to a hospital, a software company, a city council or a mining project, and to every type of risk, from cyber attacks to currency swings.

The standard treats risk as the effect of uncertainty on what you are trying to achieve. Two consequences follow. First, a risk only makes sense in relation to an objective — “cyber” is not a risk; “a ransomware attack stops order processing for a week” is. Second, the effect can be positive as well as negative, so the same discipline applies to opportunities.

The principles: what good looks like

The standard puts one idea at the centre — risk management exists to create and protect value — and surrounds it with eight characteristics. In our own words:

The framework: making it stick

The framework is about the organisation, not individual risks. It answers the question: what has to be true for the process to run reliably and influence decisions? It sits on leadership and commitment — without visible support from the top, nothing else holds — and runs as a cycle of five activities:

• Integration — decide where risk management plugs into existing governance: strategy reviews, investment approvals, project gates, board reporting.
• Design — understand the organisation and its context, write a risk management policy, assign roles and accountability, allocate resources and agree how risk information will be communicated.
• Implementation — roll it out with a plan, timelines and training, and make sure decisions actually take risk into account.
• Evaluation — periodically check whether the framework is working against its purpose.
• Improvement — adapt it and fix the gaps found.

For a mid-size organisation the framework usually boils down to three documents and one habit: a short risk management policy, a risk appetite statement, a methodology page with scales and roles — and a recurring agenda item where leadership reviews top risks.

The ISO 31000 risk management process, step by step

The process is the part most people mean when they say “ISO 31000”. It is a loop, not a one-off project. Six core steps run in sequence, while two activities — communication and consultation and recording and reporting — run alongside all of them.

1. Scope, context and criteria

Decide what you are assessing (the whole organisation, a business unit, a project), what the relevant objectives are, and what the internal and external environment looks like — regulation, competitors, technology, dependencies, culture. Then set your risk criteria: the scales for likelihood and impact and the thresholds that decide what is acceptable. Setting criteria before scoring is what makes later decisions defensible.

2. Risk identification

Find, recognise and describe risks that could help or hinder your objectives — including ones whose sources are outside your control. Good descriptions name a cause, an event and a consequence. Techniques range from workshops and interviews to checklists, process walk-throughs and scenario analysis.

3. Risk analysis

Understand each risk: what drives it, which controls exist and how well they work, how likely it is and how bad the consequences could be. Analysis can be qualitative (a 5×5 matrix), semi-quantitative or fully quantitative (loss distributions, Monte Carlo). Record how confident you are — a score based on ten years of incident data is not the same as one based on a hunch.

4. Risk evaluation

Compare the analysis with your criteria and decide what needs action. The output is a decision, not a number: accept, treat, investigate further, or reconsider the objective. This is where inherent and residual scores and your appetite meet.

5. Risk treatment

Choose and implement options. The standard lists more than the classic four Ts, but in practice they group into: avoid the activity, remove the source, change the likelihood, change the consequences, share the risk (insurance, contracts), or retain it knowingly. It also allows for taking on more risk to pursue an opportunity. Treatment plans need owners, deadlines and a check that the treatment does not create new risks.

6. Monitoring and review

Check that risks, controls and treatments are behaving as expected — through scheduled reviews, key risk indicators, incident data and audits — and feed the results back into the earlier steps.

What you produce at each step

ISO 31000 vs COSO ERM, ISO 31010 and other standards

ISO 31000 rarely stands alone. Here is how it relates to the documents it is most often confused with:

Applying ISO 31000 in 30 days (50–500 people)

You do not need a programme of work to be consistent with ISO 31000. A realistic first cycle for a mid-size company:

Then keep the loop going: monthly reviews for critical risks, quarterly for the rest, and a short annual look at whether the framework itself is working. That annual review is the part most organisations forget — and it is the one that turns a register into risk management.

Common myths

• “We are ISO 31000 certified.” Organisations cannot be. If a supplier claims this, they mean they align with it, or a person holds a training certificate.
• “ISO 31000 requires a 5×5 matrix.” It prescribes no scale, matrix or colour scheme. The matrix is just a common way to do analysis and evaluation.
• “It is only about threats.” Uncertainty can work in your favour; the same process applies to opportunities.
• “It is a compliance exercise.” The whole point of the principles is that risk management should change decisions. A register nobody reads does not meet the spirit of the standard, however complete it looks.
• “It is too heavy for a small business.” The guidance explicitly expects you to tailor it. A one-page policy and a 30-line register can be perfectly consistent with ISO 31000.
• “The 2018 version is obsolete.” A revision is in progress, but the 2018 edition remains current until a new one is published, and the core structure is not expected to change.