Risk management frameworks compared: which one fits your organisation?

ISO 31000, COSO ERM, NIST RMF, the NIST AI RMF, ISO 27001 — the names get thrown around as if they were interchangeable. They are not. Some are general guidance, some are certifiable standards, some are written for US federal agencies. Here is what each one is for, what it costs and which one a small or mid-size organisation should actually start with.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 15 min read

What a risk management framework is

The word “framework” is used loosely, so it helps to separate three things that are often blurred together:

• A process — the steps you follow for each risk: identify, analyse, evaluate, treat, monitor. Every framework has one, and they look very similar.
• A framework — the organisational arrangements around the process: who is accountable, how risk appetite is set, how risks are reported to leadership, how the approach is reviewed and improved.
• A management system standard — a framework written as auditable “shall” requirements, so that an accredited body can certify you against it. ISO 27001 and ISO 22301 are examples; ISO 31000 and COSO are not.

The differences between frameworks are mostly in scope (all risks or one domain), audience (board, auditors, engineers, government) and formality (guidance or requirements). The core logic — understand objectives, find what could get in the way, decide what to do about it, keep watching — is shared. If you want the basics before choosing a framework, start with our plain-English guide to what risk management is.

What “enterprise risk management” means

Enterprise risk management (ERM) is risk management applied across the whole organisation rather than in silos. Instead of the IT team keeping a cyber list, finance keeping a credit list and operations keeping a health and safety list, ERM puts all material risks into one view, scores them on one scale and links them to the organisation’s strategy and objectives. That lets leadership compare a supplier failure with a data breach with a lost key customer and decide where money and attention go.

ERM is not a separate framework so much as a level of ambition. ISO 31000 and COSO ERM are both ERM frameworks; the NIST RMF and ISO 27001 are domain frameworks that feed into ERM. For a 40-person company, “ERM” can simply mean one risk register covering everything, owned by named people and reviewed by the leadership team every quarter.

What a risk management framework includes

Whichever framework you follow, a working one has the same parts. ISO 31000 describes the framework as a cycle around leadership and commitment — integration, design, implementation, evaluation and improvement. In documents, that usually means:

The main frameworks side by side

The table compares the frameworks small and mid-size organisations are most likely to meet. “Cost” means the cost of the document itself; implementation and certification audits cost far more, and depend on your size and scope.

Two things stand out. First, the general frameworks (ISO 31000, COSO ERM) are not certifiable, so “being compliant” with them is a matter of judgement, not a certificate. Second, the certifiable standards are domain-specific: you can be certified for information security, AI management or business continuity, but not for “risk management” as a whole.

ISO 31000: the general-purpose default

ISO 31000 is a short international guideline, first published in 2009 and revised in 2018, that applies to any organisation and any type of risk. It is organised in three parts: principles (what good risk management looks like), framework (how to embed it in governance) and process (from setting the context to monitoring and review).

Its strengths for a small organisation are that it is brief, it does not prescribe documents or tools, and its vocabulary — risk owner, risk treatment, residual risk — is the one most auditors, insurers and enterprise customers already understand. Its weakness is the flip side: because it prescribes nothing, it tells you what to achieve but not exactly how. We cover it in depth, including how to apply it in 30 days, in our ISO 31000 guide, so we will not repeat that here.

COSO ERM and COSO Internal Control

COSO — the Committee of Sponsoring Organizations of the Treadway Commission — is a US private-sector initiative backed by accounting and audit bodies. It publishes two frameworks that are often confused.

COSO ERM: Integrating with Strategy and Performance (2017)

The “COSO framework” people search for in a risk context is usually COSO ERM. The 2017 edition replaced the 2004 “cube” and reframed ERM around strategy. It has five components and 20 principles:

COSO ERM is stronger than ISO 31000 on board governance, culture and the link between risk and strategy, and it is the framework US auditors and audit committees know best. It is also much longer, and the full text is a paid publication. For a small private company it is more often a reference than an operating manual.

COSO Internal Control — Integrated Framework (2013)

This is a different document: a framework for designing and assessing internal controls, with five components (control environment, risk assessment, control activities, information and communication, monitoring activities) and 17 principles. It is the framework most US public companies use for their Sarbanes-Oxley assessment of internal control over financial reporting. If your auditors talk about “COSO 2013”, they mean this one, not ERM.

The NIST Risk Management Framework

The NIST RMF is defined in NIST Special Publication 800-37, Revision 2 (December 2018). It is the process US federal agencies must use to manage security and privacy risk for their information systems under FISMA, and it is commonly flowed down to contractors who operate systems on an agency’s behalf. Its seven steps are:

1. Prepare — set roles, risk strategy and organisation-wide context.
2. Categorise — rate the system by the impact of a loss of confidentiality, integrity or availability.
3. Select — choose a baseline of controls from NIST SP 800-53 and tailor it.
4. Implement — put the controls in place and document them.
5. Assess — test whether the controls work as intended.
6. Authorise — a senior official accepts the remaining risk and authorises the system to operate.
7. Monitor — track changes and control effectiveness continuously.

The “authorise” step is the distinctive idea worth borrowing even if you never touch government work: a named senior person explicitly accepts the residual risk of a system before it goes live. For a private company without federal contracts, though, the full RMF and the SP 800-53 control catalogue are heavy. The lighter NIST option is the Cybersecurity Framework (CSF) 2.0, published in February 2024, which organises cyber risk into six functions — Govern, Identify, Protect, Detect, Respond, Recover. It is free, voluntary and a good structure for a cybersecurity risk assessment.

The NIST AI Risk Management Framework

The NIST AI RMF 1.0 (NIST AI 100-1) was published in January 2023. It is voluntary and aimed at anyone who designs, develops, deploys or uses AI systems. It is organised into four functions:

NIST added a Generative AI Profile (NIST AI 600-1) in July 2024, which lists risks specific to generative models, such as confabulation and information integrity. In July 2025 the US AI Action Plan directed NIST to revise the AI RMF; as of October 2026 version 1.0 is still the current published version. If you need a certifiable AI standard rather than voluntary guidance, look at ISO/IEC 42001:2023.

For most small companies the practical point is simple: if staff use AI tools on customer data or AI outputs reach customers, those are risks for your main register, and the four functions are a useful checklist for describing them.

Other frameworks you will meet

• ISO/IEC 27001:2022 — the certifiable information security standard. Its risk assessment can follow ISO 31000; its Annex A lists 93 controls. Usually driven by enterprise customers’ procurement questionnaires.
• ISO 22301:2019 — certifiable business continuity management; useful where downtime is the main risk.
• FAIR — a quantitative model for expressing cyber and operational risk as a range of probable financial loss. Valuable when you need to justify spend in money terms; overkill for a first register.
• ISO/IEC 27005:2022 — guidance on information security risk management, written to support the risk assessment and treatment that ISO 27001 requires.
• COBIT 2019 — ISACA’s framework for governance and management of enterprise IT, popular with IT auditors; risk is one of its governance and management objectives.
• The IIA Three Lines Model (2020) — not a risk process but a model of roles: management owns and manages risk, specialist risk and compliance functions support and challenge, internal audit gives independent assurance. Useful when you start to separate those roles.
• Sector regulation — not frameworks you choose, but rules you must follow: APRA CPS 230 for Australian financial institutions, the EU Digital Operational Resilience Act (DORA) for EU financial entities from January 2025, PCI DSS for anyone handling card data. These sit on top of whichever general framework you use.

Which framework is right for you?

Choose by asking what is forcing the question. A framework adopted because it sounds impressive tends to produce documents; one adopted to meet a real need tends to produce decisions.

A three-question shortcut

1. Does a law, regulator or contract name a framework? If yes, that one is not optional — start there.
2. Do customers ask for a certificate? If yes, you need a certifiable standard for that domain (usually ISO 27001), with a general framework behind it for everything else.
3. Neither? Use ISO 31000. It is the lightest credible option and nobody will criticise you for it.

How to implement a risk management framework

Choosing a framework takes an afternoon; implementing one is where most organisations stall. For a small or mid-size organisation, this sequence gets a working framework in place in about a quarter:

1. Get a sponsor. One senior person — usually the managing director or finance director — who owns the framework and chairs the review.
2. Set scope and objectives. Whole organisation or one division? Write down the objectives risks will be judged against.
3. Pick the backbone. Use the shortcut above; for most, ISO 31000 plus any framework a customer or regulator names.
4. Write the policy and appetite. Two or three pages: why, who, how much risk is acceptable, who can accept residual risk at each level.
5. Define the method. Likelihood and impact scales with written definitions, one matrix, a standard way of writing risks.
6. Build the first register. A workshop with the leadership team; 15–30 risks with owners, controls, scores and actions.
7. Embed it in decisions. Budget rounds, new projects, supplier selection and product launches all start with a look at the register.
8. Monitor, report and review. Monthly for top risks, quarterly to leadership, an annual review of the framework itself.

The test of implementation is simple: in a year’s time, can you point to decisions that changed because of the register? If not, the framework is documentation, not management. Our ISO 31000 guide includes a 30-day version of this plan.

How to combine frameworks without duplicating work

Organisations get into trouble when each framework gets its own spreadsheet: an ISO 27001 risk list, a separate AI risk list, an “ERM register” for the board. The same risk appears three times with three scores and three owners. A better pattern:

1. One process and one scale. Use a single risk matrix for all risks, so a cyber risk and a supplier risk can be compared.
2. One register. Every risk lives once, with a category and tags for the frameworks it relates to.
3. Map controls, not risks. Link each control to the framework requirements it satisfies — one MFA control can meet an ISO 27001 Annex A control, a NIST CSF outcome and a PCI DSS requirement at once.
4. Report from the same data. The board pack, the ISO 27001 risk treatment plan and the AI risk summary are filtered views of the one register.
5. Set appetite once. A single risk appetite statement tells every framework which risks are acceptable.

Common mistakes when choosing a framework

• Choosing by brand. COSO sounds serious, but its full ERM framework is long and written for large organisations. A 30-person firm rarely needs it.
• Confusing guidance with certification. Nobody can certify you to ISO 31000 or COSO ERM. A consultant offering “ISO 31000 certification” is selling a training course or a private attestation.
• Adopting the NIST RMF for a private company. It is excellent, but it is built around federal system authorisation. NIST CSF 2.0 or ISO 27001 is usually the right fit.
• Treating the AI RMF as an IT project. AI risks are often business risks — wrong advice to a customer, a biased hiring screen — and need business owners.
• Running parallel registers. One risk, one entry, one owner.
• Stopping at the framework. The framework is the scaffolding. Value comes from the register being used in decisions and reviewed on a schedule.