ISO 31000 risk management: principles, framework and process

What ISO 31000 is, and what it is not

ISO 31000:2018, Risk management: Guidelines, is the second edition of the standard, published in February 2018. It is short: ISO's catalogue lists it at 16 pages. ISO last reviewed and confirmed it in 2023 and also notes that it is to be revised, so the 2018 edition is the one to use today, and a new one may come.

The standard defines risk as the effect of uncertainty on objectives. Two things in that sentence do the work. A risk only exists relative to something you are trying to achieve, so "what is our objective here?" always comes before "what could go wrong?" And the effect can be positive or negative, which is why ISO 31000 treats opportunities and threats in the same process.

It is not a certification scheme. ISO says plainly that it gives guidance and cannot be used for certification. It also does not tell you which technique to use. There is no required matrix, no mandatory scoring scale. Assessment techniques sit in a companion document, IEC 31010:2019, which ISO lists alongside the standard. What ISO 31000 gives you is a shared structure and shared vocabulary, so that a project manager, a CFO and an auditor are describing the same thing when they say "risk".

The eight principles

The principles are the test of whether risk management in your organization is working. If one of them is missing, the process on paper will not save you.

The ones that tend to slip are integration, dynamism and culture. A register that is reviewed once a year and never consulted when a decision is made breaks all three at once.

The framework: building risk management into the organization

The framework answers a different question from the process. The process tells you how to assess and treat risk for something specific. The framework asks whether the organization is set up so that this actually happens, with the right owners, resources and routines. PECB's Lead Risk Manager handbook treats it as a separate exam domain, covering the framework's components, leadership commitment, roles, the risk management policy and plan, and how the framework is evaluated and improved.

Leadership and commitment is the component to look at first. When senior managers do not use risk information to make decisions, everything beneath them turns into paperwork.

The risk management process

The process has six activities. You can apply it to a strategy, a project, a system or a supplier. It is iterative: findings in one activity send you back to another. Communication and consultation, and monitoring and review, are not steps you finish early. They run alongside everything else.

Risk assessment has three parts

Identification finds, recognizes and describes the risks. Analysis builds an understanding of each one: its causes, likelihood and consequences. Evaluation compares the results with the criteria you set earlier and decides which risks need treatment. The order matters. If you set the criteria after you have scored the risks, you are tuning the criteria to the answer.

Treatment options

Treatment is a decision about what to do with a risk, and adding a control is only one answer. The options include avoiding the activity, taking or increasing a risk to pursue an opportunity, removing the source, changing the likelihood or the consequences, sharing the risk through insurance or contracts, and retaining it by informed decision. PECB's handbook also lists the ability to define acceptable and unacceptable risk levels, build a risk register and protect risk records, so expect all three in practice.

A worked example

Illustrative scenario with invented figures, not a client case.

A mid-size online lender plans to add instant payouts and wants to launch in 90 days. Scope is the payout feature only. The context includes a regulator that expects safeguards on customer money and a dependency on one payment partner. The team sets its criteria before scoring anything: a three-level scale for likelihood and consequence, consequence defined by customer harm, financial loss and regulatory action, and a rule that any high risk needs the product owner's sign-off before launch.

What makes this useful is the trail it leaves. The criteria came first, each risk has an owner, the treatment choice is visible, and a named person with authority accepts what is left. Six months later, when something goes wrong or an auditor asks, you can show why the decision was made.

Where ISO 31000 sits among other standards

Think of ISO 31000 as the general approach, with narrower standards underneath. IEC 31010:2019 covers risk assessment techniques. ISO 31073 holds the vocabulary, and PECB's sample exam questions treat it as the standard that defines generic risk terms. ISO/IEC 27005 applies risk management to information security, and ISO/IEC 27001 requires an information security risk assessment as part of its management system. The management system standards are certifiable. ISO 31000 is not.

Common mistakes

Four failures come up again and again. Criteria set after scoring, which makes the results look more precise than they are. Risks with no owner, so nobody acts. A register treated as the goal, when the real output is better decisions. And one-off assessments presented as risk management: PECB's handbook asks candidates to tell the two apart, because the difference matters. An assessment tells you where you stand. Management is what you do next.

A fifth is easier to miss. Because the definition covers positive effects, a process that only lists threats is incomplete. Ask what could go better than planned, and whether you are prepared to take advantage of it.

From the standard to a credential

Because ISO 31000 cannot be certified, PECB certifies people, not organizations. The credential depends on your experience, not on which exam you take.

Every level also requires signing the PECB Code of Ethics, and every certification is valid for three years. The Lead Risk Manager exam has 80 multiple-choice questions, a 70% pass mark, and is open book: you may bring a hard copy of ISO 31000, your course materials and your own notes. The course is four training days plus the exam. PECB sets and proctors the exam. Your training fee covers the first attempt, one free retake, the certification application fee and the first year of the annual maintenance fee, and you apply within 12 months of purchase for self-study and eLearning formats.

reconn attaches support to every enrollment: a free 1-on-1 session with a PECB Certified Trainer, and email and WhatsApp help until you clear the exam, within 12 months of enrollment. That is support, not a pass guarantee.