orbit by reconn.
Insights around Applied AI, AI Governance, AI Security and everything around it
Risk management insights for ISO 31000, emerging risks and information security risk
Risk management is the coordinated set of activities an organization uses to direct and control itself with regard to risk. This blog explains how ISO 31000, ISO/TS 31050 and ISO/IEC 27005 fit together, written by PECB Certified Trainer Shenoy and sourced from standards bodies.
Every great mission starts with reconn.
What this blog covers
Three standards sit behind most risk management work. Each one links to the official page at ISO, so you can check every claim.
ISO 31000
The international guideline on risk management. Learn its principles, framework and process, and how to apply them in any organization, whatever its size or sector.
ISO/TS 31050
A technical specification on managing emerging risks to enhance resilience. See how to spot weak signals early and build them into your existing risk process.
ISO/IEC 27005
Guidance on managing information security risks, built to support an ISO/IEC 27001 information security management system. Learn how it applies the ISO 31000 approach to cyber and information risk.
All Risk Management articles
Every post in this blog, newest first.
Risk management questions, answered
What is risk management?
Risk management is the coordinated set of activities an organization uses to direct and control itself with regard to risk. It covers identifying, analyzing and evaluating risk, treating it, and monitoring and communicating throughout.
What is ISO 31000?
ISO 31000 is the international guideline on risk management. It describes eight principles, a framework and a process that any organization can use, whatever its size, sector or activity. It gives guidance, so organizations cannot be certified against it.
Can an organization be certified to ISO 31000?
No. ISO 31000 provides guidelines, not requirements, so there is no certification of an organization against it. Individuals can earn a PECB ISO 31000 professional certification, which shows personal competence rather than organizational conformity.
What is ISO/IEC 27005 used for?
ISO/IEC 27005 gives guidance on managing information security risks. It supports an ISO/IEC 27001 information security management system by describing how to identify, analyze, evaluate and treat information security risks.
Which PECB course fits my role?
ISO 31000 Lead Risk Manager suits people who build and run enterprise risk management. ISO 31050 Emerging Risks Manager focuses on emerging risks, and ISO 27005 Risk Manager on information security risk. PECB sets and proctors every exam.
Who writes the Risk Management articles?
Shenoy, founder of reconn, writes them. He is a PECB Certified Trainer and holds the ISO 31000 Senior Lead Risk Manager credential. Articles cite standards bodies and other official sources.
Last updated
Build risk management skills with a PECB Authorized Titanium Partner
reconn is a PECB Authorized Titanium Partner. Pick the course that matches your role, or ask a PECB Certified Trainer which format fits.
ISO 31000 Lead Risk Manager
Learn to build and run a risk management framework and process. Self-study or eLearning, with a 1-hour session with a PECB Certified Trainer.
Explore ISO 31000 Lead Risk ManagerISO 31050 Emerging Risks Manager
Learn to identify and manage emerging risks to enhance resilience. Self-study, with a 1-hour session with a PECB Certified Trainer.
Explore ISO 31050 Emerging Risks ManagerISO 27005 Risk Manager
Learn to manage information security risk in line with ISO/IEC 27005. Self-study or eLearning, with a 1-hour session with a PECB Certified Trainer.
Explore ISO 27005 Risk ManagerEvery enrollment includes email and WhatsApp support until you clear the exam, within 12 months of enrollment.