ISO 31000 risk management guidance
ISO 31000 gives guidance on managing risk in any organization. It describes principles, a framework and a process for dealing with uncertainty in a consistent way, from strategy to daily operations. It is a set of guidelines and is not intended for certification. Organizations use it to shape their own approach, and to bring a common risk language to other management systems.
Updated 5 November 2026
Info. Showing a standard does not mean a partner holds scope for it. How matching works.
Who it may be relevant for
- Boards, executives and risk managers building or improving a risk framework
- Organizations with several management systems that want a shared way to treat risk
- Public and private bodies setting risk policy for projects and operations
- Teams that want a plain structure for risk assessment without heavy bureaucracy
What it covers
- Principles describing what effective risk management looks like
- A framework for integrating risk management into governance, planning and decisions
- A process for identifying, analysing, evaluating and treating risks
- Communication, consultation, monitoring and review of risk
- Recording and reporting on risk to decision makers
What it can help with
- A shared language for risk across departments, sites and projects
- Decisions that take uncertainty and its effect on objectives into account more openly
- A better fit between risk work and other systems such as quality, safety and security
- A defined way to review whether risk management is working
What the pathway means
ISO 31000 gives guidance and is not intended for certification. There is no certificate to obtain, and an organization cannot be certified to it. It can be adopted internally and reviewed through internal or advisory reviews. If a company says it is certified to ISO 31000, treat that as a red flag and ask what exactly was audited. For certifiable standards that use risk-based thinking, see the related pages. MIYAAR CONNECT does not audit or certify.
Where it is typically used
- A group aligning risk registers from finance, operations and safety under one process
- A project-based business defining how risks are assessed at bid, start-up and delivery stages
- An organization using it to design the risk-assessment steps inside ISO 9001 or ISO/IEC 27001
What adopting it involves
- Internal staff time to design, document and run the risk framework
- Training for managers and risk owners, and any tools used to record risk
- The size and complexity of the organization and the number of business units involved
- Whether you bring in outside advisers or training, which are your own commercial choices
What affects timing
- How much of a risk process already exists and can be reused
- Time to agree risk criteria and appetite with senior management
- How quickly different departments can adopt common templates and routines
- Scale of rollout, from a single department to the whole organization
What to have ready
- A description of the objectives and decisions where risk matters most
- Existing risk registers, policies and reporting lines, described in general terms
- A view on who would own the risk framework and who needs training
- A list of management systems or standards you want the risk approach to support
Recognition
There is no certification, accreditation or conformity scheme for ISO 31000, so there is no certificate to check against an accreditation body. If someone offers a certificate, ask who issued it, what it covers and what it was assessed against. Some training bodies issue personal course certificates, which show attendance or knowledge of an individual, not that an organization conforms. Buyers and regulators decide how they treat any such evidence, so check the tender or contract wording.
Common questions
Can an organization be certified to ISO 31000?
A company claims ISO 31000 certification. What should we ask?
Which standards are certifiable and also risk-based?
Does it replace our existing risk process?
Related standards
Relevant industries
Useful reading
Sources
- ISO: ISO 31000 family, risk management (checked 5 November 2026)
Have a question about ISO 31000?
This standard gives guidance and is not intended for certification, so there is nothing to request a quote for. We are happy to help you see how it fits with standards that are.