ISO 31000

What is ISO 31000?

ISO 31000 is the international standard giving guidelines for managing risk. The International Organization for Standardization (ISO) publishes it through technical committee ISO/TC 262. Any organisation can use it, whatever its size, activity or sector, and it is voluntary guidance rather than a certifiable standard.

The current edition is ISO 31000:2018, Risk management — Guidelines, second edition, published in February 2018. ISO confirmed it at its 2023 review, and a further review in October 2024 decided it should be revised. The ISO page for the standard now shows stage 90.92 ("International Standard to be revised"). Its replacement, ISO/CD 31000 (edition 3), is a committee draft whose comment period closed on 1 March 2026. Until it publishes, the 2018 edition is the one to cite.

The standard has three parts: principles, a framework and a process. Together they describe how an organisation finds, weighs, treats, tracks and reports risk, from board decisions to single projects.

A risk framework that lives only in a policy document isn't a framework.

Why it matters

ISO 31000 matters because boards, customers and auditors keep asking the same question: how do you manage risk? Without a shared structure, the honest answer is often a spreadsheet that one person maintains.

The ISO 31000 risk management framework gives that answer a recognised shape. Four things make it relevant:

• A common reference across sectors. Because the standard is written for any organisation, it works as a benchmark whether you are a software firm, a clinic or an insurer.
• Guidance for audit. There is no certificate, but ISO says the standard can guide internal and external audit programmes. That gives auditors a recognised benchmark to test practice against.
• Contracts and insurance. ISO notes that many contracts and insurance agreements ask for solid evidence of good risk management practice. ISO 31000 is a recognised way to show it.
• Public-sector use. The UK government's Orange Book cites it (see the UK position below).

A risk register nobody reviews is a list of worries, not risk management.

Who it applies to

ISO 31000 applies to any organisation. ISO names companies in heavily regulated industries such as financial services, healthcare and energy among those who need it. It is less useful to a firm that wants a certificate to show a customer, because there is no certification scheme.

The obligation is voluntary. No legal duty arises from the standard itself. Where a duty exists, it comes from a regulator, a contract or a government policy that points to the standard.

The relationship to ISO 27001 is a difference of scope and purpose. ISO/IEC 27001 requires an information security risk assessment and treatment process (clause 6.1) and can be certified. ISO 31000 cannot be certified, but it is general guidance a firm can use to shape that process and extend it to every other kind of risk. Holding one does not stand in for the other.

The UK position

No UK statute requires ISO 31000. A UK firm meets it in one clear place: UK central government. The HM Treasury Orange Book: Management of Risk – Principles and Concepts cites BS ISO 31000:2018 as a standard informing its principles-based approach to risk management.

The Orange Book applies to all central government departments and arm's length public bodies, and it may be useful to the wider public sector. Its main principles are mandatory, and boards must consider adherence to them on a comply-or-explain basis. That duty sits in the Orange Book. ISO 31000 itself carries none.

For a private-sector UK firm, the standard creates no legal duty. You are most likely to meet it when a customer, board or internal risk policy names it as the benchmark, or when you supply a public body that works to the Orange Book.

Key requirements

ISO 31000 is guidance, not a list of auditable requirements, so there is nothing to comply with in the way ISO 27001 clauses are complied with. Its content is organised in three parts:

1. Principles. The values that should shape how risk management is done. ISO's own summary of the 2018 edition names creating value as the key driver, with related principles such as continual improvement, including stakeholders, customising the approach to the organisation, and attention to human and cultural factors.
2. Framework. The organisational arrangements that support risk management across the organisation, so it is part of how the organisation runs and not a separate exercise.
3. Process. The repeatable cycle applied to each decision, project or area of the business.

The process covers six activities:

• identifying risks;
• analysing them;
• evaluating them against what the organisation will accept;
• treating them;
• monitoring them;
• communicating them across the organisation.

The framework is what keeps the process from being a one-off workshop. The process is what the framework exists to run.

What IEC 31010 adds

IEC 31010, Risk management — Risk assessment techniques, is the supporting standard for the assessment step. ISO sells it in a risk management bundle with ISO 31000, and the Orange Book describes it as guidance on choosing and applying systematic techniques for risk assessment.

For the official record of the standard, its edition and its revision status, see the ISO page.

Frequently asked questions