ISO 31000: Enterprise Risk Management That Informs Decisions
How to build risk management that informs decisions, rather than a risk register that nobody reads
Every ISO management system standard asks organisations to address risks and opportunities. But risk management becomes much more powerful when it covers the whole organisation: strategy, projects, finance, operations, compliance and reputation. ISO 31000:2018, Risk management — Guidelines is the international reference for doing this.
ISO 31000 is a guidance standard. It is not intended for certification. Its value is in giving the organisation a common language and method for risk, which management systems such as ISO 9001, ISO 14001, ISO 45001 and ISO 22301 can then plug into.
1. The three parts of ISO 31000
| Part | What it covers |
|---|---|
| Principles | The characteristics of effective risk management |
| Framework | How risk management is built into governance, leadership and decision-making |
| Process | The practical steps for identifying, assessing, treating and monitoring risk |
2. The principles
Effective risk management is:
- Integrated into all organisational activities.
- Structured and comprehensive, giving consistent, comparable results.
- Customised to the organisation’s context and objectives.
- Inclusive, involving stakeholders at the right time.
- Dynamic, responding to change.
- Based on the best available information, with its limitations recognised.
- Aware of human and cultural factors.
- Continually improved through learning and experience.
The purpose behind all of them is the creation and protection of value.
3. The framework: making it part of how the organisation is run
The framework starts with leadership and commitment, then covers integration, design, implementation, evaluation and improvement. In practice this means:
- Top management sets the risk management policy and the organisation’s appetite for risk.
- Roles and accountabilities for risk are clear, from the board to process owners.
- Risk information feeds strategic planning, budgeting, investment and project decisions.
- Resources and competence are provided.
- The framework is reviewed and improved.
4. The process
| Step | Key questions |
|---|---|
| Communication and consultation | Who needs to be involved and informed? |
| Scope, context and criteria | What are we assessing, and how will we judge whether a risk is acceptable? |
| Risk identification | What could happen, why and how, that would affect our objectives? |
| Risk analysis | How likely is it, what would the consequences be, and how effective are existing controls? |
| Risk evaluation | Which risks need treatment, and in what order? |
| Risk treatment | Avoid, reduce, share, accept, or pursue an opportunity, with a plan and owner |
| Monitoring and review | Are risks and controls changing? Are treatments working? |
| Recording and reporting | Who needs which risk information to make decisions? |
5. ISO 31000 and management systems
| Standard | How ISO 31000 helps |
|---|---|
| ISO 9001 | A consistent method for addressing risks and opportunities to quality objectives |
| ISO 14001 | Linking environmental aspects and compliance obligations to organisational risk |
| ISO 45001 | Placing OH&S risk assessment within enterprise risk |
| ISO 22301 | Feeding business impact analysis and risk assessment for continuity |
| ISO 37301 and governance | Treating compliance risk within the same framework, as part of governance, risk and compliance (GRC) |
Using one risk method across the integrated management system avoids several incompatible risk registers and scoring scales.
6. Common pitfalls
- A register built once for the audit and never used in decisions.
- Risks described vaguely, such as “quality risk”, with no cause or consequence.
- Scores without criteria, so different managers rate the same risk differently.
- Only threats considered, while opportunities are ignored.
- Treatment plans without owners or dates.
- No link to objectives, so the board cannot see which objectives are most at risk.
7. A practical starting point
- Agree risk criteria and a simple scoring scale for the whole organisation.
- Hold short workshops with each function to identify the top risks to its objectives.
- Consolidate them into a corporate risk profile for top management.
- Assign owners and treatment plans for the highest risks.
- Review the profile quarterly and report it to management review.
Conclusion
ISO 31000 turns risk management from a compliance exercise into a way of making better decisions. Its principles, framework and process give the whole organisation one language for uncertainty, and give every management system a solid base for addressing risks and opportunities.
Ask your leadership team: what are our five biggest risks to this year’s objectives, and who owns each one?