What is ISO 31000?

ISO 31000 may not be well known but its philosophy can be seen across all the popular management system standards that are aligned to ISO 27001, ISO 22301 and future versions of ISO 9001 and ISO 14001. Being the international standard for Risk Management, we have long been passionate about the principles of ISO 31000 and the benefits that come with implementing it as part of another standard, or as a means of organizational risk governance.

Risk Management Principles

The standard starts with 11 Principles:

1. Risk Management Creates and Protects
2. Risk Management is an integral part of all organizational processes
3. Risk Management is part of the decision making
4. Risk Management explicitly addresses uncertainty
5. Risk Management is systematic, structured and timely
6. Risk Management is based on the best available information
7. Risk Management is tailored
8. Risk Management takes human and cultural factors into account
9. Risk Management is transparent and inclusive
10. Risk Management is dynamic, iterative and responsive to change
11. Risk Management facilitates continual improvement of the organization

Risk Management Framework

A “Mandate and Commitment” is required by management before creating the risk management framework, then as is becoming common in management system standards, a detailed understanding of the organization and it’s context is undertaken. This helps to define the processes required, communication routes and reporting lines.

Risk Management Process

The risk management process focuses on the recognizable Identification, Analysis, Evaluation and Treatment of risk – which fits well with risk-based standards such as ISO 27001 for Information Security.

Continual Improvement

The goal is to achieve continual improvement of the system by monitoring and reviewing activity.

ISO 31000 Advantages

1. Identify & Control Risks.
2. 11 Risk Principles.
3. Provides Framework.
4. Considers Context.
5. Requires Management Mandate and Accountability.
6. Continual Improvement.
7. Integrate with other Annex SL based ISO standards.