ISO 31000 is one of the most commonly misunderstood standards on any compliance list, mostly because of its title: "Risk management — Guidelines." That word — guidelines — is the key to the whole standard. Unlike ISO 27001 or ISO 9001, ISO 31000 doesn't specify auditable requirements an accredited body certifies you against. It provides principles, a framework, and a process for managing risk, meant to be applied and adapted, not checked off.
There is no accredited "ISO 31000 certification"
You may occasionally see vendors offering "ISO 31000 certification" — but because the standard itself doesn't set out requirements in the way ISO 27001's Annex A or ISO 9001's clauses do, there's no accredited certification scheme against it the way there is for those standards. What organisations actually do with ISO 31000 is use it as the reference methodology for how they manage risk — and then get certified against a standard that requires evidence of effective risk management, like ISO 27001 or ISO 22301, using ISO 31000's approach underneath it.
The principles: what good risk management should embody
ISO 31000 sets out a set of principles describing the characteristics of effective risk management — among them, that it should be integrated into all organisational activities rather than a bolt-on exercise, structured and comprehensive, customised to the organisation's context, based on the best available information, and subject to continual improvement as the organisation learns. These principles are the "why" behind the framework and process that follow.
The framework: embedding risk management into governance
The framework component is about integrating risk management into the organisation's overall governance, strategy, and operations — not running it as an isolated function. It covers leadership and commitment from top management, designing the framework to fit the organisation's context, implementing it in practice, evaluating whether it's working, and improving it over time — a continual cycle rather than a one-time setup.
The process: the actual mechanics of managing a risk
This is the part most people mean when they say "risk assessment," and ISO 31000 breaks it into clear stages:
- Communication and consultation — with stakeholders throughout the process, not just at the end.
- Scope, context, and criteria — defining what's being assessed and against what criteria risk will be evaluated.
- Risk assessment — identifying risks, analysing their causes and consequences, and evaluating them against the defined criteria to decide what needs treatment.
- Risk treatment — selecting and implementing options to modify risk (similar in spirit to the "accept, avoid, transfer, mitigate" choices used elsewhere).
- Monitoring and review — checking that the process and its outcomes remain valid as circumstances change.
- Recording and reporting — documenting the process and its outcomes to support decision-making and accountability.
Why it shows up underneath so many other standards
ISO 27001's mandatory risk assessment, ISO 22301's business continuity risk assessment, and ISO 9001's risk-based thinking all describe risk management requirements without necessarily prescribing the exact methodology — which is precisely the gap ISO 31000 is designed to fill. An organisation running multiple ISO management systems often adopts one ISO 31000-aligned risk methodology and applies it consistently across all of them, rather than inventing a separate risk process for each certification.
This guide is general information — how to structure risk management for your specific organisation and the standards you're pursuing is best discussed with a qualified risk management professional.
One risk methodology, applied consistently across frameworks
Because ISO 31000's process maps so directly onto the risk assessment requirements embedded in ISO 27001, ISO 22301, and other frameworks, ComplianceDesk lets you apply one consistent risk methodology across every framework you've activated — so a risk identified once doesn't need to be re-assessed from scratch under a different framework's own risk register.