ISO 31000 is an international standard of guidelines on managing risk. It is not a requirements standard and was not written for certification, so an auditor uses it as a yardstick for how well a company manages risk, not as a pass or fail list. It has three parts: principles, a framework and a process.
Last reviewed: 17 October 2026. Facts checked. We searched for ISO 31000 and opened the Wikipedia page on ISO 31000. The ISO website returned an error and we did not open it. A search summary of other pages described the principles and framework, and we have not opened those pages ourselves. We have not read the standard.
What it is
Per Wikipedia, ISO 31000 was first published on 13 November 2009. A revision began in 2015, and ISO 31000:2018 is the current version, last reviewed and confirmed in 2023. It can be used by any organisation, whatever its size, activity or sector.
The key point for auditors: Wikipedia quotes that ISO 31000 "has not been developed with the intention for certification." Some bodies sell personal credentials linked to it, but there is no certificate for the standard that an organisation can hold. If someone claims "ISO 31000 certified", ask what exactly was certified.
The three parts
| Part | What it is | Plain meaning |
|---|---|---|
| Principles | The ideas behind good risk management | Why do it |
| Framework | Components and arrangements that embed risk management | Where it lives in the company |
| Process | The activities carried out on each risk | How to do it |
Principles. The search summary we read lists eight, including integrated, structured and comprehensive, customised, inclusive, dynamic, based on the best available information, accounting for human and cultural factors, and continual improvement. We did not verify the exact wording.
Framework. Wikipedia defines it as the set of components that give the foundations and organisational arrangements for managing risk. Foundations include policy, objectives, mandate and top management commitment. Arrangements include plans, relationships, accountabilities, resources and processes. The summary we read adds leadership and commitment, integration, design, implementation, evaluation and improvement.
Process. Wikipedia lists these activities: communication and consultation, establishing context, risk identification, analysis, evaluation, treatment, monitoring and review. Sources differ in how they group the steps, so check the standard for the official diagram.
Why auditors should know it
Risk language runs through audit work. Several ISO management system standards ask a company to consider risks and opportunities. Internal audit plans are often risk-based. Boards ask whether risk is managed. ISO 31000 gives a shared, neutral vocabulary.
It does not replace the standards that set requirements. An ISO 9001 or ISO 27001 audit tests the clauses of those standards. ISO 31000 helps you judge whether the risk work behind them is sensible.
Using it in an audit
Treat ISO 31000 as a benchmark. These questions follow the three parts.
- Leadership. Does top management own risk management, and is there a written policy and mandate?
- Integration. Is risk considered in planning and decisions, or only in a yearly workshop?
- Context. Are risk criteria defined, so that "high" means the same thing everywhere?
- Identification. Are risks identified from many sources and people, not only the risk manager?
- Analysis and evaluation. Is there a method for likelihood and impact, applied consistently?
- Treatment. Does each treatment have an owner, a date and a check?
- Monitoring. Are risks reviewed as things change, and do findings feed back?
For scoring method, see risk assessment matrix: how to score likelihood and impact and try the risk assessment matrix calculator.
A practical way to apply it
Do not try to audit all of ISO 31000 at once. Pick one area, such as how risks are rated, and ask to see three real examples from start to finish: how the risk was found, how it was rated, what was done and whether anyone checked. Gaps show up quickly this way. Write each finding as the expectation, the evidence you saw and the difference between them, so that management can act on it.
What it is not
- It is not a certification scheme.
- It is not an internal control framework. For that, see our guide to the COSO 2013 internal control framework.
- It is not a sector standard. Banks, insurers and others have their own rules in addition.
Frequently Asked Questions
Can a company be certified to ISO 31000?
Not according to the sources we read. The standard was not developed for certification. Personal credentials exist, but they are separate.
Which edition is current?
ISO 31000:2018, per Wikipedia, last reviewed and confirmed in 2023.
What is the difference between a framework and a process in ISO 31000?
The framework is how risk management is built into the organisation. The process is the set of steps applied to each risk.
Is ISO 31000 the same as COSO ERM?
No. They are different documents from different bodies. We did not compare them in detail for this article.
How do auditors use ISO 31000?
As a benchmark when judging a company's risk management, and as a common vocabulary in audit planning.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error