Risk management (guidance)
ISO 31000:2018
Guidelines for managing risk in any organisation, built on principles, a framework and a process. It is not certifiable, but it underpins the risk thinking in every management-system standard.
1 What it covers
ISO 31000 gives a common approach to managing any type of risk. It is organised in three parts: the principles that make risk management effective, a framework for integrating risk management into governance and everyday activities, and a process for identifying, analysing, evaluating and treating risk. Because it is guidance, organisations cannot be certified to it — courses lead to a training certificate (for example a PECB “Risk Manager” credential) rather than to auditing the standard.
2 Who uses it
Risk managers, compliance and governance teams, project managers and anyone designing risk processes for ISO 9001, 27001, 22301 or other systems.
3 Structure and key clauses
4 Principles
Risk management should be integrated; structured and comprehensive; customised; inclusive; dynamic; based on the best available information; take human and cultural factors into account; and be continually improved — all in service of creating and protecting value.
5 Framework
Leadership and commitment · integration · design · implementation · evaluation · improvement
6 Process
- Communication and consultation
- Scope, context and criteria
- Risk assessment: risk identification, risk analysis, risk evaluation
- Risk treatment
- Monitoring and review
- Recording and reporting
4 Key facts for courses and exams
- Current edition: ISO 31000:2018; a revision is at committee draft stage (iso.org, October 2026).
- Risk is the effect of uncertainty on objectives — the effect can be positive or negative.
- Risk assessment = identification + analysis + evaluation.
5 ISO 31000 qualifications
| Qualification | UK courses listed |
|---|---|
| ISO 31000 Foundation / requirements | 2 |
| ISO 31000 Implementer / lead implementer | 2 |
S Sources
Facts on this page last checked 3 October 2026.
- iso.org, ISO 31000:2018 page — https://www.iso.org/standard/65694.html