ISO 31000: Enterprise Risk Management Guidelines Explained

ISO 31000 is the international standard that gives guidelines for managing risk in any organisation. It is not about one kind of risk: the same principles and process apply to strategy, finance, operations, projects, technology, information security and compliance. Its definition of risk, "the effect of uncertainty on objectives", covers both threats and opportunities.

The current edition, ISO 31000:2018, is shorter and more practical than the 2009 original, focusing on leadership, integration into decisions and a repeatable process. A revision is in development, but the 2018 edition remains the reference. This guide explains the principles, framework and process, how ISO 31000 relates to ISO/IEC 27005 and COSO, and how IT and software companies can use it without heavy bureaucracy.

What is ISO 31000?

ISO 31000 was first published in 2009 and revised in 2018 by ISO Technical Committee 262. It provides guidelines, not requirements, so organisations adapt it to their context. The standard has three main parts: principles that describe effective risk management, a framework for embedding risk management into the organisation, and a process for managing individual risks. It is supported by related documents, including IEC 31010 on risk assessment techniques and ISO 31073 on risk management vocabulary.

Because it is generic, many specialised standards build on it, including ISO/IEC 27005 for information security risk, ISO 22301 guidance on business continuity risk, and ISO 14971 for medical device risk.

History and current edition

The 2009 edition introduced a common international approach and replaced several national standards, including the Australian and New Zealand standard AS/NZS 4360, which strongly influenced it. The 2018 revision simplified the text, reduced the principles to eight, put more emphasis on leadership and integration, highlighted human and cultural factors, and described the process as iterative rather than linear. ISO/TC 262 has a working group developing a further revision; until a new edition is published, ISO 31000:2018 applies.

Who should use it?

• Boards and executives who want risk information that supports strategic decisions.
• Risk, compliance and internal audit teams designing enterprise risk management.
• Technology leaders who need to compare security, privacy, reliability and delivery risks on the same scale.
• Project and product managers managing uncertainty in delivery.
• Public sector bodies, many of which reference ISO 31000 in risk policies.

Is it mandatory or voluntary?

Voluntary. No law requires ISO 31000, and it cannot be certified because it contains no requirements. Some governments and regulators cite it as good practice, and organisations certified to management system standards such as ISO/IEC 27001 or ISO 22301 often use it to structure the risk elements those standards require.

The eight principles

ISO 31000:2018 says effective risk management is:

1. Integrated into all organisational activities.
2. Structured, taking a consistent approach across the organisation so results are comparable (the standard pairs this with being broad in coverage).
3. Customised to the organisation's context and objectives.
4. Inclusive, involving stakeholders appropriately and in good time.
5. Dynamic, anticipating and responding to change.
6. Based on the best available information, recognising its limitations.
7. Attentive to human and cultural factors, which influence every stage.
8. Continually improved through learning and experience.

The purpose of risk management, according to the standard, is the creation and protection of value. The principles are the test of whether a risk program is working in practice.

The framework

The framework helps an organisation integrate risk management into governance and operations. Its components are:

• Leadership and commitment from top management and oversight bodies, including a risk policy, resources and accountability.
• Integration of risk management into structures, processes and decision making.
• Design: understanding context, articulating commitment, assigning roles, allocating resources and setting up communication.
• Implementation through plans, timelines and decision processes.
• Evaluation of the framework's effectiveness against its purpose.
• Improvement: adapting and continually improving the framework.

The risk management process

1. Communication and consultation with relevant stakeholders throughout.
2. Scope, context and criteria: define the scope of the activity, the internal and external context, and criteria for evaluating the significance of risk.
3. Risk assessment:
   • Identification: find, recognise and describe risks that could help or prevent achieving objectives.
   • Analysis: understand the nature of risk, including sources, consequences, likelihood, events, scenarios, controls and their effectiveness.
   • Evaluation: compare results with criteria to decide where action is needed.
4. Risk treatment: select and implement options, which include avoiding the risk, taking or increasing it to pursue an opportunity, removing the source, changing likelihood or consequences, sharing it, or retaining it by informed decision.
5. Monitoring and review of the process and its outcomes.
6. Recording and reporting to support decisions and accountability.

Risk criteria and appetite

Criteria reflect the organisation's values, objectives and resources, and its legal and contractual obligations. They define how likelihood and consequences are measured, how risk levels are determined and what level of risk is acceptable. Many organisations express this as a risk appetite statement approved by the board, for example accepting moderate risk in product experimentation but very low risk in customer data protection and regulatory compliance. ISO 31000 encourages treating risk as a source of opportunity as well as harm, so criteria can recognise positive consequences.

Risk assessment techniques

IEC 31010:2019 describes more than 40 techniques that can support ISO 31000 assessments. Common ones in technology organisations include:

• Brainstorming and structured interviews.
• Scenario analysis and what-if analysis.
• Failure modes and effects analysis (FMEA) for systems.
• Bow-tie analysis showing causes, controls and consequences.
• Fault tree and event tree analysis.
• Consequence and likelihood matrices.
• Monte Carlo simulation for cost and schedule risk.

The choice depends on the decision being made, the data available and the time and expertise at hand.

Applying ISO 31000 in IT and software companies

Technology companies face several kinds of risk that are often managed separately: security and privacy, reliability, delivery and project risk, supplier and cloud dependency, regulatory change, talent and key person risk, and commercial risk. ISO 31000 provides one method that lets leadership see them together. Practical applications include:

• Enterprise risk register combining top risks from all areas, reviewed quarterly by leadership.
• Project risk management for client projects, with risk logs, owners and contingency plans.
• Architecture decisions documented with risks and trade-offs, such as choosing a single cloud region.
• Release risk assessment for major changes, with rollback plans and staged rollouts as treatments.
• Supplier risk for critical vendors, with alternatives and exit plans.

Information security risks can be assessed in detail with ISO/IEC 27005 and then rolled up to the enterprise register using the same criteria.

Roles and accountability

ISO 31000 asks top management to be accountable for managing risk and oversight bodies, such as the board, to make sure risks are adequately considered. In practice, many organisations organise responsibilities using the Institute of Internal Auditors' Three Lines Model. Operational managers own and manage risks in their areas. Risk, security and compliance functions provide expertise, methods, challenge and monitoring. Internal audit gives independent assurance that risk management works. ISO 31000 does not prescribe this model, but the two fit together well. In a small software company, the same people may hold several roles; what matters is that each top risk has a named owner with authority to act, and that someone other than the owner reviews whether treatments are working.

Reporting risk to leadership

Good risk reporting is short and decision-oriented. A useful leadership report shows the top risks, their current and target levels, trend since the last review, key risk indicators, overdue treatments and any risks outside appetite that need a decision. Heat maps help, but a table with owners and actions is often clearer. The aim is that leadership can answer three questions: what could stop us meeting our objectives, are we comfortable with that, and what are we doing about it.

Key risk indicators for software companies

Key risk indicators give early warning that a risk is growing. Examples relevant to IT and software businesses include:

• Percentage of revenue from the largest client.
• Attrition of senior engineers and number of systems known by only one person.
• Open critical vulnerabilities older than the agreed fix time.
• Service availability against targets and number of major incidents.
• Failed change rate and rollback frequency.
• Project schedule and budget variance.
• Suppliers without current security assessments.

Each indicator should have a threshold that triggers review, linked to the relevant risk in the register.

How to implement it, step by step

1. Get leadership commitment and approve a short risk policy.
2. Define roles: risk owners, a risk coordinator, and board or leadership oversight.
3. Set risk criteria and appetite for key risk areas.
4. Run an initial assessment across strategy, operations, technology, security, compliance and projects.
5. Agree treatments with owners and deadlines.
6. Integrate risk into existing processes: planning, budgeting, project kick-offs, architecture review and change management.
7. Report regularly with a short dashboard of top risks and trends.
8. Evaluate and improve the framework each year.

Documentation you will need

• Risk management policy and appetite statement.
• Roles and responsibilities.
• Risk criteria and scales.
• Risk registers at enterprise, project and system levels.
• Treatment plans and progress.
• Risk reports to leadership or the board.
• Framework evaluation records.

Timeline and cost considerations

A small or mid-sized IT company can set up a basic ISO 31000-aligned framework in four to eight weeks: policy, criteria, initial register and reporting rhythm. Embedding it into decisions takes longer and depends on leadership attention. The standard itself is inexpensive; costs are mainly staff time and, optionally, GRC software.

Benefits and limitations

• Benefits: common language for all risks; better prioritisation of investment; stronger governance evidence for clients and investors; foundation for specialised standards.
• Limitations: no certification; guidelines are general, so organisations must design details; risk management can become a box-ticking exercise if not linked to real decisions.

Common mistakes

• Risk registers disconnected from decisions, updated only for audits.
• Only considering threats, ignoring opportunities and positive risk-taking.
• Different scales in different teams, making risks incomparable.
• No named risk owners.
• Overly complex scoring that no one understands.
• Ignoring human and cultural factors, such as a culture where people hide bad news.

Best practices, tools and technologies

• Keep the enterprise register short, with the top 15 to 25 risks.
• Use the same five-point scales across specialised registers.
• Tie risk review to existing meetings rather than creating new ones.
• Use key risk indicators, such as uptime, incident counts, attrition and project variance.
• Document risk in architecture decision records and project charters.
• Align enterprise risk with COSO ERM if auditors or investors expect it.

Delivery and operational risks fall when software is built with automated testing, monitored releases and clear documentation. That is how our maintenance and support and migration and modernisation teams work.

ISO 31000 compared with COSO ERM

Aspect	ISO 31000	COSO ERM
Publisher	ISO (international)	COSO (US-based private sector bodies)
Length and style	Short, principle-based guidelines	Longer framework with 20 principles in five components
Focus	Any organisation, any risk	Enterprise risk linked to strategy and performance
Typical users	Global organisations, public sector, management system users	US listed companies, auditors, financial sector
Certification	None	None

The two are compatible. Many organisations use ISO 31000's process with COSO's governance and reporting expectations.

How it relates to other frameworks

Framework	Relationship
ISO/IEC 27005	Applies ISO 31000 to information security risk.
ISO/IEC 27001	Requires risk assessment and treatment consistent with ISO 31000 concepts.
ISO 22301	Business continuity management using risk assessment.
COBIT	IT governance framework with a risk management objective that can use ISO 31000.
NIST RMF	US federal system-level risk framework.

Real-world example

A 150-person Indian software services company adopts ISO 31000 after a major client asks about enterprise risk management. Leadership approves a one-page risk policy and appetite, with low appetite for security and compliance risk and moderate appetite for new technology bets. The company keeps a top-20 enterprise register, reviewed in the monthly leadership meeting, with risks such as dependency on two large clients, key architect attrition, a cloud region outage and a ransomware attack. Project managers use the same scales in project risk logs, and the security team feeds its ISO 27005 assessment into the enterprise view.

Next steps

1. Write a short risk policy and appetite.
2. Agree common scales.
3. Build a top-risk register with owners.
4. Integrate review into existing meetings.
5. Watch for the revised edition.

Frequently asked questions

What is ISO 31000?

The international guidelines for managing any type of risk, with principles, a framework and a process.

Can an organisation be certified to ISO 31000?

No. It contains guidelines, not requirements, so it is not certifiable.

What is the current version?

ISO 31000:2018. A revision is being developed by ISO/TC 262.

How does ISO 31000 define risk?

As the effect of uncertainty on objectives, which can be positive or negative.

What is the difference between ISO 31000 and ISO 27005?

ISO 31000 covers any risk; ISO 27005 applies its approach to information security risk.

What is the difference between ISO 31000 and COSO ERM?

Both are enterprise risk frameworks; ISO 31000 is shorter and international, while COSO ERM is more detailed and widely used by US listed companies.

What are the eight principles?

Integrated, structured, customised, inclusive, dynamic, best available information, human and cultural factors, and continual improvement.

What is IEC 31010?

A companion standard describing risk assessment techniques that support ISO 31000.

Is ISO 31000 useful for small companies?

Yes. It scales, and a small company can apply it with a short policy and a simple register.

Does ISO 31000 cover opportunities?

Yes. It treats risk as uncertainty that can have positive as well as negative effects.

How often should risks be reviewed?

Top risks are commonly reviewed monthly or quarterly by leadership, with a full review of the framework at least once a year and after major changes.

Do I need special software for ISO 31000?

No. Spreadsheets work for small organisations; GRC tools help larger ones link risks, controls, indicators and evidence.