Definition and purpose

The purpose of ISO 31000 is to provide guidance on risk management that can be used by any organization, regardless of its size, activity, or sector. The standard emphasizes a systematic, transparent, and reliable approach to risk management, intended to enhance the effectiveness of decision-making and improve overall organizational resilience.

Governing Body

The standard is developed and maintained by the International Organization for Standardization (ISO).

Last updated

ISO 31000 was last updated in 2018. 

Applies to

ISO 31000 is applicable to all types of organizations, including public and private companies, government entities, and not-for-profit organizations. It is industry-agnostic and can be integrated into any area of organizational operation.

Controls and requirements

ISO 31000 outlines key principles and guidelines, rather than specific controls, for risk management, which include:

• Risk Management Principles: Guidelines for creating value, integrating risk management into organizational processes, and customizing the risk management approach.
• Risk Management Framework: Steps for designing, implementing, evaluating, and continually improving risk management throughout the organization.
• Risk Management Process: A systematic approach to risk identification, assessment, treatment, monitoring, and review.

Please refer to the official ISO 31000 documentation for details on controls and requirements.

Audit type, frequency, and duration

Audits related to ISO 31000 are generally focused on evaluating the effectiveness of an organization's risk management processes and their alignment with the standard. These can be internal or external audits. The frequency of risk management audits can depend on the organization's internal policies, the nature of its operations, or in response to significant changes in the external or internal context of the organization.

The duration of the audit varies depending on the size and complexity of the organization, the scope of the audit, and the maturity of the risk management processes in place.