Your company has been asked by a board, a customer, an auditor or a regulator to demonstrate that it manages risks in a structured way, or it already has some risk management in place (a matrix, an inventory, an analysis done for ISO 9001) and wants to turn it into something that truly supports decisions, rather than a spreadsheet reviewed once a year.
Either way, this guide brings together what you need to know about ISO 31000 right now: from the basic definition to the difference between a guidelines standard and a certifiable one, covering what is in force in 2026, the principles, the framework and the risk management process, cost, timeline, implementation and how to keep risk management alive day to day, without relying on a scramble before the next ISO 9001 audit.
What is ISO 31000?
ISO 31000, “Risk management – Guidelines,” is published by the International Organization for Standardization (ISO) and developed by technical committee ISO/TC 262, dedicated to risk management. Created in 2009, drawing on the experience of the Australian/New Zealand standard AS/NZS 4360, it was revised in 2018, when it gained a shorter, more direct text with more emphasis on integrating risk management into governance and decision-making. In Brazil, it is adopted identically by ABNT as NBR ISO 31000.
The starting point of the standard is its definition of risk: the effect of uncertainty on objectives. This changes how the subject is seen. Risk is not just a threat, and not just what can go wrong in operations: it is any deviation, positive or negative, from what the organization intends to achieve. A new customer who may not materialize, a regulatory change, dependence on a single supplier, a technology that could make a product obsolete or an expansion opportunity are all risks in the ISO 31000 sense.
The standard is generic: it applies to private companies, public bodies, nonprofits and even specific projects or areas, and it covers any type of risk: strategic, operational, financial, compliance, information security, environmental or reputational. It does not follow the ten-clause Annex SL structure shared by ISO 9001, ISO 14001 and ISO 45001. It is organized into three connected blocks:
Principles (clause 4): eight characteristics that effective risk management should have, all serving one central purpose, the creation and protection of value.
Framework (clause 5): how risk management is embedded in the organization, with leadership and commitment at the center, and integration, design, implementation, evaluation and improvement around it.
Process (clause 6): the practical cycle of communication and consultation, establishing scope, context and criteria, risk identification, analysis and evaluation, treatment, monitoring and review, and recording and reporting.
Another important point: ISO 31000 contains no requirements, only recommendations. While ISO 9001 uses “shall,” ISO 31000 uses “should.” It doesn’t say which risk matrix to adopt, how many probability levels to use or which software to implement: it guides how to think about and organize risk management, and leaves the organization to adapt the model to its context, size and maturity.
ISO 31000 is also the reference standard of a larger family. The ones most used alongside it are ISO 31073:2022, the risk management vocabulary (which replaced the former ISO Guide 73), and IEC 31010:2019, which describes risk assessment techniques such as FMEA, bow-tie, fault tree analysis, HAZOP and scenario analysis. There are also specific guides, such as ISO 31022 (legal risk) and ISO 31030 (business travel risk).
The organizations that typically adopt ISO 31000 as a reference are companies certified or pursuing certification to ISO management system standards, which need to show how they handle risks and opportunities; companies with a board of directors or audit committee that expects a consolidated view of business risks; public bodies and state-owned companies, where risk management is required by governance regulations; financial institutions, health insurers, energy companies and other regulated sectors; and organizations that want to move from reactive, incident-driven risk management to preventive management integrated into planning.
ISO 31000 in 2026: what is in force and what may change
Unlike ISO 9001, which got a new version in September 2026, ISO 31000 remains in its 2018 edition. A revision is under way, but still at an early stage. What is in force and what is merely expectation are two different things, and it’s worth not confusing them:
| Topic | Status in 2026 | What it means for the company |
|---|---|---|
| Version of the standard | ISO 31000:2018 in force, confirmed in the ISO systematic review completed in 2023 | It is the reference to use today, both at ISO and at ABNT (NBR ISO 31000:2018) |
| Revision of the standard | Under way in ISO/TC 262, at the Committee Draft (CD) stage, with no announced publication date | There is no final text yet. Discussions point to more integration with governance and strategy and more clarity on accountability for risks, but none of this is confirmed |
| Transition | Not applicable | Since ISO 31000 is not certifiable, a new edition does not open a transition period or invalidate what has been done: the company adopts the new version at its own pace |
| ISO 9001:2026 | New version published on September 16, 2026, with transition through September 2029 | Keeps the requirement to determine risks and opportunities and adds a new clause dedicated to planning changes. Risk management based on ISO 31000 makes it easier to meet both points |
| Supporting standards | ISO 31073:2022 (vocabulary) and IEC 31010:2019 (risk assessment techniques) in force | They serve as a reference to standardize risk language and choose the most suitable analysis techniques for each type of risk |
In practice, if your company is structuring or reviewing risk management now, the reference is ABNT NBR ISO 31000:2018 (ISO 31000:2018). A future revision is likely to refine the 2018 approach, not replace it, so the work done today remains valid. The point of attention in 2026 is for companies certified to ISO 9001, which will go through the transition to the 2026 version and can use that moment to review how they handle risks and changes in the QMS.
Is ISO 31000 certifiable? Guidelines vs. requirements standard
This is the most common question about the standard, and the answer is: NO.
ISO 31000 was written as a guidelines document, not a requirements standard, and ISO itself makes clear that it is not intended for certification. That doesn’t diminish its importance: it simply means its value shows up in the quality of the company’s decisions, not in a seal.
| Aspect | ISO 9001 (requirements standard) | ISO 31000 (guidelines standard) |
|---|---|---|
| Nature of the text | Requirements (“shall”) | Recommendations (“should”) |
| Organization certification | Yes, by an accredited certification body | No accredited certification exists |
| Structure | 10 clauses, Annex SL | Principles, framework and process |
| Scope | Quality management system | Any type of risk, at any level of the organization |
| How compliance is verified | Certification, surveillance and recertification audits | Self-assessment, internal audit, maturity assessment or voluntary independent review |
| Relationship between the two | Requires determining risks and opportunities, but doesn’t require a formal risk management method | Offers the method a company can use to meet the risk requirements of ISO 9001 and other standards |
Two practical cautions follow from this. First: be wary of offers of an “ISO 31000 certificate” for the company. A document of this kind may well be issued by a consultancy or private entity, but it doesn’t carry the recognition of an accredited certification and won’t be accepted as such by customers or auditors.
What does exist, and is legitimate, is the certification of individuals: professionals can earn risk manager or risk auditor credentials based on ISO 31000, issued by personnel certification bodies.
Second: not being certifiable doesn’t mean not being audited. In a company certified to ISO 9001, ISO 14001, ISO 45001 or ISO/IEC 27001, the auditor will assess how risks are determined, treated and monitored. They won’t demand ISO 31000 itself, but risk management structured on it usually answers those questions far more consistently than a generic matrix put together on the eve of the audit.
Where ISO 31000 connects with certifiable standards
Because it is not certifiable, ISO 31000 is rarely implemented on its own. In most companies, it is the method behind the risk requirements of other standards:
| Standard | Where risk appears | How ISO 31000 contributes |
|---|---|---|
| ISO 9001 | Risks and opportunities in QMS planning and, in the 2026 version, change planning | Consistent risk criteria across areas, a risk register and tracking of actions |
| ISO 14001 | Risks and opportunities associated with environmental aspects, legal requirements and context | Same process and same criteria used in the QMS, making integration easier |
| ISO 45001 | Hazard identification, risk assessment and OH&S opportunities | A structure to integrate safety risks with the company’s other risks |
| ISO/IEC 27001 | Assessment and treatment of information security risks | ISO/IEC 27005, the information security risk guide, is aligned with ISO 31000 |
| ISO/IEC 17025 | Risks to impartiality and laboratory risks and opportunities | A method to keep the impartiality risk analysis alive, not just declared |
| IATF 16949 | FMEA, contingency plans and supply chain risks | A consolidated view that connects the technical risks of the FMEA to business risks |
For companies with more than one certification, this is the biggest gain: a single risk management process, with the same criteria and the same language, serving several standards at once, instead of a different matrix for each audit.
The principles, framework and process of ISO 31000
The 8 principles
The principles describe the characteristics of effective risk management. They serve as a yardstick for judging whether what the company does today is real risk management or just form-filling:
1- Integrated: risk management is part of all of the organization’s activities, from strategic planning to operations, and is not a parallel process run only by the quality or compliance area.
2- Structured and comprehensive: a systematic approach, with defined criteria, produces consistent results that are comparable across areas and over time.
3- Customized: the framework and process are tailored to the organization’s external and internal context and objectives, not copied from a generic template.
4- Inclusive: interested parties are involved at the right time, which brings knowledge, different viewpoints and greater engagement with decisions.
5- Dynamic: risks emerge, change and disappear as the context changes, and risk management needs to anticipate, detect and respond to those changes.
6- Best available information: decisions are based on historical and current data and on future expectations, explicitly taking into account the limitations and uncertainties of that information.
7- Human and cultural factors: behavior and culture influence every aspect of risk management, at every level.
8- Continual improvement: risk management improves through learning and experience.
The framework
The framework deals with how risk management is embedded in the organization. At the center are the leadership and commitment of top management, which must ensure that risk management is integrated into governance, define responsibilities and provide resources. Around it, five elements in a cycle:
Integration: embedding risk management into the governance structure, processes and decision-making.
Design: understanding the organization’s context, articulating the commitment to risk management (normally in a policy), defining roles, authorities and responsibilities, allocating resources and establishing communication and consultation.
Implementation: putting the plan into practice, with timelines, owners and changes to the decision-making process where needed.
Evaluation: periodically measuring the framework’s performance against its purpose and checking that it remains suitable.
Improvement: adapting the framework to internal and external changes and continually improving its suitability, adequacy and effectiveness.
The risk management process
The process is the best-known part of the standard and the one that shows up most in day-to-day work:
- Communication and consultation: runs through every step, so the people involved understand the risks, the basis for decisions and the actions needed.
- Scope, context and criteria: defines what is being assessed, the external and internal context and the risk criteria, that is, how likelihood and consequence will be measured and what level of risk is acceptable.
- Risk identification: finds, recognizes and describes the risks that may help or prevent the achievement of objectives.
- Risk analysis: understands the nature of the risk, its causes, consequences, likelihood and the effectiveness of existing controls.
- Risk evaluation: compares the analysis results with the defined criteria to decide where to act and with what priority.
- Risk treatment: selects and implements response options, such as avoiding, reducing, sharing or accepting the risk, or taking advantage of an opportunity, with action plans, owners and deadlines.
- Monitoring and review: tracks the risks, the controls and the effectiveness of treatments over time.
- Recording and reporting: documents the process and its results and communicates risk information to those who need to decide.
Steps 3, 4 and 5 together make up what the standard calls the risk assessment process. This is where the IEC 31010 techniques come in, chosen according to the type of risk: brainstorming and interviews for identification, a likelihood and consequence matrix for prioritization, FMEA for process risks, bow-tie for risks with multiple causes and consequences, and scenario analysis for strategic risks.
What are the benefits of ISO 31000 for a company?
Even without producing a certificate, adopting ISO 31000 solves concrete management problems:
Improves the quality of decisions: investment, expansion, supplier selection or product launch decisions start to explicitly consider what can go wrong and what can go right, based on known criteria.
Creates a common risk language: different areas stop using their own scales and concepts, and risks become comparable with one another, which lets you prioritize resources where the impact is greatest.
Strengthens existing certifications: companies certified to ISO 9001, ISO 14001, ISO 45001 or ISO/IEC 27001 meet the risks and opportunities requirements with a single, consistent process instead of parallel matrices.
Gives visibility to top management and the board: an up-to-date risk register, with owners and tracked treatments, lets you report to governance on how the main risks are evolving.
Reduces surprises and losses: risks identified and treated in advance cost less than incidents, supply interruptions, fines or reputational crises.
Supports regulatory and customer requirements: in the public sector and regulated industries, risk management is required by governance regulations, and ISO 31000 is one of the most widely accepted references for demonstrating that it exists and works.
Seizes opportunities, not just avoids threats: since the concept of risk includes positive effects, the standard helps the company see and capture opportunities in a structured way.
How much does it cost and how long does it take to implement ISO 31000?
Since there is no certification, there are no certification body fees or mandatory external audits. The investment is in implementation: people’s time, training, possible consulting and tools. It varies with a combination of factors:
| Factor | Impact on cost/timeline |
|---|---|
| Scope | Starting with one process, one site or the QMS risks is faster than implementing enterprise risk management all at once |
| Current maturity | Companies that already have a risk analysis for ISO 9001 or a structured FMEA start ahead |
| Size and number of areas | More areas and sites mean more identification workshops, more owners and more effort to harmonize criteria |
| Leadership engagement | Without top management sponsorship, implementation stalls on defining criteria and responsibilities |
| Integration with other standards | Unifying the risks of several certifications takes more up-front work, but reduces maintenance effort later |
| Training | Training risk owners and facilitators is essential so the process doesn’t depend on a single person |
| External consulting | Optional, but speeds up the definition of the framework, criteria and first assessments |
| Management tool | Spreadsheets work at first, but tend to get lost as the number of risks, owners and actions grows |
As a general benchmark, a first complete cycle, with a policy, criteria, risk register and treatment plans for a defined scope, usually takes 3 to 6 months.
Taking risk management across the whole organization and truly integrating it into governance, planning and each area’s routine is a longer process, normally 12 to 24 months, because it depends on culture change, not just documentation. Companies that already have a mature QMS or centralize risks, actions and indicators in a management system tend to cover this path faster.
What documents and records does ISO 31000 recommend?
Being a guidelines standard, ISO 31000 doesn’t provide a list of mandatory documents. It does recommend, however, that the process and its results be recorded and reported, and in practice some documents become indispensable, not least because they are exactly what auditors of certifiable standards ask for when they assess risks:
- Policy or statement of commitment to risk management, approved by top management (5.4.2)
- Definition of roles, authorities and responsibilities, including the owner of each risk (5.4.3)
- Analysis of the external and internal context and interested parties (5.4.1 and 6.3)
- Risk criteria: likelihood and consequence scales, risk matrix and acceptable level of risk (6.3.4)
- Risk register or inventory, with causes, consequences, existing controls and risk level (6.4)
- Treatment plans, with actions, owners, deadlines and resources (6.5)
- Risk indicators and control monitoring results (6.6)
- Periodic risk reports to top management and, where applicable, to the board (6.7)
- Records of communication and consultation with interested parties (6.2)
- Results of periodic framework evaluations and improvement decisions (5.6 and 5.7)
The most common mistake isn’t a missing document; it’s a risk register that doesn’t talk to the company’s reality: generic risks copied from a template, assessed only once, with treatment actions that never left the page.
Auditors of ISO 9001 and other standards spot this gap quickly, because they ask an area manager what the risks of their process are and compare the answer with what is recorded.
How to implement ISO 31000 in your company
A structured path keeps risk management from becoming a bureaucratic exercise:
- Maturity assessment of current risk management, comparing what exists with the principles, framework and process of ABNT NBR ISO 31000:2018.
- Top management sponsorship and definition of the risk management policy, with roles and responsibilities.
- Definition of the initial scope, context and risk criteria, including the acceptable level of risk.
- Risk identification, analysis and evaluation, with the participation of areas and process owners.
- Risk treatment, with action plans, owners and deadlines.
- Monitoring, with risk indicators and tracking of the effectiveness of controls and actions.
- Recording, reporting and integrating risks into management review and planning.
- Periodic evaluation and improvement of the framework, expanding the scope as maturity grows.
The earlier risk management enters each area’s routine, rather than being concentrated in an annual review before the audit, the more value it generates, and the less effort it takes to keep up to date.
How to assess risk management maturity based on ISO 31000
Since there is no certification audit, the company itself needs to know whether its risk management works. The questions below serve both for a self-assessment or internal audit and to anticipate what the auditor of a certifiable standard will look at when assessing risks and opportunities.
| Area of the standard | What to check | Typical evidence expected | How Qualiex helps |
|---|---|---|---|
| Leadership and commitment (5.2) | Whether top management sponsors risk management, defines responsibilities and follows the main risks | Approved policy, risks discussed in management meetings, recorded decisions | Minutes and Decisions module linked to indicators and action plans, so risk discussions at the management level produce traceable decisions |
| Integration (5.3) | Whether risks are considered in planning, projects, changes and supplier selection, and not just in an annual survey | Risks linked to processes, projects and changes; risk assessment in relevant decisions | Risks module with a configurable methodology, letting you record risks by process, area or project on the same platform as the QMS |
| Risk criteria (6.3.4) | Whether likelihood and consequence scales are defined and used the same way by all areas | Documented risk matrix, defined acceptable risk level | Assessment methodology configured once in the Risks module and applied consistently to all risks |
| Risk assessment process (6.4) | Whether risks were identified with the participation of areas, analyzed for causes, consequences and controls, and prioritized | Up-to-date risk register, with owners and risk level | Central risk register, with owner, assessment history and periodic reassessment |
| Risk treatment (6.5) | Whether risks above the acceptable level have a treatment plan with an owner and deadline, and whether actions are completed | Action plans, evidence of implementation, reassessment after treatment | Action Plans module with owner, deadline and automatic alerts, linked to each risk |
| Monitoring and review (6.6) | Whether risks and controls are tracked with indicators and whether deviations trigger action | Risk indicators, measurement history, trend analysis | Indicators module with targets and late-collection alerts, to track risk indicators over time |
| Learning from incidents (6.6 and 5.7) | Whether incidents, nonconformities and complaints feed back into the risk register | Analyzed occurrences, risks revised after relevant events | Occurrences module with cause analysis, action plan and effectiveness verification, connecting what happened to the risk that should have anticipated it |
| Recording and reporting (6.7) | Whether risk information reaches decision-makers, in the right format and frequency | Periodic risk reports, management review agenda | Indicators and minutes centralized, with history available to report on the evolution of risks to management |
| Framework evaluation (5.6) | Whether the company periodically checks that risk management is working and fulfilling its purpose | Internal audit or maturity assessment, improvement plan | Audits module with registrable checklists, letting you build your own ISO 31000-based script |
ISO 31000 implementation checklist
We’ve broken the 8 implementation steps into individual blocks. Copy each one into your team’s task management tool and use it as a tracking checklist for the project.
Step 1. Maturity assessment
Before creating any new process, you need to understand how risks are already handled today, even informally. Without that, implementation ignores what already works and repeats what doesn’t.
- Survey where the company already assesses risks today (QMS, FMEA, safety, compliance, projects)
- Compare current practices with the principles, framework and process of ABNT NBR ISO 31000:2018
- Identify the different criteria, scales and languages each area uses
- Prioritize gaps by impact and effort
Step 2. Sponsorship and risk management policy
Without leadership, risk management becomes one area’s chore. This is where top management states what it expects and who is accountable for what.
- Obtain formal top management sponsorship for the initiative
- Draft and approve the risk management policy
- Define roles: top management, risk owners, facilitators and a support area
- Communicate the policy and responsibilities across the organization
Step 3. Scope, context and criteria
The criteria are the yardstick of risk management: if each area measures differently, risks stop being comparable.
- Define the initial scope (process, site, QMS risks or enterprise risks)
- Analyze the external and internal context and the relevant interested parties
- Define likelihood and consequence scales and the risk matrix
- Establish the acceptable level of risk and who can accept each risk level
Step 4. Risk identification, analysis and evaluation
This is the moment to turn scattered knowledge into a real risk register, built with the people who know each process.
- Run risk identification workshops with the areas and process owners
- Choose assessment techniques suited to each type of risk, with the support of IEC 31010
- Analyze causes, consequences and existing controls for each risk
- Prioritize risks based on the defined criteria
Step 5. Risk treatment
A well-made risk register is of no use if the priority risks don’t get a concrete response.
- Define the treatment option for each risk above the acceptable level
- Draw up action plans with an owner, deadline and resources
- Formally record accepted risks and who accepted them
- Reassess the risk after the actions are implemented
Step 6. Monitoring and indicators
Risks change. Without monitoring, the risk register ages within a few months.
- Define risk indicators for the priority risks
- Establish how often each risk is reassessed
- Connect incidents, nonconformities and complaints to the review of related risks
- Track the progress and effectiveness of treatment plans
Step 7. Recording, reporting and management review
Risk information only creates value when it reaches decision-makers at the right time.
- Define the format and frequency of risk reports
- Include the main risks on the management review agenda
- Record decisions and actions in formal minutes
- Integrate risks into strategic and budget planning
Step 8. Framework evaluation and improvement
Since no external auditor assesses ISO 31000, the company itself needs to verify that risk management fulfills its purpose.
- Carry out a periodic internal audit or maturity assessment
- Check that the principles of the standard are being practiced, not just declared
- Adjust criteria, roles and process according to lessons learned
- Plan the expansion of scope to new areas or types of risk
How to keep risk management alive day to day
In certifiable standards, the surveillance audit works as an external reminder that the system needs to keep working. In ISO 31000, that reminder doesn’t exist, and that is exactly why many risk management initiatives lose momentum after the first cycle: the risk register is built with great effort, presented to management and then only opened again on the eve of the next ISO 9001 audit.
The standard treats risk management as an iterative process, and maintenance depends on routine: reassessing risks at the defined frequency, reviewing the register whenever there is a relevant change (a new customer, a new process, a regulatory change, an incident), tracking risk indicators, following up on the completion of treatment plans and bringing the evolution of the main risks to management review.
The biggest risk at this stage is rarely technical; it’s operational: losing track of when each risk should have been reassessed, which treatment actions are overdue, who owns a risk after someone changed roles or which incident should have led to a risk review, especially when those controls are scattered across spreadsheets, emails and shared folders.
Common mistakes in ISO 31000 implementation
The same mistakes show up, with few variations, in companies of all sizes and industries:
| Most common mistakes | Root cause | How Qualiex solves it |
|---|---|---|
| A risk register built once and never reassessed | Risk management treated as a project deliverable, not a routine | Risks module with periodic reassessment and automatic deadline alerts |
| Each area using its own scales and matrices, making risks incomparable | Risk criteria not defined centrally or not applied consistently | Assessment methodology configured in the system and applied the same way to all risks |
| Generic risks copied from templates, unrelated to the real processes | Identification done by the quality area alone, without the participation of process owners | Risks recorded by process and by area, with a defined owner and assessment history |
| Treatment plans defined but never completed | Actions with no clear owner, no deadline or no follow-up | Action Plans module with owner, deadline and automatic alerts, linked to each risk |
| Incidents and nonconformities handled without reviewing the related risk | Occurrences and risks managed in separate tools | Occurrences module with cause analysis and action plan on the same platform as the Risks module |
| Risks that never reach top management or reach it without prompting a decision | Informal risk reporting, with no defined place in governance | Minutes and Decisions module linked to indicators and action plans, with a history of decisions made |
| A different risk matrix for each certification (ISO 9001, 14001, 45001) | Risks treated as a requirement of each standard, not as a single company process | Single risk register, with a configurable methodology, serving the different standards on the same platform |
| A company believing it “has ISO 31000” because it hired a course or received a non-accredited certificate | Confusion between personnel certification, private certificates and accredited certification | Periodic framework evaluation with its own checklists in the Audits module, measuring real practice, not the seal |
How Qualiex helps structure risk management based on ISO 31000
This is exactly where most companies lose their rhythm: keeping risk management active, with risks to reassess, treatment plans coming due, indicators to collect and incidents that should feed back into the register. Without an external auditor demanding ISO 31000, the routine has to be sustained by the process itself, and scattered spreadsheets and actions with no clear owner are the shortest path back to risk management as a document in a drawer.
Qualiex, Quality Management Software, centralizes risks, action plans, indicators, occurrences and nonconformities, minutes and decisions, documents, audits and suppliers on a single platform, with integrated modules, an audit trail and automatic deadline alerts.
The Risks module lets you configure the company’s assessment methodology, with criteria defined from ISO 31000, and apply it consistently to every area, with an owner, assessment history and periodic reassessment. Treatment plans are linked to each risk, risk indicators are tracked with targets and alerts, and occurrences connect what happened in practice to the risk that needs to be reviewed.
For companies certified to ISO 9001, ISO 14001 or ISO 45001, this also means keeping a single risk management process for all standards, ready for when the auditor asks how the company determines and treats risks and opportunities. And, for those facing the transition to ISO 9001:2026, it makes it easier to review in one place how risks and changes are planned in the QMS. No last-minute digging through files.
If your company is structuring or reviewing risk management, whether to mature its governance or to strengthen the certifications it already holds, talk to a ForLogic specialist and see how Qualiex can support your operation.
Frequently asked questions about ISO 31000
Can my company be certified to ISO 31000?
No. ISO 31000 is a guidelines standard, with recommendations rather than requirements, and it was not created for certification. There is no accredited ISO 31000 certification for organizations, and certificates of this kind offered by consultancies or private entities don’t carry the same recognition as, say, an ISO 9001 certification. What does exist are certifications for individuals, for professionals who work as risk managers or risk auditors.
Is ISO 31000 required by law?
No. Adopting ISO 31000 is voluntary. But risk management itself may be required: in Brazil’s federal public sector, governance regulations such as Decree 9,203/2017 and Law 14,133/2021 (the new public procurement and contracts law) call for risk management practices, and regulated sectors, such as financial services, have their own rules. In those cases, ISO 31000 is usually used as a reference for structuring the required risk management, but the law does not mandate adopting the standard itself.
If ISO 31000 isn’t certifiable, why implement it?
Because its value is in decisions, not in a seal. The standard helps the company identify and treat risks before they become problems, create a common risk language across areas, give visibility to top management and respond consistently to the risk requirements of certifiable standards. For those who already have ISO 9001, ISO 14001 or ISO 45001, it is the method that gives substance to the requirement to determine and treat risks and opportunities
Do I need ISO 31000 to meet the risk requirements of ISO 9001?
It isn’t mandatory. ISO 9001 requires the company to determine risks and opportunities and plan actions to address them, but makes clear that it does not require a formal risk management method. ISO 31000 is one way to do this more consistently, especially in companies with several areas or several certifications, but a simpler approach may be enough for a small company, as long as it works in practice.
What is the difference between ISO 31000 and COSO ERM?
Both are enterprise risk management references, but they have different origins and emphases. ISO 31000 is an international standard, shorter and more generic, applicable to any type of organization and risk. COSO ERM, published by the Committee of Sponsoring Organizations of the Treadway Commission, grew out of the internal controls and audit context, with a strong emphasis on governance, strategy and performance, and is widely used by publicly traded companies and internal audit functions. Many organizations combine the two, and neither is certifiable.
What is the difference between ISO 31000 and IEC 31010?
ISO 31000 defines the principles, framework and process of risk management. IEC 31010 is a supporting standard that describes techniques for carrying out the risk assessment process, such as FMEA, bow-tie, fault tree analysis, HAZOP, scenario analysis and the likelihood and consequence matrix, with guidance on when to use each. In short: ISO 31000 says what to do, IEC 31010 helps you choose how to do it.
Will ISO 31000 change? What happens to what my company has already implemented?
ISO 31000:2018 remains in force and was confirmed by ISO in 2023. A revision is under way, at the Committee Draft stage, with no announced publication date. Since the standard is not certifiable, a new edition does not open a transition period or invalidate what has been done: the company can adopt the changes at its own pace. The trend is for the revision to refine the 2018 approach, not replace it.
Do I need to hire a consultant to implement ISO 31000?
It isn’t mandatory. A consultant can speed up the definition of the framework, risk criteria and first assessments, especially in companies with no prior experience in structured risk management. Companies with a mature QMS, or supported by software that already centralizes risks, action plans and indicators, often run the implementation in-house at a lower cost.
How long does it take to implement ISO 31000?
It depends on the scope and the company’s maturity. A first complete cycle, with a policy, criteria, risk register and treatment plans for a defined scope, usually takes 3 to 6 months. Taking risk management across the whole organization and integrating it into governance and planning is a longer process, normally 12 to 24 months, because it involves culture change, not just documentation.
