ISO 31000 — Risk management guidelines

Reviewed by Apex Insurance Brokers · Last reviewed 2026-06-22

Reviewed by Apex Insurance Brokers · Last reviewed 2026-06-22

Reviewed by Apex Insurance Brokers · Last reviewed 2026-06-22

Category: Risk management frameworks · Reviewed by Jake Leat, Associate Director · Last reviewed

ISO 31000:2018 is the international standard on risk management published by the International Organization for Standardization. It provides principles, a framework and a process applicable to any organisation regardless of sector or size. Unlike ISO 27001 or ISO 9001, ISO 31000 is not certifiable — it is a guidance standard.

Structure

The 2018 revision is organised around three layers:

1. Principles (Clause 4). Eight principles describe what good risk management looks like: integrated, structured and comprehensive, customised, inclusive, dynamic, best-available information, human and cultural factors, and continual improvement.

2. Framework (Clause 5). A Plan–Do–Check–Act cycle covering leadership and commitment, integration, design, implementation, evaluation and improvement of the risk-management arrangement.

3. Process (Clause 6). The operational steps: communication and consultation; scope, context and criteria; risk assessment (identification → analysis → evaluation); risk treatment; monitoring and review; recording and reporting.

ISO 31000 versus COSO ERM

ISO 31000 is shorter, principle-led and process-neutral; COSO ERM is more prescriptive, control-oriented and oriented to US-listed financial reporting requirements (Sarbanes-Oxley). Many UK insurers blend the two: COSO for internal controls and reporting, ISO 31000 for the operating risk process.

Companion standards

• ISO Guide 73:2009 — Risk management — Vocabulary. The authoritative source for risk terminology.
• IEC 31010:2019 — Risk assessment techniques. A toolbox of methods (HAZOP, FMEA, bowtie, Monte Carlo, etc.).
• ISO 31022:2020 — Legal risk management.

Why brokers reference ISO 31000

Insurer underwriting questionnaires for D&O, cyber and management-liability lines often ask whether the insured has adopted “a recognised risk management framework such as ISO 31000 or COSO ERM”. Affirmative answers can shift terms in the insured’s favour.

References

• ISO 31000:2018 — Risk management — Guidelines (BSI Standards reference).
• IEC 31010:2019 — Risk assessment techniques.
• ISO Guide 73:2009 — Risk management — Vocabulary.

Cross-references

• Enterprise risk management
• COSO ERM framework
• Risk treatment
• Risk assessment methodology

Maintained by Apex Insurance Brokers. FCA FRN 724952. Companies House 07014570.