What ISO 31000 Is — And Is Not
ISO 31000:2018 provides principles, a framework, and a process for managing risk in any type of organisation, regardless of sector, size, or complexity. It is intentionally principles-based: it describes what effective risk management should achieve and the structural elements that support it, without prescribing specific methodologies, tools, or rating systems.
This makes ISO 31000 fundamentally different from compliance standards like ISO 27001 or SOC 2, which specify controls that must be implemented. An organisation cannot be "certified" to ISO 31000 — there is no certification scheme, because the standard does not define a specific set of requirements to be audited against. Organisations align with ISO 31000; they do not comply with it in the conventional audit sense.
The Three Components: Principles, Framework, and Process
The principles describe the characteristics that effective risk management should possess: integrated into the organisation's governance and operations, structured and comprehensive, customised to the context, inclusive of stakeholder perspectives, dynamic in response to changing conditions, informed by available information, informed by human and cultural factors, and continually improving. These principles provide a quality standard for assessing whether risk management practices are achieving their purpose.
The framework describes the structural elements that support risk management: the commitment and leadership from governance bodies and senior management, integration into the organisation's governance structures, the design and implementation of the risk management programme, evaluation and improvement mechanisms. The framework is essentially a governance model for risk management — describing how risk management should be positioned and overseen within the organisation.
The process is the operational element: communication and consultation with stakeholders, establishing context (external, internal, and risk management), risk assessment (identification, analysis, and evaluation), risk treatment, monitoring and review, and recording and reporting. This process applies at any level of the organisation, to any type of risk, and across any time horizon.
Practical Application for Internal Auditors
Internal auditors use ISO 31000 primarily in two ways: as a benchmark for assessing the quality of an organisation's risk management programme, and as a framework for planning and conducting risk-based audits.
When assessing risk management, the auditor can map the organisation's actual practices against ISO 31000's principles and framework to identify gaps — areas where risk management is not integrated, not comprehensive, or not systematically improving. The standard's principles function as audit criteria: does the organisation's risk management practice exhibit the characteristics that ISO 31000 says it should?
When planning risk-based audits, the risk assessment process described in ISO 31000 provides a sound methodology for identifying, analysing, and evaluating risks within the audit universe — helping the audit function apply to its own planning the same risk management rigour it expects of the functions it audits.
ISO 31000's value is not as a compliance checklist — it is as a thinking framework. Professionals who internalise its principles develop the ability to assess the quality of risk management intuitively and consistently, across very different organisational contexts.
The 2018 Update: Key Changes
The 2018 revision of ISO 31000 made several important changes from the 2009 version. It strengthened the emphasis on leadership and commitment, recognising that risk management culture cannot be implemented through process alone. It added explicit attention to human and cultural factors — a significant advance over the previous version's more mechanical treatment of the process. It also simplified the structure, making the standard more accessible and easier to implement. For organisations that still reference the 2009 version, updating to the 2018 framework is worthwhile — the improvements are substantive, not merely cosmetic.