Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    ISO 31000

    Definition

    International standard of risk management guidelines: principles, a framework and a process for any organisation, whatever its size or sector.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/iso-31000

    Scope: ISO 31000:2018 gives guidelines and is not certifiable; ISO shows it as under revision.

    Sources checked: . Examples are editorial illustrations.

    What ISO says ISO 31000:2018 is, and is not

    ISO 31000:2018, Risk management: Guidelines, is the second edition, published in February 2018, and it replaced ISO 31000:2009. ISO's page says it provides principles, a framework and a process for managing risk and can be used by any organisation regardless of size, activity or sector. It lists the benefits as a standard set of principles, framework and process, guidance for implementing risk management practices, tools for contextualising it to any organisation, criteria for monitoring, reviewing and improving it, and a foundation for integrating it throughout an organisation. The process runs through identifying, analysing, evaluating, treating, monitoring and communicating risks, and the framework side concerns embedding risk management into governance, strategy, planning, reporting, policies, values and culture. The page also says the publication was last reviewed and confirmed in 2023, so that version remains current.

    Two limits matter to a buyer. First, it gives guidelines and not requirements: ISO says it is not a certifiable standard and cannot be used for certification, although it provides guidance for internal or external audit programmes. A claim of certification to ISO 31000 is therefore worth querying. Second, it does not list assessment techniques. IEC 31010:2019, Risk management: Risk assessment techniques, is a separate publication that gives guidance on selecting and applying such techniques, and its page says the concepts of ISO 31000 are no longer repeated in it. ISO shows IEC 31010 as published in June 2019 in its second edition, which replaced the 2009 first edition.

    ISO's page shows the stage of the standard as to be revised, and lists ISO/CD 31000 as under development to replace it. Until a new edition is published, the 2018 edition is the current one, and a record should cite the edition. HSE's workplace guidance is narrower and practical: identify hazards, assess risks, control them, record findings and review. ISO 31000 covers risks that can be threats or opportunities across an organisation, while HSE's steps address harm at work, so the two overlap in subject without being the same. This page is general information, not legal advice or a certification statement.

    Sources opened :

    What an ISO 31000 style record holds in software

    • A risk entry with the objective at stake, the source and event, the possible consequences and the owner.
    • The context: scope, evaluation criteria and acceptance criteria, with the approver and date.
    • Evaluation results with the scales or criteria named, so results can be compared.
    • Treatment options chosen, with owner, date and expected effect, and the residual risk after treatment.
    • Monitoring and review entries, with dates and what changed.
    • Links from each risk to the actions, incidents or audit findings that bear on it.
    • Communication records: who was told, when and what was decided.

    ISO 31000, risk assessment techniques and a risk register

    ISO 31000 sets out a framework and process, IEC 31010 describes techniques used within an assessment, and a risk register is a record that either could produce. A tool with a risk matrix does not by itself show that risk management follows the guidelines, because governance, integration and review sit outside any single screen.

    A hypothetical example: one process, two kinds of risk

    This scenario is invented and describes no real firm. A mid-sized food manufacturer sets the scope of its risk process to cover production, supply and finance, and records its evaluation criteria and the person who approved them. A worker injury risk and a supplier failure risk are both entered with the objective each threatens, an owner and the controls already in place.

    At evaluation both are scored against the same recorded criteria. The injury risk is treated by redesigning a task and the supplier risk by adding a second source, and the register records the residual risk after each treatment and the review date. Six months later a monitoring entry shows that the second source has a longer lead time, so the owner reopens the risk, records the new consequence and tells purchasing. The entry also notes which assessment technique was used, so a later reader can see how the score was reached. The earlier entries stay in the history with the criteria version each was scored under.

    Common misunderstandings about ISO 31000

    • ISO 31000 is not a certification. ISO says it is not certifiable and cannot be used for certification.
    • It is not a hazard list or a checklist. It gives principles, a framework and a process, while techniques sit in separate documents such as IEC 31010.
    • It is not only about safety. ISO's page speaks of threats and opportunities across strategy, planning and reporting, which is wider than HSE's steps for harm at work.
    • The 2018 edition is not withdrawn. ISO shows it as published and confirmed in 2023, although a replacement, ISO/CD 31000, is in development.
    • A matrix is not the process. Scoring is one step, and context, treatment, monitoring and communication are also part of the process ISO describes.

    How ISO 31000 relates to other glossary terms

    ISO 31000 is the general frame, and several narrower terms work inside it.

    • HIRA: hazard identification and risk assessment for workplace harm, narrower than the standard.
    • ALARP: a UK principle for judging when a risk has been reduced far enough.
    • ISO 19011: guidance on auditing management systems, another ISO guidance document.
    • Bow-tie: a technique for showing how a hazardous event can arise and what barriers lie between cause and consequence.

    Records and evidence that usually exist for ISO 31000 style risk management

    • The risk register with owners and objectives.
    • The scope, criteria and their approval.
    • Evaluation records with the scales used.
    • Treatment plans with dates and residual risk.
    • Monitoring and review notes.
    • Communication records, and the edition of the guidelines cited.
    • The assessment techniques used for each risk, where a technique was applied.

    What a software tool needs to capture for ISO 31000 style records

    • Risk records tied to an objective, not only to a hazard.
    • Configurable criteria and scales, with the version stored on every score.
    • Treatment actions with an owner, a date and a field for residual risk.
    • Scheduled and event-driven review, with a history of changes.
    • A communication log or tasks for notifying affected owners.
    • Reports that show which process steps were completed, not only a heat map.
    • A field for the edition of the standard that the procedure cites.

    Catalog profiles documenting risk assessment or risk register records

    The list follows the risk assessment or risk register rule. ISO 31000 is not certifiable, so a listing does not show that a product follows it; ask which parts of the process a product records.

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 38 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Can a company be certified to ISO 31000?

    ISO says no. It provides guidelines, is not a certifiable standard and cannot be used for certification, although it gives guidance for internal or external audit programmes.

    Is ISO 31000:2018 still current?

    Yes. ISO shows it as published and reviewed and confirmed in 2023, with the stage 'to be revised' and ISO/CD 31000 under development. ISO lists the 2009 edition as withdrawn. Check the ISO page for a new edition before citing it.

    How does it relate to a risk matrix?

    A matrix is a tool for evaluating likelihood and consequence. ISO 31000 concerns the principles, framework and process around such tools, and IEC 31010 covers assessment techniques. The process also covers context, treatment, monitoring and communication.

    More standards terms

    Related guides