Risk Management (ISO 31000)

ISO 31000 is a GUIDANCE document offering principles, a framework and a process for risk management. It is not designed for certification purposes and contains no requirements; the standard itself states this explicitly. It helps an organisation establish its risk management according to its own context.

• Organisations establishing an enterprise risk management (ERM) framework
• Those wanting to meet the risk-based thinking requirement of standards such as ISO 9001, ISO 14001, ISO 45001
• Internal audit and risk functions reporting risk to the board
• Organisations wanting to systematise risk assessment in project and investment decisions

Not mandatory, and no accredited certification is issued. There is no accredited certificate on the market called an 'ISO 31000 certificate'; training certificates issued to individuals are not an organisational certificate.

• Principles: creating and protecting value, being integrated, structured and comprehensive, customised, inclusive, dynamic, the best available information, human and cultural factors, continual improvement
• Framework: leadership and commitment, integration, design, implementation, evaluation, improvement
• Process — Defining scope, context and criteria
• Process — Risk assessment: risk identification, risk analysis, risk evaluation
• Process — Risk treatment: identifying options and implementing plans
• Process — Monitoring and review; recording and reporting
• Process — Communication and consultation

1. 1Gap AnalysisCurrent practices are compared against the guidance's recommendations; gaps are identified.
2. 2ApplicationThe process, roles and records the guidance recommends are implemented, adapted to the organisation's own structure.
3. 3Internal AssessmentThe effectiveness of implementation is measured through internal audit and review.
4. 4Second-Party Assessment (optional)A customer or an independent party can assess the implementation's conformity with the guidance and issue a report. This is not an accredited certificate.

This document is guidance; because no accredited certificate is issued, it also has no validity period. Implementation depends on the organisation's own review schedule.

• Existing policy, procedure and process descriptions
• Relevant records and measurement data
• Definitions of responsibility and authority

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The scope of the gap analysis
• Whether implementation consultancy is requested
• Whether a second-party assessment is requested

This document is not a requirement but a guide; That's why accredited certification is NOT provided. If anyone submits an accredited document such as "ISO 31000 certificate", this is against the accreditation rules. Implementation of the guidance can be considered as evidence in the audit of the relevant specification standard (e.g. ISO 9001, ISO 45001).

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• ISO 37001Anti-Bribery
• ISO 37301Compliance Management
• ISO 37000Corporate Governance
• ISO 37002Whistleblowing Management
• ISO 9001Quality Management System
• ISO 10002Customer Satisfaction and Complaint Management
• ISO 10004Customer Satisfaction Monitoring and Measurement
• ISO 10012Measurement Management System