ISO 31000:2018
Risk management — Guidelines
Standard Introduction
ISO 31000:2018 is an active (guidelines - not certifiable) standard published by International Organization for Standardization (ISO). It is commonly used across Manufacturing, Healthcare, Finance & Banking, Technology, Services, Government, Energy, Construction and applies in Global.
Use this page to review the official documentation, current status, and the certification or assessment bodies most commonly associated with ISO 31000:2018.
Universal Application
Applicable to any organization regardless of size, sector, or activity. Provides generic guidelines that can be customized to any type of risk — strategic, operational, financial, environmental, or compliance.
Integrated Framework
Built on three core pillars — principles, framework, and process — ensuring risk management is not a standalone activity but integrated into governance, strategy, planning, and decision-making at all levels.
Customizable & Scalable
Designed as a guidelines standard (not certifiable), giving organizations flexibility to adapt the framework and process to their specific context, risk appetite, and organizational culture.
list_alt Core Components
- Eight principles for effective risk management
- Leadership and commitment integration
- Framework design — integration, implementation, evaluation, improvement
- Risk identification across all organizational activities
- Risk analysis (qualitative, semi-quantitative, quantitative)
- Risk evaluation against criteria and risk appetite
- Risk treatment selection and implementation
- Communication, consultation, and continuous monitoring
Who Needs to Comply?
Any organization seeking a structured approach to managing risk — from small businesses to multinational corporations, government agencies, and non-profits. Widely used as a foundation for sector-specific risk management frameworks.
Key Requirements
Principles of Risk Management
Adopt the eight principles: risk management creates and protects value, is an integral part of all organizational processes, is part of decision-making, explicitly addresses uncertainty, is systematic and structured, is based on the best available information, is tailored, and considers human and cultural factors.
Risk Management Framework
Design a framework that integrates risk management into the organization through leadership commitment, organizational design, resource allocation, and establishing communication and reporting mechanisms.
Risk Assessment Process
Implement a systematic process of risk identification (what can happen and why), risk analysis (likelihood and consequences), and risk evaluation (comparing against criteria to determine treatment priorities).
Risk Treatment
Select and implement risk treatment options — avoid, accept, modify likelihood, modify consequences, share, or retain risk. Develop treatment plans and monitor their effectiveness.
Monitoring & Continuous Improvement
Establish monitoring and review processes to ensure risk management remains relevant and effective. Continuously improve the framework and process based on organizational learning and changing context.
Penalties & Enforcement
No penalties — ISO 31000 is a guidelines standard and is not certifiable. There are no regulatory requirements to comply with it. However, many regulations and industry standards reference ISO 31000 principles, and organizations using its framework often demonstrate better risk governance to regulators, investors, and stakeholders.
Official Documentation
Official PDF for ISO 31000:2018
Official publication or summary for ISO 31000:2018
Official online resource
International Organization for Standardization (ISO) guidance and reference material
Implementation toolkit
Templates, guidance, or companion resources for ISO 31000:2018