ISO 31000:2018 risk management

ISO 31000 provides principles, a framework and a process for managing risk. The current edition, ISO 31000:2018, replaced ISO 31000:2009. It helps organisations set strategy, achieve objectives and make informed decisions by integrating risk management into governance, planning and everyday operations. ISO 31000 is a guideline standard, so it is implemented rather than certified.

ISO 31000:2018 can be used by any organisation, regardless of its size, activity or sector, so it is not specific to any industry. It can be applied throughout the life of the organisation and to any activity, including decision making at all levels: strategies, operations, processes, functions, projects, products, services and assets. It applies to any type of risk, whether its effects are positive or negative.

Although ISO 31000 provides generic guidelines, it does not aim at uniform risk management across organisations. The design and implementation of risk management plans and frameworks must take into account the needs of the specific organisation: its objectives, context, structure, operations, processes, functions, projects, products, services, assets and specific practices.

Typical sectors (companies and authorities): advisory firms, heavy manufacturing companies, financial institutions (banks, insurance companies, brokerage companies and others) and investment companies.