A Risk Practitioners Guide

to ISO 31000: 2018

Review of the 2018 version of the ISO 31000 risk
management guidelines and commentary on the
use of this standard by risk professionals

1 A Risk Practitioners Guide to ISO 31000 – 2018

About IRM
IRM is the leading professional body for risk management.
We are an independent, not-for-proft organisation that
champions excellence in managing risk to improve
organisational performance.

We do this by providing internationally recognised qualifications and training, publishing research

and guidance and raising professional standards across the world. Our members work in all
industries, in all risk disciplines and across the public, private and not-for-proft sectors.

© Institute of Risk Management

A company limited by guarantee.
Registered in England number 2009507

IRM does not accept any liability to any party for any loss, damage or costs
howsoever arising, whether directly or indirectly, whether in contract, tort
or otherwise from any action or decision taken (or not taken) as a result of
any person relying on or otherwise using this document or arising from any
omission from it.

Registered Office: 2nd Floor, Sackville House,

143-149 Fenchurch Street, London, EC3M 6BN

T – +44 (0)20 7709 9808

E – enquiries@theirm.org
W – www.theirm.org

2 A Risk Practitioners Guide to ISO 31000 – 2018

Contents
1. Executive summary
2. Nature of management systems
3. Changing risk context for organisations
4. Structure and approach of ISO 31000
5. Guidance provided by ISO 31000 – principles
6. Guidance provided by ISO 31000 – framework
7. Guidance provided by ISO 31000 – process
8. Comparison of ISO 31000 against Annex SL
9. Relevance of ISO 31000 for risk professionals

Appendix A:
Structure of ISO management system standards

Appendix B:
Components of ISO 31000: 2018

3 A Risk Practitioners Guide to ISO 31000 – 2018

1. Executive Summary
There are many recommended approaches to risk Develop’ components, as illustrated in Figure 1 and Figure
management (RM) and several different guides and 2, respectively. This guide considers these two groups of
risk management frameworks and standards have been components as the means of comparing ISO 31000 with the
published. This guide explains the approach used in ISO Annex SL format. The conclusion is that ISO 31000 includes
31000:2018 Risk management – Guidelines and identifies all the required features of a management system standard,
the importance and relevance of ISO 31000 and other but with the emphasis on the ‘Control and Develop’
frameworks. This guide also outlines the practical application components.
of the ISO 31000 guidelines and provides commentary on
implementation. Overall, ISO 31000 provides detailed guidelines on the
plan, implement, measure and learn features of a risk
It remains a challenge for risk professionals to clearly management system, but less explicit information on
demonstrate the value of making resources available for the context, leadership and support features required
risk management. In view of this continuing challenge, of a management system standard. An analysis of the
ISO has published an updated version of ISO 31000 components of ISO 31000 is provided in Appendix B. The
Risk management – Guidelines. This IRM guide provides message for risk professionals is that their employer or client
commentary on the revised ISO 31000. In 2017 COSO organisations should implement the ISO 31000 principles
published ‘ERM – Integrating Strategy and Performance’ and components that are best suited to their particular
and a separate IRM guide to the updated COSO framework circumstances and modify other principles and components,
has also been published. as necessary.

In order to evaluate ISO 31000 and, in the separate ISO 31000 contains much valuable information and it
guide, the updated COSO framework, a recognised format represents robust, high-level guidelines for the management
is necessary. The International Standards Organisation of risk. However, there is no step-by-step checklist to
(ISO) published a highly regarded guide to the format for implementation of the risk management initiative.
management system standards entitled Annex SL. The The challenge for risk professionals is to rearrange the
Annex SL format for management system standards is guidance in ISO 31000 to align with their own approach
summarised in Appendix A of this guide. to implementing a risk management initiative. This guide
provides an analysis of ISO 31000, a comparison with the
Annex SL describes seven substantive components of a ISO format for management system standards (Annex SL)
management system standard. These are grouped in this and outlines a checklist for the implementation of a risk
guide as ‘Scope and Design’ components and ‘Control and management initiative in Section 9.

4 A Risk Practitioners Guide to ISO 31000 – 2018

2. Nature of management systems
A management system is the framework of policies, In order to review ISO 31000, the Annex SL components
processes and procedures employed by an organisation have been grouped into components that consider the
to ensure that it can fulfill the tasks required to achieve its ‘Scope and Design’ and components that consider the
purpose and objectives. These objectives will cover all aspects ‘Control and Develop’ features of a management system.
of the organisation, including strategy, tactics, operations The Annex SL components relevant to ‘Scope and Design’
and compliance. For instance, a quality management system are context, leadership and support. The components
enables organisations to improve the quality and consistency relevant to ‘Control and Develop’ are planning, operation,
of products and/or services. performance and improvement. These latter components
are equivalent to plan, implement, measure and learn
ISO has published a guide to management system standards (PIML) or the plan-do-check-act approach used in some
with information on the sections that should be included. This management systems.
ISO guidance is published as Annex SL and several standards
have already been converted into this format. ISO 9001 on Figure 1 illustrates the relationship between the three
quality management is the best established international components of the ‘Scope and Design’ and Figure 2
standard and was updated in 2015 using the Annex SL illustrates the relationship between the four components
format. Several existing ISO management system standards of ‘Control and Develop’. Presentation of the Annex SL
are being converted into the Annex SL format, including components in this format separates the ‘Scope and
ISO 14001 – Environmental management systems and Design’ components, which represent the framework for
ISO 45001 – Occupational health and safety management supporting risk management from the ‘Control and Develop’
systems. components which represent the risk management process
itself.
Given the well-established nature of Annex SL and the fact
that ISO 9001 has already been converted into this format, Formalised management systems have defined, documented
it is the most appropriate structure against which to judge processes that are intended to explicitly manage
the completeness of ISO 31000. A summary of the Annex processes within an organisation. These will be auditable
SL format is provided in Appendix A. However, ISO 31000 standards developed for each activity or process. Informal
and the COSO framework Enterprise Risk Management – management systems are implicit and may include roles
Integrating with Strategy are not in the Annex SL format. and responsibilities, audits and management of change.
Table 2 in Section 8 of this guide compares ISO 31000 with However, for larger organisations formalised processes are
the Annex SL format and provides a useful means of testing essential and that explains the importance of published
the completeness of ISO 31000. standards, such as ISO 9001 and ISO 31000.

Figure 1: Scope and design components Figure 2: Control and develop

of management systems components of management systems

Context Plan Implement

Organisation, stakeholder Management system Operational planning,
expectations and scope of objectives and planning to implementation and control
the management system achieve them

Support Leadership Learn Measure

Resources, competence, Commitment, policy and Non-conformity, corrective Monitoring, measurement,
awareness, communication organisational roles and action and continual analysis, evaluation, audit
and documentation responsibilities improvement and review

5 A Risk Practitioners Guide to ISO 31000 – 2018

3. Changing risk context
for organisations
The World Economic Forum (WEF) has commented on the Indeed, it is no longer acceptable for organisations to find
increasing volatility, uncertainty, complexity and ambiguity themselves in a position whereby unexpected events cause
of the world. WEF states that the current competitive financial loss, disruption to normal operations, damage to
landscape can be defined by one word: ‘disruption’. WEF reputation and loss of market presence. Stakeholders now
states that the ideas of incremental progress, continuous expect that organisations will take full account of the risks
improvement, and process optimizations do not work that may cause non-compliance with statutory obligations;
anymore. WEF acknowledges that these practices are disruption and inefficiency within operations; late delivery of
necessary, but are insufficient. projects; or failure to deliver promised strategy.

WEF supports the analysis that stakeholders are more There are an increasing number of risks faced by
engaged today, seeking greater transparency and organisations. Some of these risks relate to managing the
accountability for managing the impact of risk, while organisation and others relate to rapid and/or unexpected
also critically evaluating leadership ability to embrace changes in the marketplace. Most organisations need to
opportunities. Even success can bring with it additional manage risks associated with:
downside risk, such as the risk of not being able to fulfill • Variable cost or availability of raw materials.
unexpectedly high demand or maintain expected business • Cost of retirement/pension/social benefits.
momentum. Organisations and board members need to be • Increasing importance of intellectual property (IP).
more adaptive to change. They need to think strategically • Greater supply chain and joint venture dependency and
about how to manage the increasing volatility, uncertainty, complexity.
complexity and ambiguity of the world. • Reputation becoming more important and more
vulnerable.
Following the global financial crisis in 2008, all organisations • Regulatory pressures and legislative requirements
are taking a greater interest in risk and risk management. It increasing.
is increasingly understood that the explicit and structured
management of risk brings benefits. By taking a proactive The changes in the marketplace can be even more dramatic
approach to risk and risk management, organisations will be and include:
able to achieve the following four areas of improvement: • Volatile markets and globalization of customers, suppliers
• Strategy, because the risks associated with different and products.
strategic options will be fully analysed and better strategic • Increased competition in the marketplace and greater
decisions will be reached. customer expectations.
• Tactics, because consideration will have been given • Product innovation and rapid changes in product
to selection of the tactics and the risks involved in the technology.
alternatives that are available. • Threats to national economies and restricted freedom of
• Operations, because events that can cause disruption will world trade.
be identified and actions taken to reduce the likelihood of • Potential for international organised crime and increased
these events, limit the damage and contain the cost. political risks.
• Compliance will be enhanced because the risks associated • Extreme weather events resulting in destruction and/or
with failure to achieve compliance with statutory and population shift.
customer obligations will be recognized.

6 A Risk Practitioners Guide to ISO 31000 – 2018

Management holds overall responsibility for managing
risks to the organisation, but it is important for senior
management to go further and enhance the conversation
with the board and stakeholders. Risk management needs
to be used to gain a competitive advantage. Through
enhanced risk management, senior management and the
board will gain a better understanding of how the explicit
consideration of risk may beneficially impact the choice of
strategy.

Traditionally, risk management has played a strong

supporting role at board level. Now, boards are increasingly
expected to provide robust oversight of risk management.
ISO 31000 provides important information for boards,
so that they can define and fulfil their risk oversight
responsibilities. These considerations include governance
and culture; strategy and objective-setting; performance;
information, communications and reporting; and the review
and revision of practices to enhance the performance of the
organisation.

However, there is a danger when implementing ISO 31000

that the output from the risk management process forms a
stream of management information that is separate from
the other information required to successfully manage the
organisation. It is important that risk managers undertake
their activities in a way that aligns with the current business
model and the strategy for the future.

Integrating consideration of risk into existing management

activities will ensure that risk information is part of the
management information used by executives and board
members. This will help overcome the perception that
risk management is only concerned with compiling and
managing a list of risks and this can be undertaken
separately from the day-to-day management of the
organisation and the development of strategy for the future.

7 A Risk Practitioners Guide to ISO 31000 – 2018

4. Structure and approach
of ISO 31000
ISO 31000 was originally published in 2009 and an updated As with all ISO standards and guidelines, the first substantive
version was published in February 2018. However, the overall section defines key terms. A total of eight terms are defined,
purpose of ISO 31000 remains the same – integrating including the definition of risk as “the effect of uncertainty
the management of risk into a strategic and operational on objectives”. This definition is clarified by a note to the
management system. The 2018 version is very similar to the definition stating that risk is usually expressed in terms of
original version, but the following bullet points identify the risk sources, potential events, their consequences and their
main changes for the 2018 version of the guidelines: likelihood.
• the principles of risk management have been reviewed, as
these are the key criteria for successful risk management; The new version of ISO 31000 is shorter than the earlier
• the importance of leadership by top management is version, and it presents a high-level overview of risk
highlighted, as is the integration of risk management, management and how a risk management initiative can
starting with the governance of the organisation; be implemented. ISO 31000 suggests that effective risk
• greater emphasis is placed on the iterative nature of risk management is characterised by principles, framework and
management, because new knowledge and analysis leads process. The separation of principles, framework and process
to revision of processes, actions and controls; and is not in line with the suggested format for management
• the content is streamlined with greater focus on system standards, as described in Annex SL. This may
sustaining an open systems model to fit multiple needs present the risk professional with a challenge when seeking
and contexts. to produce an implementation plan or checklist for their risk
management initiative based on ISO 31000.
ISO 31000:2018 Risk Management The overall structure and approach adopted by the 2018
– Guidelines edition of ISO 31000 is best illustrated by the diagram
included in ISO 31000 and reproduced over the page as
“A lot of the complicated language has been eliminated, so Figure 3. ISO 31000 states that managing risk is based
the text is leaner and more precise. The new draft is shorter, on the principles, framework and process described in
but it gains in clarity and precision and is much easier to the guidelines. It also states that these principles and
read. It includes improvements, such as the importance of components might already exist in full or in part within
human and cultural factors in achieving an organisation’s an organisation, but they might need to be adapted or
objectives and an emphasis on embedding risk management improved so that managing risk is efficient, effective and
within the decision-making process.” consistent.

Edited extract from ISO website, www.iso.org

8 A Risk Practitioners Guide to ISO 31000 – 2018

Figure 3: Principles, framework and risk management process from ISO 31000

Risk Management Principles

Risk Management Framework Risk Management Process

Continual Integrated
Improvement

Human &
Cultural Structured &
Factors Comprehensive
Value Creation
and
Best Available Protection Customised
Information

Dynamic Inclusive

Integration Scope, Context,

Communication & Consultation

Criteria

Monitoring & Review

Risk Assessment
Improvement
Risk Identification
Leadership & Design
Risk Analysis
Commitment
Risk Evaluation

Evaluation
Implementation Risk Treatment

Recording & Reporting

Permission to reproduce extracts from British Standards is ISO 31000 states that the guidelines should be used by
granted by BSI Standards Limited (BSI). No other use of this people who create and protect value in organisations by
material is permitted. British Standards can be obtained in managing risks, making decisions, setting and achieving
PDF or hard copy formats from the BSI online shop: objectives and improving performance. The guidelines
www.bsigroup.com/Shop are applicable to all types and sizes of organisations and
relevant to all external and internal factors and influences.
They also state that managing risk assists organisations
in setting strategy, achieving objectives and making
informed decisions. Managing risk is part of governance and
leadership and is fundamental to how organisations are
managed at all levels.

9 A Risk Practitioners Guide to ISO 31000 – 2018

5. Guidance provided in
ISO 31000 – principles
ISO 31000 states that the purpose of risk management is 6. Risk management explicitly considers any limitations of
the creation and protection of value. The principles set out available information.
in ISO 31000 provide guidance on the characteristics of 7. Human and cultural factors influence all aspects of risk
effective and efficient risk management, communicating its management.
value and explaining its intention and purpose. There are 8. Risk management is continually improved through
total of eight principles presented in the standard, as shown learning and experience.
in Figure 3 of this guide.
The first five principles provide guidance on how a risk
The ISO 31000 guidelines provide a statement of risk management initiative should be designed, and principles
management principles. The eight principles are described six, seven and eight relate to the operation of the risk
below: management initiative. These latter principles confirm
1. Framework and processes should be customised and that the best information available should be used; human
proportionate. and cultural factors should be considered; and the risk
2. Appropriate and timely involvement of stakeholders is management arrangements should ensure continual
necessary. improvement.
3. Structured and comprehensive approach is required.
4. Risk management is an integral part of all organisational The first five principles are concerned with the design and
activities. planning of the risk management initiative and these
5. Risk management anticipates, detects, acknowledges and principles are often summarised as proportionate, aligned,
responds to changes. comprehensive, embedded and dynamic (PACED), as shown
in Table 1.

Table 1: Principles of risk management

Principle Description
Proportionate Risk management activities must be proportionate to the level of risk faced by the
organisation.
Aligned Risk management activities need to be aligned with the other activities in the
organisation.
Comprehensive In order to be fully effective, the risk management approach must be
comprehensive.
Embedded Risk management activities need to be embedded within the organisation.
Dynamic Risk management activities must be dynamic and responsive to emerging and
changing risks.

10 A Risk Practitioners Guide to ISO 31000 – 2018

6. Guidance provided in
ISO 31000 – framework
The principles of risk management and the framework are ISO 31000 places great emphasis on understanding the
closely related. For example, one of the principles is that organisation and its context. Information is provided on
risk management should be integrated and one of the how to examine both the external and internal context
components of the framework is integration. The principle of the organisation. There is also advice and guidance on
outlines what must be achieved, and the framework provides articulating risk management commitment, assigning roles
information on how to achieve the required integration. and responsibilities and allocating resources. There is some
guidance on establishing communication and consultation
The ISO 31000 guidelines are centred on leadership and in the framework section of ISO 31000 with more detailed
commitment. The effectiveness of risk management will information in the process section of the guidelines.
depend on its integration into all aspects of the organisation, Therefore, the guidance on communication and consultation
including decision-making. The remaining components in the framework section needs to be read in conjunction
of the framework are design, implementation, evaluation with the guidance on the same topic in the process section
and improvement. This approach is often represented in of ISO 31000.
management literature as plan-do-check-act. It is similar
to the plan, implement, measure learn (PIML) approach Understanding the organisation and its context is included
described in Section 9 of this guide. as part of the framework guidance in ISO 31000 and is also
included in the process section under the heading ‘scope,
ISO 31000 provides narrative description of how the context, criteria’. The components of establishing the
framework should support risk management activities in an context are described as defining the purpose and scope
organisation. This is often referred to as the risk architecture, of risk management activities; establishing the external,
strategy and protocols of the organisation, as set out in internal and risk management context; and defining the
Table 2. There is information in ISO 31000 about the extent risk criteria. Defining the risk criteria involves specifying the
of leadership and commitment that is required, and the amount and type of risk that the organisation may or may
range of activities involved in designing and implementing not take, relative to objectives. This is usually referred to as
the risk management initiative, and this information is the ‘risk appetite’ of the organisation.
compatible with the activities listed in Table 2.
However, ISO 31000 does not use the phrase ‘risk appetite’,
even though it is defined in the ISO Guide 73:2009 Risk
Table 2: Risk management framework management – Vocabulary. Risk appetite is defined in Guide
73 as the amount and type of risk that an organisation is
Risk management architecture
willing to pursue or retain. The phrase ‘risk appetite’ is used
• Committee structure and terms of reference
by many organisations and is frequently described in the
• Roles and responsibilities
annual report and accounts of a wide range of different
• Internal reporting requirements
types of organisation. ISO 31000 provides guidance on
• External reporting controls
the concept of ‘risk criteria’, but no guidance specific to the
• Risk management assurance arrangements
more commonly used concept of ‘risk appetite’.
Risk management strategy
• Risk management philosophy
• Arrangements for embedding risk management
• Risk appetite and attitude to risk
• Benchmark tests for significance
• Specific risk statements/policies
• Risk assessment techniques
• Risk priorities for the present year
Risk management protocols
• Tools and techniques
• Risk classification system
• Risk assessment procedures
• Risk control rules and procedures
• Responding to incidents, issues and events
• Documentation and record keeping
• Training and communications
• Audit procedures and protocols
• Reporting/disclosures/certification
11 A Risk Practitioners Guide to ISO 31000 – 2018
7. Guidance provided in
ISO 31000 – process
The section of ISO 31000 concerned with the risk risk management process is no longer represented as a series
management process describes risk assessment and risk of linked activities with connecting arrows in the way that
treatment as being at the centre of the risk management it was presented in the 2009 version of ISO 31000. The risk
process. This section also includes guidance on (1) scope, management process is now presented as a set of iterative
context and criteria; (2) communication and consultation; steps that are undertaken in a coordinated manner, but not
(3) monitoring and review; and (4) recording and reporting. necessarily in a strict sequence.
In many organisations, these latter four related activities
are more closely aligned with the framework. It could In this regard, the new representation of the risk
be argued that these four activities are part of the risk management process in ISO 31000 is similar to the
management context and, therefore, should be part of approach taken by the 2004 COSO publication Enterprise
the risk management framework. The risk management Risk Management — Integrated Framework (COSO ERM
framework is often described as the risk architecture, strategy cube). ISO 31000 acknowledges this similarity by stating:
and protocols of the organisation. ‘Although the risk management process is often presented
as sequential, in practice it is iterative’.
The nature and extent of risk management activities in an
organisation are influenced by risk attitude and risk appetite. At the centre of the risk management process are the
The risk attitude and risk appetite of the organisation, as activities of risk assessment and risk treatment. Risk
supported by the risk criteria for different types of risks, helps assessment is described as having the three stages of risk
to define the risk management context of the organisation. identification, risk analysis and risk evaluation. Each of
Risk attitude and risk appetite also provide the foundations the three stages is described in detail in ISO 31000 and it
for undertaking risk assessments and recording the results in provides valuable insight into how risks can be identified,
the risk register. The nature and extent of communication of how they can be analysed in terms of likelihood and
the information contained in the risk register throughout the consequences and finally, how they can be evaluated in
risk architecture of the organisation also helps define the risk relation to the established risk criteria (risk appetite) to
management context. determine whether additional action is required.

The risk management context is part of the internal context Risk treatment is also a vitally important part of the risk
of an organisation. The internal context refers to the management process and ISO 31000 provides information
organisation itself, the activities it undertakes, the range on the selection of risk treatment options, the preparation
of skills and capabilities available within the organisation, and implementation of risk treatment plans. ISO 31000
and how it is structured. Internal stakeholders and their states that the selection of risk treatment options involves
expectations are part of the internal context. balancing the potential benefits of introducing further risk
treatment (controls) against the associated cost, effort
Internal context is about the culture of the organisation, or disadvantages. The risk treatment plan should clearly
the resources that are available, receiving outputs from the identify the timescale and responsibilities for implementing
risk management process and ensuring that these influence the selected risk treatments.
behaviours that support and provide governance of risk and
risk management. The internal context concerns objectives, The guidelines provided in ISO 31000 includes information,
the capacity and capabilities of the organisation, as well as advice and guidance on all the steps required to implement
the business core processes that are in place. An important risk management and ensure continual improvement in
consideration regarding the internal context is how the performance. As illustrated in Section 8, there is a high
organisation makes decisions. degree of completeness in ISO 31000 compared with the
requirements of Annex SL. Section 9 of this guide provides
Having discussed the context for the organisation, ISO a consolidated approach to the implementation of a risk
31000 provides considerable information on the risk management initiative in terms of plan, implement, measure
management process and provides a diagram that is and the learn (PIML).
included in this guide as Figure 3. It should be noted that the

12 A Risk Practitioners Guide to ISO 31000 – 2018

8. Comparison of ISO
31000 against Annex SL
ISO has published guidance on the format for management ISO 31000 provides separate narrative and guidance on
system standards as Annex SL and this format has the principles, framework and process for risk management.
been adopted for the most recent version of the quality Separation presentation of principles, framework and process
standard ISO 9001:2015 Quality management systems is not aligned with the format of Annex SL. This separation
– Requirements. Annex SL provides information on the makes mapping of ISO 31000 against Annex SL challenging.
components that are required in a full management system Nevertheless, Table 3 provides a mapping of the framework
standard. Appendix A summarises the Annex SL format. and process components of ISO 31000 against Annex SL.
The mapping demonstrates that ISO 31000 provides full
Figure 1 and Figure 2 in Section 2 of this guide illustrate the coverage of the requirements for a management system
relationship between the seven substantive components of standard.
Annex SL. Figure 1 identifies the relationship between the
‘Scope and Design’ components of context, leadership and
support. Figure 2 identifies the relationship between the
‘Control and Develop’ components of the plan, implement,
measure and learn.

Table 3: Mapping of ISO 31000 against Annex SL

Clause Annex SL heading ISO 31000 (2018)
1. Scope
2. Normative references
3. Terms and definitions
4. Context of the organisation
4.1 Understanding the organisation and its context Component 2 of the Framework: ‘Integration’ includes
4.2 Understanding the needs and expectations of determining oversight roles and responsibilities and ensuring
interested parties RM is part of all aspects of the organisation
4.3 Determining the scope of the management Component 2 of the Process: ‘Scope, context and criteria’
system includes purpose and scope of RM, defining risk criteria and risk
4.4 The management system decision-making
5. Leadership
5.1 Leadership and commitment Component 1 of the Framework: ‘Leadership and
5.2 Policy commitment’ includes aligning RM, policy statement,
resources and risk appetite
5.3 Organisational roles, responsibilities and Component 3 of the Framework: ‘Design’ includes internal
authorities and external context, roles and responsibilities, and
communications and consultation
6. Planning
6.1 Actions to address risks and opportunities Component 1 of the Framework: ‘Leadership and
6.2 Management system objectives and planning to commitment’ includes aligning RM, policy statement,
achieve them resources and risk appetite

Component 3 of the Framework: ‘Design’ includes internal

and external context, roles and responsibilities, and
communications and consultation

13 A Risk Practitioners Guide to ISO 31000 – 2018

 7. Support
7.1 Resources Component 1 of the Process: ‘Communication and
7.2 Competence consultation’ includes involvement, risk information and
ownership of risk
7.3 Awareness
7.4 Communication Component 6 of the Process: ‘Recording and reporting’
7.5 Documented information includes information for decision-making and risk information
for stakeholders
8. Operation
8.1 Operational planning and control Component 4 of the Framework: ‘Implementation’
includes implementation deadlines, decision-making and
implementation responsibilities

Component 3 of the Process: ‘Risk assessment’ includes

description of the identification, analysis and evaluation stages
of risk assessment

Component 4 of the Process: ‘Risk treatment’ includes the

selection, design and implementation of risk treatment options
9. Performance evaluation
9.1 Monitoring, measurement, analysis and evaluation Component 5 of the Framework: ‘Evaluation’ includes
9.2 Internal audit measuring framework performance and continued suitability
of the framework
9.3 Management review
Component 5 of the Process: ‘Monitoring and review’
includes monitoring RM outcomes, and inclusion of risk within
performance reports
10. Improvement
10.1 Non-conformity and corrective action Component 6 of the Framework: ‘Improvement’ includes
10.2 Continual improvement value of RM, adapting the framework and integration of RM
activities

14 A Risk Practitioners Guide to ISO 31000 – 2018

9. Relevance of ISO 31000
for risk professionals
The ISO 31000 guidance is presented in narrative form as Measure
a list of principles, framework and process. There are several 7. Evaluate effectiveness of existing controls and introduce
examples in ISO 31000 of overlap between framework and improvements
process, as demonstrated by the inclusion of context as part 8. Embed risk-aware culture and align RM with other
of the designing the framework and as part of scope, context activities in the organisation
and criteria. Another example of the overlap of framework Learn
and process is that establishing communication and 9. Monitor and review risk performance indicators to
consultation is a component of the process and is discussed measure RM contribution
as part of the design component of the framework. 10. Report risk performance in line with obligations and
monitor improvement
In addition to overlap of framework and process, there
are examples of overlap of principles and framework, Although ISO 31000 covers the full scope of requirements
including the inclusion of integration as a principle and as a for a management system, it is for the organisation to
component of the framework. These overlaps demonstrate convert those requirements into a checklist and action
that risk professionals who use ISO 31000 as the basis for plan. In fact, ISO 31000 covers the ‘Control and Develop’
implementation of a risk management initiative will need components, as set out in Figure 2 in a concise and easy to
to extract the valuable information and guidance provided understand manner. The ‘Scope and Design’ components
in ISO 31000 and develop it into a coherent and logical from Annex SL are present in ISO 31000, but the structure of
implementation checklist. the guidelines on the framework require some interpretation
and conversion into a checklist or implementation plan. The
Risk professionals need to understand the full and detailed 2017 COSO framework ERM – Integrating Strategy and
requirements of a management system, as set out in Annex Performance provides an alternative approach that is also
SL. These requirements define the components required for helpful.
the successful implementation of a management initiative,
including a risk management initiative. The list below There is much useful information in ISO 31000 for risk
provides an overview of the stages involved in implementing professionals as they support their employer and/or clients
the ‘Control and Develop’ components of Annex SL. in the implementation of a risk management initiative.
The combination of principles, framework and process set
Successful implementation of a risk management initiative out in ISO 31000 provides a high-level, but comprehensive,
is an ongoing process that involves working through the view of the components that are required to implement risk
10 activities below on a continuous basis. These activities management in an organisation.
relate to the four components (1) Plan; (2) Implement; (3)
Measure; and (4) Learn. ISO 31000 is an important and well-recognised contribution
towards effective risk management, but risk professionals
Plan will need to extract the guidance and advice most relevant
1. Identify intended benefits of the RM initiative and gain to their employer or client organisations when formulating a
board support successful risk management initiative that will enhance the
2. Plan the scope of the RM initiative and develop common success of the organisation.
language of risk
3. Establish the RM strategy, framework and the roles and
responsibilities
Implement
4. Adopt suitable risk assessment tools and an agreed risk
classification system
5. Establish risk benchmarks (risk criteria) and undertake
risk assessments
6. Determine risk appetite and risk tolerance levels and
evaluate the existing controls

15 A Risk Practitioners Guide to ISO 31000 – 2018

Appendix A: Structure of ISO
management system standards
ISO defines a management system as a set of procedures an Clause 9: Performance evaluation
organisation needs to follow in order to meet its objectives. Clause 10: Improvement
A management system standard provides a model to follow
when setting up and operating a management system. Clause 1: Scope – sets out the intended outcomes of the
Some of the top-level benefits of a successful management management system. The outcomes are industry specific
system standard are (1) enhanced use of resources; (2) and should be aligned with the context of the organisation
improved risk management; and (3) increased customer (see clause 4).
satisfaction by meeting product/service expectations.
Clause 2: Normative references – provides details of the
ISO has published many management system standards for reference standards or publications relevant to the particular
topics ranging from quality and environment to information standard.
security and business continuity management. Despite
sharing common elements, ISO management system Clause 3: Terms & definitions – explains terms and
standards have sometimes had different structures. This definition applicable to the specific standard in addition to
has sometimes resulted in confusion and difficulties at the any formal related terms and definitions standard.
implementation stage.
Clause 4: Context of the organisation – with four sub-
Most organisations have more than one management clauses:
system standard. Uncoordinated systems take up extra 4.1 Understanding the organisation and its context
time and resources, so there is a clear need to find a way 4.2 Understanding the needs and expectations of
of integrating and combining the standards in the best stakeholders
possible way. Existing management system standards often 4.3 Determining the scope of the managements system
have different structures, requirements and terminology, 4.4 The management system
so integration is challenging. To address this problem, Clause 4 describes why the organisation exists. The
ISO developed Annex SL – the framework for a generic organisation needs to identify internal and external
management system and the blueprint for all new and issues that can impact on its intended outcomes, as well
revised management system standards in future. as all stakeholders and their expectations. It also needs
to document its scope and set the boundaries of the
By adopting the Annex SL format, individual management management system.
systems will produce less duplication, confusion and
misunderstandings. Management system auditors Clause 5: Leadership – with three sub-clauses:
will be able to use a core set of generic requirements 5.1 Leadership and commitment
across disciplines and industry sectors. In future, all ISO 5.2 Policy
management system standards will have the same high-level 5.3 Organisational roles, responsibilities and authorities
structure, identical core text, as well as common terms and Top management is accountable for all management
definitions. systems. They need to integrate the management system
into core business process, ensure the system achieves its
Annex SL applies to all management system standards, intended outcomes and allocate the necessary resources.
including full ISO standards. The revised ISO 9001 and ISO Top management is also responsible for communicating the
14001, as well as the new ISO 45001 will all be based on the importance of the system to heighten employee awareness
Annex SL high-level structure, as follows: and involvement.
Clause 1: Scope
Clause 2: Normative references Clause 6: Planning – with two sub-clauses:
Clause 3: Terms and definitions 6.1 Actions to address risks and opportunities
Clause 4: Context of the organisation 6.2 Management system objectives and planning to
Clause 5: Leadership achieve them
Clause 6: Planning Having identified risks and opportunities, the organisation
Clause 7: Support needs to specify how these risks will be managed. This
Clause 8: Operation

16 A Risk Practitioners Guide to ISO 31000 – 2018

proactive approach replaces preventive actions and reduces expectations should be embedded in all management
the need for corrective actions later. The objectives of the system standards.
management system should be measurable, monitored,
communicated, aligned to the policy of the system and https://www.bsigroup.com/LocalFiles/nl-nl/iso-9001/BSI-
updated when needed. Annex-SL-Whitepaper.pdf

Clause 7: Support – with five sub-clauses:

7.1 Resources
7.2 Competence
7.3 Awareness
7.4 Communication
7.5 Documented information
After addressing the context, commitment and planning,
organisations need to look at the support needed to
meet their goals and objectives. This includes resources,
targeted internal and external communications, as well as
documented information that replaces previously used terms
such as documents, documentation and records.

Clause 8: Operation – with one sub-clause:

8.1 Operational planning and control
The bulk of the management system requirements specific
to the topic under consideration are within this single clause.
Clause 8 addresses both in-house and outsourced processes,
while overall management of the process includes adequate
criteria to control these processes, as well as ways to manage
planned and unintended change.

Clause 9: Performance evaluation – with three sub-

clauses:
9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit
9.3 Management review
Decisions are required on how performance will be
monitored, measured, analysed and evaluated. Internal
audit activities are part of the process to ensure the
management system conforms to the requirements of
the organisation and is successfully implemented and
maintained. Management review, evaluates whether the
management system is suitable, adequate and effective.

Clause 10: Improvement – with two sub-clauses:

10.1 Non-conformity and corrective action
10.2 Continual improvement
Clause 10 looks at ways to address non-conformities and
corrective action, as well as strategies for improvement on a
continual basis. The requirement for continual improvement
in performance and enhanced delivery of stakeholder

17 A Risk Practitioners Guide to ISO 31000 – 2018

Appendix B: Components
of ISO 31000:2018
1. Principles 5. Evaluation, including:
The purpose of risk management is the creation and • measuring framework performance against its
protection of value. It improves performance, purpose, implementation and behaviours; and
encourages innovation and supports the achievement of • determining whether it remains suitable to support
objectives. Principles include the requirement for the risk achievement of objectives.
management initiative to be (1) customised; (2) inclusive;
(3) structured and comprehensive; (4) integrated; and (5) 6. Improvement, including:
dynamic. • continually monitoring and adapting the framework to
address external and internal changes;
• taking actions to improve the value of risk
2. Framework management; and
The purpose of the risk management framework is to assist • improving the suitability, adequacy and effectiveness
with integrating risk management into all activities and of the RM framework.
functions. The effectiveness of risk management will depend
on integration into governance and all other activities of the
organisation, including decision-making. 3. Process
The risk management process involves the systematic
1. Leadership and commitment, including: application of policies, procedures and practices
• aligning risk management with the strategy, objectives to the activities of communicating and consulting,
and culture of the organisation; establishing the context and assessing, treating,
• issuing a statement or policy that establishes a RM monitoring, reviewing, recording and reporting risk.
approach, plan or course of action;
• making necessary resources available for managing 1. Communication and consultation, including:
risk; and • bringing different areas of expertise together for each
• establishing the amount and type of risk that may or step of the RM process;
may not be taken (risk appetite). • ensuring different views are considered when defining
risk criteria and evaluating risks;
2. Integration, including: • providing sufficient information to facilitate risk
• determining management accountability and oversight and decision-making; and
oversight roles and responsibilities; and • building a sense of inclusiveness and ownership
• ensuring risk management is part of, and not separate among those affected by risk.
from, all aspects of the organisation.
2. Scope, context and criteria, including:
3. Design, including: • defining the purpose and scope of risk management
• understanding the organisation and its internal and activities;
external context; • identifying the external and internal context for the
• articulating risk management commitment and organisation;
allocating resources; and • defining risk criteria by specifying the acceptable
• establishing communication and consultation amount and type of risk; and
arrangements. • defining criteria to evaluate the significance of risk and
to support decision-making;
4. Implementation, including:
• developing an appropriate implementation plan 3. Risk assessment, including:
including deadlines; • risk identification to find, recognise and describe
• identifying where, when and how different types of risks that might help or prevent achievement of
decisions are made, and by whom; and objectives and the variety of tangible or intangible
• modifying the applicable decision-making processes consequences;
where necessary. • risk analysis of the nature and characteristics of risk,
including the level of risk, risk sources, consequences,

18 A Risk Practitioners Guide to ISO 31000 – 2018

 likelihood, events, scenarios, controls and their
effectiveness; and
• risk evaluation to support decisions by comparing the
results of the risk analysis with the established risk
criteria to determine the significance of risk.

4. Risk treatment, including:

• selecting the most appropriate risk treatment
option(s); and
• designing risk treatment plans specifying how the
treatment options will be implemented.

5. Monitoring and review, including:

• improving the quality and effectiveness of process
design, implementation and outcomes;
• monitoring the RM process and its outcomes, with
responsibilities clearly defined;
• planning, gathering and analysing information,
recording results and providing feedback; and
• incorporating the results in performance
management, measurement and reporting activities.

6. Recording and reporting, including:

• communicating risk management activities and
outcomes across the organisation;
• providing information for decision-making;
• improving risk management activities; and
• providing risk information and interacting with
stakeholders.

19 A Risk Practitioners Guide to ISO 31000 – 2018

Institute of Risk Management
2nd Floor, Sackville House,
143-149 Fenchurch Street,
London, EC3M 6BN
Tel: +44 (0)20 7709 9808
Fax: +44 (0)20 7709 0716
enquiries@theirm.org
www.theirm.org