What is ISO 31000?
ISO 31000 is the international guidance standard for risk management. It sets out principles, a framework and a process for identifying, analysing, evaluating, treating and monitoring risk. Unlike the other standards we cover, ISO 31000 is guidance, so organisations are not certified to it. Instead, it's used to build a strong, consistent approach to risk that supports certified systems such as ISO 9001, 14001, 45001 and 22301, all of which require risk-based thinking.
Who needs it?
- Organisations with separate risk registers that don't join up
- Businesses holding ISO certificates that want a stronger approach to risks and opportunities
- Directors and boards who want clearer risk reporting
- Growing businesses taking on bigger contracts and more complex projects
Business benefits
Better decisionsRisks are understood and weighed before commitments are made.
Fewer surprisesEmerging risks are spotted and managed earlier.
ConsistencyOne method and one set of criteria across the business.
Stronger auditsA risk approach that satisfies the risk requirements of your ISO standards.
How SBMS helps
- Gap analysisWe review how you currently identify and manage risk.
- DocumentationWe develop your risk management policy, criteria, risk appetite and register format.
- ImplementationWe run risk workshops with your team to populate and prioritise the register.
- Internal auditWe check the process is being followed and risks are being reviewed and acted on.
- IntegrationWe link risk management into your management systems, project reviews and board reporting.
- Ongoing maintenanceWe support periodic risk reviews and keep the framework working as you grow.
Typical timescales
Depending on scope, a working risk framework can usually be in place within a few weeks to a few months.