What ISO 31000 is and why organisations use it
ISO 31000 is the international standard that provides guidance on managing risk. Crucially, it is a guidance document, not a certifiable management system — there is no ISO 31000 certificate, and any organisation claiming to be “certified to ISO 31000” has misunderstood it. What ISO 31000 offers instead is a recognised set of principles, a framework and a process for managing risk consistently across an organisation.
That consistency is valuable in its own right. Boards and leadership teams use ISO 31000 to put a common language and method around risk, rather than managing it differently in every department. It also underpins the risk thinking required by certifiable standards: when you implement ISO 27001 for information security or ISO 22301 for business continuity, a sound risk methodology is exactly what the auditor expects to see — and ISO 31000 is the most widely adopted source for it. ABS supports ISO 31000 as advisory and implementation work within the broader ISO Certifications portfolio.
What an ISO 31000 engagement covers
Because ISO 31000 is not certifiable, an ABS engagement is advisory and assessment-based rather than a certification audit. It typically covers:
- The framework — leadership and commitment, and how risk management is integrated into governance and decision-making
- The risk management process — identifying, analysing, evaluating, treating, monitoring and reviewing risk
- The principles — ensuring the approach is structured, tailored, inclusive and continually improved
The output is an honest gap assessment against the standard’s principles and a practical roadmap to strengthen your risk management — not a certificate. Where you want certifiable assurance, we can scope the risk-driven management systems that provide it.
Typical timeline
An ISO 31000 advisory and assessment engagement typically runs 8–12 weeks, depending on the size of your organisation and how developed your risk management already is. Implementation of the recommendations then continues on a timeline you control. As with every engagement, we start with a fixed-price scoping call and send a proposal within 24 hours.
Common questions
Can you get certified to ISO 31000?
No. ISO 31000 is a guidance document, not a certifiable management system standard, so there is no ISO 31000 certificate. ABS provides implementation guidance and an audit-style assessment of your risk management against the standard’s principles. If you need a certifiable system, risk management is embedded in standards like ISO 27001 and ISO 22301.
How does ISO 31000 relate to ISO 27001 and ISO 22301?
Certifiable standards such as ISO 27001 and ISO 22301 require a sound approach to risk. ISO 31000 provides the recognised principles and methodology many organisations adopt to meet that requirement consistently, which is why the three are often used together.
Who is ISO 31000 for?
Any organisation that wants a consistent, board-level approach to identifying and managing risk across the whole business — not just in one function. It is widely used as the foundation for enterprise risk management programmes.
