Risk Management — Guidelines
Provides principles, a framework and a process for managing risk of any kind at any level of an organisation. It is guidance rather than a certifiable requirements standard, and it is the enterprise-level counterpart to the product-and-patient scope of ICH Q9(R1).
What this does not cover
stated in the document's own scope- It is guidance and cannot be used for certification; there is no "ISO 31000 certified" organisation.
- It is not specific to any industry or risk type, and it does not set risk criteria or acceptable levels of risk; the organisation defines those.
- It does not replace ICH Q9(R1) for quality risk management in GMP, nor the risk-management requirements written into sector standards such as ISO 14971 for medical devices.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
ISO 31000 provides principles, a framework and a process for managing risk of any kind. It describes how an organisation identifies, analyses, evaluates, treats, monitors and communicates risks, and how risk management is embedded in its governance and decision-making rather than run as a separate exercise. It can be used by any organisation regardless of its size, activity or sector, and for any type of risk — strategic, operational, financial or otherwise. It is written as guidelines, not requirements, and that is a deliberate difference from the management-system standards that sit alongside it.
Scope & applicability
All risk an organisation faces — strategic, financial, operational, reputational — and how risk management is integrated into governance and decision-making. It does not replace quality risk management: ICH Q9(R1) governs risk to product quality and patient safety with a defined regulatory expectation behind it, while ISO 31000 gives the frame in which that sits alongside every other risk the organisation carries.
Legal basis & how it acquires force
It is a voluntary International Standard developed by ISO/TC 262 (risk management). The current text is the second edition, ISO 31000:2018, published in February 2018. ISO confirmed it at systematic review in 2023; a further review opened in 2024 has since moved it to "to be revised", and a committee draft of a new edition is under development. ISO states that ISO 31000 cannot be used for certification purposes, although it can provide guidance for internal or external audit programmes. It has no legal force; regulators and organisations adopt it by reference.
Document structure
| Part | Covers |
|---|---|
| Scope, normative references and terms | The applicability of the guidelines to any organisation and any risk, and the defined vocabulary |
| Principles | The characteristics of effective risk management that underpin the framework and the process |
| Framework | The arrangements that integrate risk management into the organisation’s governance, structures and activities, and how they are designed, implemented, evaluated and improved |
| Process | Establishing scope and context, then identifying, analysing and evaluating risk, treating it, and monitoring, reviewing, communicating and recording the results |
Key requirements
- Principles — risk management as integrated, structured, customised, inclusive, dynamic and based on best available information
- Framework — leadership commitment, integration into organisational structure, design, implementation, evaluation and improvement
- Process — scope and context, risk assessment (identification, analysis, evaluation), treatment, monitoring, recording and reporting
- Explicit treatment of risk appetite and of the criteria by which risk significance is judged
- Second edition (2018) replaced ISO 31000:2009; confirmed by ISO review in 2023, with a revision at committee draft stage
Implementation tips
- Do not merge it with quality risk management: the two have different scopes and different consequences for being wrong, and a merged register in practice means the weaker treatment wins on both
- The clause practitioners most often skip is recording and reporting — a risk accepted without a record of who accepted it, on what basis and until when, is an acceptance nobody can review
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
ISO 31000 is the general risk-management reference that domain standards draw on. ISO 22301 and ISO/IEC 27001 each require a risk assessment within their own management systems, and ISO 31000 provides the generic principles and process that those assessments can follow. In the pharmaceutical sector, ICH Q9(R1) governs quality risk management — risk to product quality and, through it, to patients — and is the instrument regulators expect; ISO 31000 frames the wider enterprise risk within which quality risk sits.
ISO 31000:2018: frequently asked questions
Quick answers to common questions about ISO 31000:2018.
Can an organisation be certified to ISO 31000?
No. ISO states that ISO 31000 cannot be used for certification purposes. It provides principles and guidelines, and can inform internal or external audit programmes.
What are the three components of ISO 31000?
Principles, a framework and a process. The principles describe effective risk management, the framework integrates it into governance and decision-making, and the process covers context, assessment (identification, analysis, evaluation), treatment, monitoring, communication and recording.
Is ISO 31000:2018 still current?
Yes, ISO 31000:2018 is the current edition. ISO confirmed it in 2023, and a subsequent review has led to a decision to revise it, with a committee draft of the next edition under development.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.