ISO 31000: Applying Risk Management Guidance

In PwC’s 2026 Global CEO Survey of 4,454 leaders across 95 countries and territories, 31% described high or extreme exposure to significant financial loss from cyber threats in the year ahead. This measures perceived exposure, not the frequency of incidents or the effectiveness of ISO 31000. Source

ISO 31000:2018 is the published guidance standard listed by ISO at the time of this review. It brings together principles, a framework and a process for risk management. It can be adapted to different organisations and decisions rather than prescribing one universal risk register.

ISO 31000 is not a certifiable management-system requirements standard. A training certificate held by an individual is different from certification of an organisation against a requirements standard. When discussing support, specify whether you need guidance implementation, capability development or a separate certification project, and avoid describing these as the same thing.

A risk statement is useful when it connects uncertainty to something the organisation is trying to achieve. “Supplier risk” is a label, not a complete decision problem. A clearer statement explains the uncertain event or condition and the possible effect on a delivery commitment, service level or other objective.

Choose a defined scope before collecting risks. A project, procurement decision or service process may provide a manageable starting point. Identify the relevant time horizon, stakeholders and assumptions. Without this context, a long risk list can mix unrelated issues and make prioritisation difficult.

Agree how consequences and likelihood will be described and how the results will inform decisions. Consequences may involve service, safety, financial, legal or reputational objectives, depending on the scope. Define the categories in language that people can apply consistently and obtain specialist input where the subject requires it.

A colour-coded matrix can support discussion, but it does not create precise measurements. Multiplying ordinal scores should not be treated as a scientific estimate of expected loss. Keep the reasoning, evidence and uncertainty visible, especially when a low-frequency event could have serious consequences.

The register is a working record, not the whole risk-management system. A completed spreadsheet has limited value if decisions, budgets and responsibilities remain unchanged. Keep the level of detail proportionate to the decision and the people who need to use it.

Distinguish a planned control from one that is implemented, and an implemented control from one that has been checked. For example, a backup arrangement recorded in a contract may still depend on unavailable capacity. Ask what evidence demonstrates that the control would work when needed.

Controls can introduce costs, delays or new dependencies. Examine these effects rather than assuming that more controls always produce a better result. Where a control is critical, define how its performance will be monitored and who acts when it fails or becomes unreliable.

Possible responses include changing the activity, reducing the likelihood or consequences, sharing part of the exposure, or retaining the risk through an informed decision. The appropriate response depends on the context and applicable obligations. Insurance or outsourcing does not automatically transfer every responsibility or consequence.

Record the action, owner, resources and target date. Explain the remaining exposure after the action and who is authorised to accept it. Avoid closing a risk simply because an action was assigned. Completion and effectiveness need to be checked against the intended outcome.

Keep the current assessment separate from the expected assessment after planned treatment. A lower future rating is a forecast until the action is implemented and evidence supports its effectiveness. The risk owner remains accountable for monitoring the exposure even when another person carries out the action. If the remaining exposure exceeds the agreed criteria or the owner’s authority, escalate the decision rather than marking it accepted.

Imagine a fictional organisation that relies on one supplier for a component needed to meet customer commitments. The team identifies uncertain delivery times and examines stock records, alternative suppliers and the actual lead time for qualification. A second supplier on a list is not a usable alternative until the relevant conditions are understood.

Suppose usable stock covers 10 working days at the assumed demand rate, while qualifying an alternative and receiving its first usable delivery would take 20 working days from today. If the main supply stopped today and no other deliveries were available, the illustrative gap would be 10 working days. This is a time-coverage scenario, not a probability estimate or a forecast of a certain loss. Demand changes, quality rejection and transport delays could change the gap.

The procurement owner should therefore confirm the alternative’s capacity and qualification evidence, while the authorised manager decides on an interim response such as additional stock, revised commitments or another verified supply route. Record the cost, owner and deadline, and set a review trigger when stock coverage falls below the time needed to activate the alternative. A trial delivery must meet the agreed acceptance criteria before the alternative is treated as effective. These are illustrative choices, not prescribed ISO controls or an ATMACSS client result.

Review risks when conditions change, not only when a calendar reminder arrives. A new contract, system change, incident or shift in demand may alter the assessment. Use incidents and near misses to examine assumptions and controls, while avoiding blame that discourages useful reporting.

Leadership needs a view of significant exposures and unresolved decisions, while operational owners need specific actions. Establish escalation arrangements and make clear which decisions require higher authority. Communication should explain uncertainty honestly rather than converting every assessment into a falsely precise score.

Software can support this routine by keeping a shared risk register, recording owners and deadlines, and alerting teams to overdue actions. Select access controls and a change history that make responsibility traceable. Check how the tool calculates scores and handles missing data. A dashboard cannot establish whether a control works, and an automated score cannot replace evidence, professional judgement or the authorised owner’s decision. These are practical tool-selection considerations, not a software requirement imposed by ISO 31000.

Bring a defined objective, current risk records and examples of difficult decisions to a discussion about Risk Management with ATMACSS. The SWOT guide can help frame strategic conditions, while a risk assessment examines particular uncertainties and responses in more detail. Start with a useful decision and build a repeatable routine around it.