Our summary
ISO 31000 is the international standard that gives principles and guidelines for managing any type of risk, in any organization and sector. The current edition was published in February 2018 by ISO/TC 262 (Risk management). ISO says it was last reviewed and confirmed in 2023, and the ISO page now shows it as “to be revised”, so a new edition is being prepared.
The standard is built on three parts: principles, a framework (how risk management is built into governance, strategy and decision-making), and a process (identify, analyse, evaluate, treat, monitor and communicate risk). It is a guidance standard, not a certifiable one. It is a paid document: the full text (16 pages) must be bought from ISO or a national standards body. This entry only describes the public ISO page and does not reproduce the standard.
How auditors use it: Use ISO 31000 as a benchmark when you assess the maturity of enterprise risk management, especially in organizations that follow ISO rather than COSO. ISO itself notes it can support internal and external audit programmes. Check that risk criteria are defined, the process is applied consistently, and risk reporting reaches the board. Watch for the revised edition.