Back to ISO
Standard · 2018
ISO 31000
Risk management. It is not a certifiable standard. The record is a maturity self-assessment, not an audit.
Record
The maturity assessment
The standard
ISO 31000:2018
Where it is used
Beside the certifiable standards
What it does
- Rendered as maturity, not as a certificate.
- Principles, framework, and process are assessed against the work you actually do.
- It does not add a badge the standard does not offer.
On the record
- The result is a maturity view. It is kept out of the certification readiness score.
- Gaps still get an owner when you choose to act on them.
- It sits beside the standards you are certified to. It does not pretend to be one of them.
The standard
ISO 31000:2018
Risk management guidelines. Not a certifiable management system standard.
Also in Standard
All- ISO 45001Occupational health and safety. Worker consultation, the hierarchy of controls, and incidents as nonconformities.
- ISO/IEC 27001Information security. 93 Annex A controls in four themes. A Statement of Applicability is required.
- ISO 9001Quality. The operational records sit with the process. A later edition can be added as an update.
- ISO 14001Environment. Published April 2026. New planning clauses, and the management review split. Transition runs to May 2029.
- ISO 50001Energy. The energy review, significant energy uses, the energy performance indicators, the baseline, and the data collection plan.
- ISO 39001Road traffic safety. The numbering does not follow the usual Annex SL pattern. Crash investigation, internal audit, and management review are included.
- ISO 22301Business continuity. The business impact analysis and the risk assessment, the strategies, the plans, and the exercise programme.
- ISO/IEC 42001AI management. 38 controls in nine groups. A Statement of Applicability, and an AI system impact assessment.