ISO 31000:2018 gives the principles, framework and process for managing any type of risk, and IEC 31010:2019 describes the techniques you can use for the risk assessment step of that process. Both are guidance documents, so neither leads to certification, and ISO 31000:2018 remains the current edition while a third edition is drafted.
This guide is for risk managers, compliance and quality leads, and internal auditors who have to set up or check a risk process.
What is the current edition of each standard?
ISO 31000:2018, Risk management, Guidelines, is the second edition. It was published in February 2018 by ISO/TC 262 and replaced the 2009 first edition. ISO last reviewed and confirmed it in 2023, according to its ISO 31000:2018 page.
That page now also marks the standard as "to be revised". A third edition is under development as ISO/CD 31000. Its committee draft consultation closed on 1 March 2026.
Until a new edition is published, the 2018 text is the one to work from. Treat anything you read about the new edition as a draft.
IEC 31010:2019, Risk management, Risk assessment techniques, is edition 2.0, published on 13 June 2019. It is a joint IEC and ISO publication prepared by IEC technical committee 56. The IEC webstore entry gives a stability date of 2027, the year until which IEC expects the content to stay unchanged. It replaced the 2009 first edition.
One older reference has gone. ISO Guide 73:2009, the risk vocabulary that many documents still cite, is withdrawn. Risk terms are now published in ISO 31073:2022, Risk management, Vocabulary.
How do ISO 31000 and IEC 31010 fit together?
ISO 31000 is short. It runs to 16 pages and tells you what a sound risk process looks like. IEC 31010 runs to 264 pages and tells you how to carry out the assessment part of that process. Its 2019 edition dropped the ISO 31000 concepts that the first edition repeated, so the two are meant to be read side by side.
ISO 31000 has three parts. Clause 4 sets out the principles.
Clause 5 covers the framework: leadership and commitment, integration into the organisation, design, implementation, evaluation and improvement. Clause 6 is the process you run on each risk topic. Its steps are communication and consultation (6.2), scope, context and criteria (6.3), risk assessment (6.4), risk treatment (6.5), monitoring and review (6.6) and recording and reporting (6.7).
Risk assessment in 6.4 has three parts: identification, analysis and evaluation. This is where IEC 31010 comes in.
Its clause 6 explains how to plan an assessment, gather information and review the results. Its clause 7 explains how to choose a technique. Annex B then describes each technique in turn.
Which IEC 31010 technique should you use, and when?
IEC 31010:2019 describes 42 techniques in Annex B, arranged in ten groups by what they help you do. The groups run from eliciting expert views (B.1) to recording and reporting (B.10). Annex A sets out how to compare techniques and which steps of the ISO 31000 process each one suits.
The table maps the ISO 31000 steps to a few techniques from Annex B and the record each step normally leaves behind. The record column is AGS's practical interpretation, not text from either standard.
| ISO 31000:2018 step | Examples of IEC 31010:2019 techniques | Record a reviewer expects to see |
|---|---|---|
| Scope, context and criteria (6.3) | Structured or semi-structured interviews (B.1.5), surveys (B.1.6) | Context analysis, approved risk criteria and scoring scales |
| Risk identification (6.4.2) | Brainstorming (B.1.2), checklists and taxonomies (B.2.2), HAZOP (B.2.4), SWIFT (B.2.6) | Workshop notes and new entries in the risk register |
| Risk analysis (6.4.3) | Bow tie analysis (B.4.2), fault tree analysis (B.5.7), business impact analysis (B.5.4), Monte Carlo simulation (B.5.10) | Analysis worksheets showing causes, controls, consequence and likelihood |
| Risk evaluation (6.4.4) | ALARP (B.8.2), risk indices (B.8.6), consequence and likelihood matrix (B.10.3) | Risk ratings compared with the criteria, with a decision on each risk |
| Risk treatment (6.5) | Cost/benefit analysis (B.9.2), multi-criteria analysis (B.9.5) | Treatment plan with owners, actions, dates and expected residual risk |
| Recording and reporting (6.7) | Risk registers (B.10.2), S-curves (B.10.4) | Current register and reports to management |
Choose by situation, not habit. A process plant may use HAZOP or layers of protection analysis (B.4.4). A food business already runs HACCP, which IEC 31010 lists as a control analysis technique (B.4.3).
A continuity team needs a business impact analysis. A privacy team needs a privacy or data protection impact analysis (B.5.11). A treasury team may use value at risk (B.7.2). A single 5 by 5 matrix used for all of these hides the differences that matter.
Can you get certified to ISO 31000?
No. ISO states that ISO 31000 provides guidelines, not requirements, and is not intended for certification. IEC 31010 is guidance too.
The standards still matter in audits. Certifiable standards ask you to manage risk inside their own scope. ISO describes ISO/IEC 27001 as applying a risk management process to information security, and our ISO/IEC 27001:2022 guide covers that requirement. Many organisations use ISO 31000 as the single method behind several of these systems, so one set of criteria and one register serve them all.
What will an auditor or board ask to see?
Without a certificate, your risk process is tested by internal audit, by the certification audits of your other management systems, and by your board or regulator. In each case the reviewer checks whether the documents match what people actually do. Typical questions are below. They are AGS's practical list, not text from the standard.
- Are the risk criteria written down and approved by top management, and do the scores in the register use them?
- Does each significant risk have a named owner, a treatment decision and a review date?
- Can the team show why a technique was chosen for a given assessment, and who took part?
- Do treatment actions have due dates, and were overdue ones escalated?
- Is the framework itself evaluated from time to time (clause 5.6), for example at management review?
If your organisation also runs business continuity, link the risk register to the business impact analysis rather than keeping two lists. Our ISO 22301 business continuity guide explains where the two meet.
How do you start an ISO 31000 framework?
Start with clause 5, not with the register. Agree who owns risk management, write a short policy stating the commitment, and set the risk criteria before anyone scores a risk. Criteria set after scoring tend to fit the scores already given.
Then run the clause 6 process on one area, such as a key project or a high-exposure site. Pick two or three techniques suited to that area from IEC 31010. Record the results, report them, and review after one cycle.
Extend the process to other areas once the first cycle works. Clause 5.7 expects the framework itself to be adapted and improved over time.
How AGS can help
The ISO 31000-2018 · IEC 31010 Risk Management System kit contains 29 editable Microsoft Word documents. It includes a risk management manual, a system scheme and 10 procedures, six named after the clause 6 steps. Its 9 forms and records include a risk register, assessment worksheet and treatment plan. It also has 4 checklists, a risk assessment techniques guide, a risk criteria and scoring guide, and 2 training documents.
Related kits are in Information Security, Risk and Business Continuity.
Frequently asked questions
Is ISO 31000:2018 still valid?
Yes. ISO confirmed it in 2023 and lists it as the current version. A third edition is in development but had not been published when this guide was reviewed.
Is IEC 31010 the same as ISO/IEC 31010?
It is one document. IEC 31010:2019 is a joint IEC and ISO publication, so you will see both names in references.
Do I need IEC 31010 to apply ISO 31000?
No. ISO 31000 does not require any particular technique. IEC 31010 helps you choose and apply techniques that suit your situation.
Does buying documentation make a risk process compliant?
No. Templates are a starting point. What counts is how the process is run, recorded and reviewed in your organisation.
This guide and the referenced kit are not affiliated with, endorsed by or approved by ISO or IEC.
Reviewed October 2026. Facts checked against the sources current at publication.
