ISO 31000:2018
Implementing the ISO 31000 Risk-Management Framework
ISO 31000 provides principles and guidance for managing risk in any organisation and sector. It's not a certifiable standard, but it's the foundation of every risk assessment other standards require.
What is ISO 31000:2018?
Every modern management system — from quality to information security — requires risk-based thinking. ISO 31000 ensures this isn't just formal tables for an auditor, but a genuine decision-making tool: which risks to accept, which to reduce, which to transfer, and which to avoid.
We implement a framework tailored to your organisation: a unified methodology, a risk register, clear owners and regular review — usable for business, project, financial and operational risks.
Implementation phases
The real phases we guide every ISO 31000 project through — from preparation to application you can demonstrate:
Monitoring and Review
The process follows the structure of the standard: Not sure whether you already meet these requirements? Check with the short self-assessment at the bottom of this page.
Framework and risk criteria
We define the methodology: likelihood and consequence scales, risk appetite, roles and responsibilities.
Risk identification
Through workshops and process analysis, we catalogue risks and opportunities across business areas.
Analysis and evaluation
We assess risks, rank them and compare them against acceptance criteria.
Risk treatment
For unacceptable risks we define measures, owners and deadlines; a risk register is formed.
Monitoring and review
Risks are tracked through indicators and periodically reviewed — the framework stays alive, not filed away.
The path to certification
ISO 31000 is not certified, but its application strengthens every other certification:
The prerequisite for everything: the system is implemented and applied in practice — every requirement of the standard met, the internal audit carried out and the management review completed.
One risk methodology serves ISO 9001, 14001, 45001, 27001, 22301 and others.
We periodically check how the framework functions and the maturity of risk management.
Risk-management workshops for management and process owners.
Risks become part of planning, investment decisions and management review.
Benefits of Adopting the Standard
Risks and opportunities are seen before they become problems or missed chances.
No parallel risk tables for each system — less work, more sense.
Systematic risk treatment reduces surprises and losses.
Mature risk management is a signal of seriousness in due-diligence processes.
An illustrative, typical scenario we often hear from clients — it does not represent a specific, named client.
“We did deal with risks, but informally — everyone carried their own share of the worry in their head. ISO 31000 forced us to build a risk register with clear owners and to define how much risk we are willing to accept at all — for the first time risk decisions are made by a team rather than by one person's instinct.”
— a common scenario among our clients
Related standards
Risk assessment is a mandatory part of ISO 9001, ISO 27001 (alongside ISO 27005 for information risk), ISO 45001 and ISO 22301 — ISO 31000 gives them a shared language and methodology.
ISO 31000 training — from a basic understanding of the standard to internal auditor training. Delivered at your premises, online or as a combination of both.
FAQ about ISO 31000:2018
Is ISO 31000 certified?
No — it's a standard made up of guidelines. Its value lies in better-quality risk assessments within certifiable standards and better decision-making.
What's the connection to ISO 27005?
ISO 27005 applies ISO 31000 principles specifically to information-security risk within ISO 27001.
How long does setting up the framework take?
Usually 1 to 2 months, including risk-identification workshops and the risk register. For large systems — over 500 employees, multiple locations or an integrated system of several standards — a project realistically runs beyond a year; we handle those clients too.
Who is ISO 31000 for?
Any organisation that wants a systematic approach to risk — especially useful for management and process owners.
How much does ISO 31000 implementation cost?
There is no fixed price that applies to everyone — the cost depends on the organisation's field of activity, its size and number of employees, the chosen standard and the current state of the system. Send us a short description of your organisation and we will prepare a free, tailored estimate.
Standards that fit together like a honeycomb
Each standard keeps its own shape, but together they form a single solid, integrated management system (IMS) — with no gaps or overlaps. Click a hexagon to open that standard.
More about the integrated management system
An integrated management system (IMS) combines two or more ISO standards — for example ISO 31000 with ISO 9001 or ISO 14001 — into one shared framework of documentation, objectives and internal reviews, instead of each standard living in its own parallel procedure.
A single structure (the High-Level Structure — HLS) shared by every modern ISO standard. Thanks to it, the quality policy, risk management, internal audits and management review can be common to several standards at once.
Each standard on its own addresses one part of the business — quality, environment, safety, information. When an organisation introduces several of them, separate systems quickly duplicate the same documentation and the same auditors.
Less duplicated procedure work, simpler management, stronger process oversight, more efficient use of resources and easier preparation for a combined certification audit.
ISO 31000 can be implemented on its own or as part of an integrated system — the decision depends on how many standards you're targeting and whether you're introducing them at once or gradually.
Check your organization's readiness
Answer a few questions and receive an indicative assessment of your organization's current level of readiness for ISO 31000.
This self-assessment provides an indicative readiness result only. It does not constitute certification, an official audit, or formal confirmation of compliance.
The EU, the US and other markets
ISO 31000 is the same standard wherever you certify it — what differs is the designation, the accreditation behind the certificate and what your customers ask for.
In the European Union the standard is adopted with an EN prefix, and what your buyer in the Netherlands, Germany or France looks at is not the prefix but the accreditation behind the certificate: a body accredited by a signatory of the international recognition arrangement (Global Accreditation Cooperation, formerly IAF) is recognised in other markets too. What EU partners and EU regulation expect is on the page about the EU market.
For companies with customers in the United States — supplier audits, security questionnaires and how ISO sits alongside SOC 2 — see the page about the US market.
Wherever your customer is, we run the project remotely in English — over Teams, WhatsApp or Viber, with documentation and records in English — and on site when that is easier.
Montenegro and the region: MEST ISO 31000:2018
When someone asks for a MEST ISO 31000 certificate (or an “ISO 31000:2018 certificate”), they are asking for something that does not exist — useful to know before you bid on a tender. ISO 31000 is written as guidance: it contains no requirements (“the organisation shall…”), so there is nothing an auditor could mark as met or not met. That is why no accredited certification body issues an organisation a certificate against this standard.
Why do the designations differ if the standard is the same?
Every country in the European and international standardisation system adopts the same standard into its own national catalogue and adds a national prefix — in Montenegro that is MEST. The content, structure and clauses stay completely identical no matter which designation is printed on the document. “ISO 31000” and “MEST ISO 31000” are therefore one and the same document under two names.
What does pass on a tender instead: a certificate of a standard that is certifiable and whose risk assessment follows ISO 31000 — ISO 9001, ISO 27001, ISO 22301 and ISO 37301. Alongside it goes proof that the framework really works: a risk register that is kept up to date, evaluation criteria, records of management reviews. If the buyer explicitly asks for “ISO 31000”, the bid states that the risk management methodology is aligned with it, together with the certificate of the system that uses it.
Private schemes also issue certificates of completed training and examination — evidence of a participant’s knowledge, not of the organisation’s system. That is proof of a person’s knowledge, not of an organisation’s system, and it does not replace a company certificate.
Montenegro is where we work from: our consultants are based in Podgorica, Budva and Bijelo Polje, documentation and training come in Montenegrin or in English, and the certificate itself is issued by an independent accredited certification body — not by us. We work on site in Serbia, Bosnia and Herzegovina, Croatia, North Macedonia, Albania and Kosovo as well — more about what we do in Montenegro.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Request a free consultation
We will assess the scope of work and propose a realistic plan and budget for your organisation. Call us or send an inquiry — we reply within 24 hours.