ISO 31000:2018 — Risk Management
Certification of an organisation's risk management approach against assessment criteria drawn from ISO 31000:2018 Risk management — Guidelines. ISO 31000 is a guidance document, not a management-system requirements standard, so the certificate is a certificate of conformity. Issued By CAS under its own authority, outside the EGAC accredited scope, with no EGAC or IAF mark.
Standard
ISO 31000:2018
Service type
By CAS
Issued under
CAS — own authority
What it is
ISO 31000:2018 gives guidelines for managing the risks that organisations face. It sets out the principles of effective risk management (Clause 4): integrated; structured and comprehensive; customized; inclusive; dynamic; best available information; human and cultural factors; and continual improvement. It describes a framework for integrating risk management into the organisation's governance and activities — leadership and commitment, integration, design, implementation, evaluation and improvement (Clause 5) — and a risk management process of communication and consultation; scope, context and criteria; risk assessment; risk treatment; monitoring and review; and recording and reporting (Clause 6). Its approach covers any type of risk, is not tied to a particular industry or sector, and can be applied to any activity throughout the life of an organisation. This second edition, published in 2018, replaces ISO 31000:2009.
Who needs it
Companies, public bodies and non-profit organisations of any size that manage risk along the lines of ISO 31000 and want independent evidence of how they do it — for example for their board, lenders, insurers or customers, or alongside management-system certifications such as ISO 9001, ISO 22301 or ISO 37301.
Audit process
ISO 31000 is a guidance document: it recommends rather than requires, and ISO states that it cannot be used for certification purposes. CAS therefore does not certify a management system against it. CAS audits the organisation's risk management framework and process, within the scope stated on the certificate, against assessment criteria drawn from the document's principles (Clause 4), framework (Clause 5) and process (Clause 6). Certification follows a two-stage initial audit (Stage 1 and Stage 2) under ISO/IEC 17021-1:2015, with annual surveillance audits and recertification every three years. The certificate is a Certificate of Conformity issued By CAS, outside CAS's EGAC accreditation, and can be verified on CAS CertSearch.
Frequently asked questions
Common questions
Is ISO 31000 certification by CAS accredited?
No. CAS issues ISO 31000 certificates By CAS, under its own authority and outside its EGAC accreditation, which covers ISO 9001, 14001, 45001, 22000, 50001 and 22301 only. The certificate carries the CAS mark, not the EGAC or IAF marks, and can be verified on CAS CertSearch.
ISO 31000 gives guidelines, not requirements. What does the certificate attest?
That CAS audited the organisation's risk management approach, within the scope stated on the certificate, against assessment criteria taken from the document's principles, framework and process, and found it conforming. It is not a management-system certification, it does not turn the guidelines into requirements, and it does not say that any particular risk has been removed or will not occur.
How does ISO 31000 relate to ISO 9001 or ISO 22301?
ISO 9001 and ISO 22301 are management-system requirements standards: each requires an organisation to determine its risks and opportunities and to plan actions to address them. ISO 31000 is not a management-system standard; it gives general guidelines on managing risk, which can support that work. Certification to ISO 9001 or ISO 22301 is separate, and the audits can be held together.
Ready to certify against ISO 31000:2018?
Tell us about your organisation and scope — we’ll come back with a costed proposal, usually within two business days. No obligation.