Current Edition Checked October 24, 2026
It is guidance, not a certifiable standard.
What It Covers
Principles, a framework and a process for managing risk of any kind, at any level of an organization.
Who It Applies To
Any organization, as the common reference for enterprise risk management.
Key Requirements
- Eight principles, led by integration into everything the organization does.
- A framework of leadership, integration, design, implementation, evaluation, and improvement.
- A process: scope and criteria, assessment (identify, analyze, evaluate), treatment, monitoring, recording, and reporting.
What an Auditor Asks to See
- The risk criteria, and how a recent decision used them.
Where Systems Fall Short
- A risk register maintained by one function and read by no other.
How QES Helps
Through QES’s risk and cybersecurity partner: enterprise risk management that the quality system can draw on.
Related Standards
Sources. ISO — ISO 31000:2018 (opens in a new tab). Status checked October 24, 2026. This page summarizes ISO 31000:2018; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.