Your cart is empty.
Keep shopping
Teach on Udemy
Turn what you know into an opportunity and reach millions around the world.
Learn MoreISO 31000:2018 Risk Management Guidelines
ISO 31000:2018 Risk Management Guidelines
Master the principles, framework, and process of ISO 31000:2018 for enterprise risk management excellence
Role Play
Created byISO Horizon
Last updated 6/2026
English
What you'll learn
- Navigate the full structure of ISO 31000:2018 including its principles, framework, and process clauses
- Apply the eight risk management principles to real organizational decisions and governance
- Design and implement a risk management framework with strong leadership and integration
- Define risk criteria, risk appetite, and risk tolerance that reflect strategy and stakeholder expectations
- Run rigorous risk identification, analysis, and evaluation using qualitative and quantitative methods
- Use risk matrices, heat maps, bow-tie analysis, and risk registers with confidence and consistency
- Select and document treatment options using avoid, modify, share, and retain strategies
- Design key risk indicators, monitoring routines, and risk reports that drive better decisions
- Connect ISO 31000 with ISO 27005, ISO 22301, and COSO ERM in an integrated risk architecture
- Position ISO 31000:2018 inside a mature enterprise risk management capability that creates and protects value
Explore related topics
Course content
26 sections • 31 lectures
- What Is ISO 31000:2018 and Why It Matters8:04Explore ISO 31000:2018 Risk Management — Guidelines as the international reference document for designing, implementing, and improving risk management in any organization. Learn that ISO 31000 is a guidance standard, not a certifiable management system, meaning organizations adopt it to mature their risk practices rather than to achieve a certificate. Understand the structure of the document, which centers on three pillars — principles in Clause 4, framework in Clause 5, and process in Clause 6 — and how these pillars connect strategy to day-to-day decision making. Discover why boards, regulators, internal auditors, and senior management increasingly expect alignment with ISO 31000 across financial services, healthcare, energy, government, and technology sectors, and how the standard supports better decision making, stronger governance, and resilience in volatile environments.
- The Evolution from ISO 31000:2009 to the 2018 Revision11:50Trace the development of ISO 31000 from its 2009 origin to the 2018 revision, learning how the discipline of risk management has shifted from a control-and-compliance activity to a value-creation discipline. Understand the key changes introduced in 2018, including a tighter focus on leadership, deeper integration with governance, a clearer set of principles, simpler language, and a more iterative process model. Examine how the 2018 revision reframes risk as the effect of uncertainty on objectives, encompassing both opportunities and threats. Learn how this evolution aligns ISO 31000 with the broader ISO management system structure and with the modern expectation that risk management should support strategy, resilience, and stakeholder trust rather than merely document hazards.
- Essential Terms and Definitions in Risk Management7:12Master the core vocabulary defined in ISO Guide 73 and referenced throughout ISO 31000:2018, including risk, risk source, event, consequence, likelihood, risk owner, residual risk, inherent risk, risk criteria, risk appetite, and risk tolerance. Understand precisely how the standard distinguishes between risk identification, risk analysis, and risk evaluation as three discrete activities within risk assessment. Learn how terminology consistency enables clear communication across departments, with auditors, and across borders. Examine how concepts like uncertainty, vulnerability, and consequence interact to define a risk scenario, and why disciplined use of language is the first sign of a mature risk culture inside any organization.
- ISO 31000 in Context — ISO 27005, ISO 22301, and COSO ERM11:13Compare ISO 31000:2018 with three closely related frameworks that risk managers encounter daily. Learn how ISO 27005 applies ISO 31000 principles specifically to information security risk, providing techniques for identifying threats to confidentiality, integrity, and availability. Understand how ISO 22301 addresses business continuity by treating disruption as a risk to organizational objectives, drawing on ISO 31000 for its risk assessment foundation. Examine how COSO Enterprise Risk Management — Integrating with Strategy and Performance complements ISO 31000 by emphasizing the link between risk and strategic decision-making in publicly traded environments. Discover how organizations integrate these frameworks rather than choose between them, creating a layered risk architecture that satisfies regulators, boards, and external auditors.
- Section 1 Quiz: Foundations of ISO 31000:2018
- Roleplay: Foundations of ISO 31000:2018
- Integrated Risk Management Across the Organization10:14Explore the principle of integration, which sits at the center of Clause 4 of ISO 31000:2018 and shapes every other principle around it. Learn why risk management must be embedded in governance, strategy, planning, performance management, reporting, values, and culture rather than treated as a separate compliance function bolted on by a small team. Understand how integration changes the role of the risk manager from gatekeeper to enabler and why isolated risk activities create blind spots that lead to surprise losses. Examine concrete examples of integration, such as building risk discussions into strategic planning cycles, capital allocation decisions, project gates, and executive performance scorecards, and the cultural shifts that make this integration sustainable.
- Structured, Comprehensive, and Customized Approaches8:56Unpack three closely linked principles from Clause 4 of ISO 31000:2018 — structured and comprehensive, customized, and inclusive — that together define how risk management should be designed for a specific organization. Understand why a structured approach yields consistent and comparable results across business units, while customization ensures the framework fits the organization's external context, internal context, risk profile, and objectives. Learn why one-size-fits-all risk frameworks fail in practice and how organizations tailor risk taxonomies, risk criteria, and methods to industry, regulatory environment, size, and culture. Examine how inclusivity — engaging stakeholders early and using their knowledge and views — strengthens both the quality of risk assessments and the legitimacy of treatment decisions.
- Dynamic Risk Management and Best Available Information7:24Examine two principles from ISO 31000:2018 Clause 4 that address how risk management must adapt to constant change. Learn why risk management has to be dynamic, anticipating, detecting, acknowledging, and responding to changes in context, objectives, and emerging risks rather than treating the annual risk register as a static document. Understand the principle of best available information, which requires that risk management rely on historical data, current information, forward-looking analysis, and clearly acknowledged limitations and assumptions. Explore how dynamic and information-driven risk management plays out in practice through emerging risk radars, scenario analysis, horizon scanning, and predictive indicators, and how to balance speed of decision-making with quality of evidence.
- Human and Cultural Factors in Risk8:38Investigate the principle of human and cultural factors in ISO 31000:2018 Clause 4, which recognizes that risk is identified, assessed, and treated by people whose behaviors and beliefs significantly shape outcomes. Learn how cognitive biases such as optimism bias, anchoring, groupthink, and availability heuristics distort risk perception and skew prioritization. Understand the role of risk culture, tone at the top, psychological safety, and incentive systems in determining whether employees surface bad news or hide it until it becomes a crisis. Examine how organizations actively design for human factors through training, transparent reporting channels, behavioral risk indicators, and leadership communication that rewards early escalation of issues.
- Continual Improvement as a Risk Discipline10:03Explore the final principle in Clause 4 of ISO 31000:2018, continual improvement, and learn why a mature risk management system never stops evolving. Understand how organizations use lessons learned from incidents, near misses, audit findings, and changes in context to refine their risk criteria, treatment plans, and framework design. Examine the role of post-incident reviews, internal audit, management review, and benchmarking against peers in driving improvement. Learn how continual improvement connects directly to the framework's improvement step in Clause 5.7 and to the iterative nature of the risk management process in Clause 6, creating a loop in which every risk-related decision feeds back into a smarter, sharper, and more resilient organization.
- Section 2 Quiz: The Eight Principles of Effective Risk Management
- Roleplay: The Eight Principles of Effective Risk Management
- Leadership and Commitment from the Top8:12Examine why Clause 5.2 of ISO 31000:2018 places leadership and commitment at the heart of the framework, treating top management and oversight bodies as accountable for risk management success. Learn what visible leadership looks like in practice — issuing and endorsing a risk management policy, allocating sufficient resources, assigning authority and responsibility, and aligning risk management with strategy and culture. Understand the role of the board, audit committee, risk committee, chief risk officer, and executive sponsors in setting tone and expectations. Explore how organizations articulate a clear statement on risk management, define accountabilities at each level, and ensure that leaders model the behaviors they expect from the rest of the workforce.
- Integrating Risk Management into Organizational Processes10:20Understand Clause 5.3 of ISO 31000:2018, which requires that risk management be integrated into the organization's governance and into all activities, including decision-making, planning, projects, change management, and performance management. Learn how integration looks different at strategic, tactical, and operational levels and how the three lines of accountability — operational management, oversight functions, and internal audit — share responsibility for embedding risk thinking. Examine practical mechanisms for integration such as embedding risk questions in business cases, project gates, procurement decisions, and budget submissions. Discover how successful integration eliminates the gap between what the risk team documents and what the business actually does day to day.
- Designing the Risk Management Framework10:57Dive into Clause 5.4 of ISO 31000:2018, which covers framework design — understanding the organization and its context, articulating risk management commitment, assigning roles and accountabilities, allocating resources, and establishing communication and consultation arrangements. Learn how the external context analysis examines regulatory, economic, social, technological, and competitive factors, while internal context analysis covers governance, structure, culture, capabilities, and stakeholder relationships. Examine the role of a risk management policy statement, risk taxonomy, risk criteria, and supporting procedures. Explore how design choices made at this stage determine whether the framework will be lightweight and pragmatic or bureaucratic and disconnected from real decisions.
- Implementing the Risk Management Framework8:58Explore Clause 5.5 of ISO 31000:2018, which addresses how organizations operationalize the designed framework so that risk management actually happens consistently across business units and functions. Learn why implementation requires a clear plan with timelines, responsibilities, resources, and milestones, and how change management techniques help embed new behaviors. Understand the importance of training, awareness campaigns, supporting tools such as risk registers and reporting templates, and integration with existing management cycles. Examine common implementation pitfalls — over-reliance on documentation, insufficient executive engagement, and treating implementation as a one-time project rather than an ongoing program — and how organizations overcome them through phased rollout and visible quick wins.
- Evaluating Framework Effectiveness8:53Examine Clause 5.6 of ISO 31000:2018, which requires organizations to periodically measure framework performance against its purpose, implementation plans, indicators, and expected behavior. Learn how to design indicators that reveal whether risk management is genuinely supporting decision-making rather than producing paperwork, including measures of risk identification quality, treatment timeliness, residual risk versus appetite, and risk-informed decisions. Understand the role of internal audit, management review, and external benchmarking in evaluation. Examine how organizations triangulate quantitative metrics, stakeholder feedback, incident data, and culture surveys to form an honest view of where their risk management framework is strong and where it falls short of its stated ambitions.
- Improving the Risk Management Framework8:59Explore Clause 5.7 of ISO 31000:2018, which calls for continual adaptation and improvement of the framework based on monitoring, review, and changes in context. Learn how organizations translate evaluation findings into concrete improvements such as updating risk criteria, refining risk taxonomies, redesigning escalation pathways, or strengthening reporting cadence. Understand how external events — regulatory change, mergers, technology shifts, and crises — trigger framework refresh cycles. Examine how mature organizations build improvement loops by connecting incident reviews, audit findings, near miss reports, and emerging risk intelligence into a backlog of framework enhancements that is prioritized, resourced, and tracked just like any other strategic initiative inside the business.
- Section 3 Quiz: The Risk Management Framework
- Roleplay: The Risk Management Framework
- The Iterative Nature of the Risk Management Process9:12Map out the risk management process described in Clause 6 of ISO 31000:2018, learning how its activities — communication and consultation, scope context and criteria, risk assessment, risk treatment, monitoring and review, and recording and reporting — interact iteratively rather than sequentially. Understand why the process is depicted as a continuous loop with communication and consultation and monitoring and review running across the entire flow. Examine how the same process applies at strategic, project, departmental, and operational levels with different inputs and outputs at each level. Explore why organizations that treat the process as a once-a-year exercise miss most of its value, while those that embed it into recurring decisions extract real intelligence about uncertainty.
- Communication and Consultation Across the Process8:18Examine Clause 6.2 of ISO 31000:2018, which positions communication and consultation as an ongoing activity that surrounds and supports every other step of the risk management process. Learn the distinction between communication, which transmits information, and consultation, which seeks feedback and informs decisions, and why both matter for accuracy and legitimacy. Understand how communication and consultation help bring different areas of expertise together, ensure stakeholders' views are considered, build awareness, and obtain endorsement for the risk management approach. Explore practical tools such as stakeholder maps, communication plans, risk dashboards, governance forums, and feedback mechanisms that make this principle operational rather than aspirational inside complex organizations.
- Defining Scope, Context, and Criteria6:34Dive into Clause 6.3 of ISO 31000:2018, which requires that organizations define the scope of risk management activities, understand external and internal context, and set criteria before assessing risk. Learn how scope decisions determine boundaries — which entities, processes, assets, time horizons, and decisions are covered. Understand external context elements such as regulatory environment, market dynamics, technological trends, and stakeholder expectations, alongside internal context elements like governance structure, strategic objectives, culture, capabilities, and contractual obligations. Examine how a clearly articulated context enables risk identification to surface relevant scenarios and prevents the common failure of generating long lists of generic risks that do not reflect the organization's actual situation.
- Risk Criteria, Risk Appetite, and Risk Tolerance8:02Explore how organizations establish risk criteria under Clause 6.3.4 of ISO 31000:2018 — the standards used to evaluate the significance of risk and support decision-making. Learn the difference between risk criteria, which include impact scales and likelihood scales, risk appetite as the amount and type of risk an organization is willing to pursue or retain, and risk tolerance as the readiness to bear residual risk after treatment. Understand how risk appetite statements translate strategic objectives into operational guidance, and how risk tolerance varies by category — financial, operational, reputational, regulatory, safety, and strategic. Examine how boards approve appetite, how management cascades it, and how organizations test whether actual exposures stay inside declared thresholds across reporting cycles.
- Section 4 Quiz: The Risk Management Process — Setting the Stage
- Roleplay: The Risk Management Process — Setting the Stage
- Risk Identification — Surfacing What Could Go Right or Wrong8:28Examine Clause 6.4.2 of ISO 31000:2018, which addresses the systematic discovery of risks that could affect the achievement of objectives. Learn that risk identification is comprehensive and forward-looking, covering tangible and intangible sources, events with multiple causes and consequences, opportunities as well as threats, cascading effects, and risks that arise from gaps and missed opportunities. Understand how techniques such as brainstorming, structured interviews, checklists, scenario analysis, SWOT, PESTLE, and process mapping help surface risks at strategic, operational, project, and emerging levels. Explore how a well-curated risk taxonomy guides identification, ensures consistency across the organization, and prevents both blind spots and duplication when many teams contribute to a single enterprise risk view.
- Qualitative Risk Analysis Methods7:53Explore qualitative risk analysis as one of the techniques referenced under Clause 6.4.3 of ISO 31000:2018, where consequence and likelihood are described using categories such as low, medium, high, and very high rather than numerical values. Learn how organizations design qualitative scales tied to financial impact bands, operational disruption thresholds, regulatory consequences, safety outcomes, and reputational damage. Understand strengths of qualitative methods — speed, accessibility for non-specialists, suitability for strategic and reputational risks where data is scarce — and limitations including subjectivity and difficulty aggregating across portfolios. Examine practical examples of qualitative analysis using descriptive criteria, narrative justifications, and expert judgment captured through structured workshops with clearly defined criteria and traceable reasoning.
- Quantitative Risk Analysis Methods11:35Examine quantitative risk analysis as a complementary approach under Clause 6.4.3 of ISO 31000:2018, where likelihood and consequence are expressed numerically using probabilities, monetary values, and statistical distributions. Learn the conceptual foundations of techniques such as expected monetary value, Monte Carlo simulation, fault tree analysis, event tree analysis, value at risk, and decision tree analysis as they are described in supporting standards like ISO 31010. Understand the data requirements, assumptions, and validation needs that make quantitative analysis credible. Explore when quantitative approaches add the most value — capital allocation, insurance purchasing, complex projects, financial risk — and how organizations blend qualitative and quantitative views to support different decisions at different levels of granularity.
- Risk Matrices and Heat Maps9:49Explore the design and use of risk matrices and heat maps as widely adopted visualization tools that operationalize Clause 6.4.3 of ISO 31000:2018. Learn how organizations build a matrix by combining a likelihood axis and a consequence axis, mapping each axis to defined criteria, and color-coding zones to communicate severity. Understand best practices for matrix design — symmetric scales, clear category definitions, calibration across business units, and consistent treatment of inherent versus residual risk. Examine pitfalls such as range compression, over-reliance on a single matrix for very different risk types, and confusion between expected loss and worst-case loss. Discover how heat maps communicate portfolio risk to boards and how they support prioritization without replacing deeper analysis.
- Bow-Tie Analysis for Cause and Consequence Mapping9:27Investigate bow-tie analysis as a conceptual technique recognized in ISO 31010 and used to give effect to ISO 31000:2018 risk analysis under Clause 6.4.3. Learn how the bow-tie diagram places a central event in the middle, threats and causes on the left, and consequences on the right, with preventive controls between causes and the event and recovery or mitigation controls between the event and consequences. Understand how the technique makes the relationship between causes, events, consequences, and controls highly visual and accessible for boards, regulators, and front-line teams. Examine where bow-tie analysis adds the most value — major hazard industries, safety critical operations, cyber incidents, and reputational events — and how it integrates with risk registers and treatment planning.
- Risk Evaluation and Prioritization11:19Examine Clause 6.4.4 of ISO 31000:2018, which describes risk evaluation as the comparison of risk analysis results against established risk criteria to support decisions. Learn how risk evaluation answers practical questions — is this risk acceptable, does it require treatment, should it be reassessed, does it warrant a different strategy, or should the activity be stopped altogether. Understand how decisions consider not just the risk level but also wider context, stakeholder views, opportunities, and ethical and legal obligations. Explore how organizations use prioritization rules, escalation thresholds, and decision rights matrices to ensure that risk evaluation outputs feed cleanly into treatment planning and resource allocation rather than disappearing into unactioned reports.
- Section 5 Quiz: Risk Assessment Methods and Techniques
- Roleplay: Risk Assessment Methods and Techniques
- Risk Treatment Options — Avoid, Modify, Share, Retain10:24Explore Clause 6.5 of ISO 31000:2018, which sets out how organizations select and implement options for modifying risk. Learn the principal categories of treatment — avoiding the risk by not starting or continuing the activity, taking or increasing the risk to pursue an opportunity, removing the risk source, changing the likelihood, changing the consequences, sharing the risk with another party including through contracts and insurance, and retaining the risk by informed decision. Understand how organizations evaluate options by weighing cost, effectiveness, feasibility, secondary risks, and alignment with values and objectives. Examine examples across financial, operational, cyber, and strategic risks, and how multiple options are typically combined to bring residual risk inside appetite while preserving opportunity.
- Designing and Implementing Risk Treatment Plans10:10Dive into the operational side of Clause 6.5.3 of ISO 31000:2018, which calls for documented risk treatment plans that explain the rationale for the selected treatment, the expected benefits, accountabilities, resources, performance measures, constraints, reporting requirements, and timing. Learn how strong plans translate treatment decisions into specific actions, owners, deadlines, and budgets that fit inside existing project and operational governance. Understand how organizations sequence treatments, build in residual risk acceptance, and address secondary risks that arise from the treatment itself. Examine how treatment plans are integrated with corporate planning cycles, capital expenditure approvals, and performance management so they actually get implemented rather than sitting in a register as good intentions.
- Risk Registers — Structure, Maintenance, and Use11:12Examine the role of the risk register as the working memory of an ISO 31000:2018-aligned risk management system, supporting Clauses 6.4 through 6.7. Learn typical fields including risk identifier, description, category, causes, consequences, inherent risk rating, current controls, residual risk rating, risk owner, treatment actions, due dates, and status. Understand how organizations design registers at enterprise, business unit, project, and operational levels and how these registers connect through consolidation and reporting. Explore best practices for keeping the register alive — quarterly refresh cycles, change triggers, control effectiveness reviews, and integration with audit findings — and common failure modes such as static lists, inconsistent ratings, and orphan risks without active owners or treatment plans.
- Key Risk Indicators and Risk Monitoring8:38Explore Clause 6.6 of ISO 31000:2018, which addresses monitoring and review as a continuous part of the risk management process. Learn how key risk indicators function as forward-looking metrics that signal changes in the level of risk before incidents occur, distinct from lagging key performance indicators that report past outcomes. Understand how organizations select KRIs that are measurable, relevant, predictive, and actionable, with defined thresholds that trigger escalation. Examine examples of KRIs across operational, financial, cyber, compliance, safety, and strategic categories, and how dashboards aggregate them for executives and boards. Discover how monitoring also covers control effectiveness, treatment implementation, residual risk versus appetite, and emerging risks that fall outside the existing register.
- Recording and Reporting Risk Information8:47Examine Clause 6.7 of ISO 31000:2018, which addresses how risk management activities, decisions, and outcomes are documented and communicated to inform decision making, improve activities, support interaction with stakeholders, and provide information for review and improvement. Learn what should be recorded — context analysis, risk assessments, decisions, treatment plans, monitoring results, and lessons learned — and how to balance completeness with usability. Understand reporting needs across audiences including boards, executive committees, risk committees, regulators, and operational managers, and how content, format, and cadence vary accordingly. Explore how mature organizations move beyond static risk reports to dynamic dashboards, narrative commentary, and forward-looking scenarios that genuinely shape decisions rather than simply tick reporting boxes.
- Enterprise Risk Management and ISO 31000 in Practice7:40Bring everything together by examining how ISO 31000:2018 supports an integrated enterprise risk management approach that connects strategy, performance, and risk across the entire organization. Learn how ERM treats the portfolio of risks holistically rather than as a list of isolated items, identifying interdependencies, concentrations, and aggregate exposures that no single business unit sees on its own. Understand how organizations align ERM with strategic planning, capital allocation, performance management, and incentive design so that risk-informed thinking shapes every major decision. Explore how this integration supports board oversight, regulatory expectations, investor confidence, and operational resilience, turning ISO 31000:2018 from a guidance document into a living capability that helps the organization create and protect value through any future it encounters.
- Section 6 Quiz: Risk Treatment, Monitoring, and Enterprise Integration
- Roleplay: Risk Treatment, Monitoring, and Enterprise Integration
Requirements
- Basic familiarity with how organizations are structured and governed
- General understanding of business objectives, projects, and operations
- Comfort reading professional documents and structured frameworks
- No prior certification or formal risk management background required
Description
This course contains the use of artificial intelligence.
Risk has never been more central to organizational survival, and ISO 31000:2018 has become the global reference for how mature organizations think about, govern, and act on uncertainty. From cyber incidents and supply chain shocks to regulatory change and reputational crises, the discipline of risk management is now a board-level capability rather than a back-office function. This course gives you a rigorous, practical, and current understanding of the international guidance that underpins how risk is managed in financial services, healthcare, energy, government, technology, and beyond.
You will work through the full structure of ISO 31000:2018, starting with its scope, vocabulary, and history, and how it compares with ISO 27005, ISO 22301, and COSO ERM. You will study the eight principles in Clause 4 — integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, and continual improvement — and see how each one shows up in real organizational behavior. You will master the risk management framework of Clause 5, including leadership and commitment, integration, design, implementation, evaluation, and improvement. You will then walk step by step through the risk management process in Clause 6, covering communication and consultation, scope, context and criteria, risk identification, risk analysis, risk evaluation, risk treatment, monitoring and review, and recording and reporting.
Along the way you will get a clear conceptual grounding in risk appetite and tolerance, risk criteria, risk matrices and heat maps, qualitative and quantitative analysis methods, bow-tie analysis, risk registers, treatment options of avoid, modify, share, and retain, key risk indicators, and the role of risk reporting at every level. You will see how all of these tools combine to form an integrated enterprise risk management capability that connects strategy, performance, and resilience.
This course is designed for risk managers, internal auditors, compliance officers, project managers, executives, and any professional accountable for risk oversight or decision-making. By the end you will be able to read ISO 31000:2018 fluently, apply it to your organization, and elevate the way risk is discussed in your boardroom. Enroll now and turn uncertainty into a strategic advantage.
Who this course is for:
- Risk managers and enterprise risk professionals seeking ISO 31000:2018 mastery
- Internal auditors evaluating risk management frameworks against international guidance
- Compliance officers, governance leads, and quality professionals supporting risk programs
- Project managers, program managers, and operational leaders accountable for risk in their domains
- Senior managers, executives, and board members responsible for risk oversight and strategy