ISO 31000 is the most widely-adopted risk management standard in the world — and the most misunderstood. This guide strips it down to the five steps your operational risk team will actually run, week after week, against a live register.
List everything that could go wrong. Workshop by process, department, or value stream. Record cause and consequence separately — 'server outage' is not a risk; 'customer-facing outage caused by unpatched dependency, leading to SLA breach' is.
Output: A raw register of candidate risks with owners assigned.
Score each risk on likelihood (1–5) and impact (1–5) before controls — this is the inherent score. Use a 5×5 matrix so severity is a single number your board can compare across categories.
Output: Inherent likelihood × impact = inherent severity for every entry.
Compare inherent severity against your risk appetite. Anything above the tolerance line needs treatment; anything below can be accepted and monitored. This is where the register stops being a list and starts driving decisions.
Output: A prioritized shortlist of risks that require action.
Pick a strategy per risk: avoid, reduce, transfer, or accept. Log the specific controls and treatment actions, then re-score post-treatment to get the residual severity. The gap between inherent and residual is the evidence that your controls worked.
Output: Named controls, action owners, and residual scores for each treated risk.
Set a review cadence per risk based on severity — quarterly for low, monthly for high, and immediately when a trigger event occurs. Track control effectiveness and re-score when the environment changes. ISO 31000 is a loop, not a checklist.
Output: A living register with next-review dates and an audit trail of changes.
The columns your ISO 31000 register needs — inherent scoring, residual scoring, treatment strategy, next-review date — are already laid out in our free Excel template.