ISO 31000:2018 Risk management

This download includes the ISO 31000:2009 Risk management project. This Standard was prepared by Joint Standards Australia/Standards New Zealand Committee OB-007, Risk Management to supersede AS/NZS 4360:2004, Risk management. This International Standard provides principles and generic guidelines on risk management.

The purpose of the risk management framework is to assist the organization in integrating risk management into significant activities and functions. The effectiveness of risk management will depend on its integration into the governance of the organization, including decision-making. This requires support from stakeholders, particularly top management. Framework development encompasses integrating, designing, implementing, evaluating and improving risk management across the organization.

The organization should evaluate its existing risk management practices and processes, evaluate any gaps and address those gaps within the framework.The components of the framework and the way in which they work together should be customized to the needs of the organization.

This International Standard can be used by any public, private or community enterprise, association, group or individual. Therefore, this International Standard is not specific to any industry or sector. It can be applied throughout the life of an organization, and to a wide range of activities, including strategies and decisions, operations, processes, functions, projects, products, services and assets.

This International Standard can be applied to any type of risk, whate ver its nature, whether having positive or negative consequences. Although this International Standard provides generic guidelines, it is not intended to promote uniformity of risk management across organizations. The design and implementation of risk management plans and frameworks will need to take into account the varying needs of a specific organization, its particular objectives, context, structure, operations, processes, functions, projects, products, services, or assets and specific practices employed. It is intended that this International Standard be utilized to harmonize risk management processes in existing and future standards. It provides a common approach in support of standards dealing with specific risks and/or sectors, and does not replace those standards. This International Standard is not intended for the purpose of certification.