ISO 31000:2018
ISO 31000:2018 Risk management, Guidelines: the eight principles, the framework (leadership and commitment, integration, design, implementation, evaluation, improvement) and the risk management process (communication and consultation, scope, context and criteria, assessment, treatment, monitoring and review, recording and reporting). Guidance, not certifiable.
ISO 31000:2018 is a compliance framework from International with 3 domains and 28 controls that map to 60 other frameworks. The largest domains are Process – ISO 31000:2018 (15 controls), Framework – ISO 31000:2018 (12 controls), Principles – ISO 31000:2018 (1 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Framework – ISO 31000:2018
| Code | Title |
|---|---|
| iso-31000-2018::5.1 | General |
| iso-31000-2018::5.2 | Leadership and commitment |
| iso-31000-2018::5.3 | Integration |
| iso-31000-2018::5.4.1 | Understanding the organization and its context |
| iso-31000-2018::5.4.2 | Articulating risk management commitment |
| iso-31000-2018::5.4.3 | Assigning organizational roles, authorities, responsibilities and accountabilities |
| iso-31000-2018::5.4.4 | Allocating resources |
| iso-31000-2018::5.4.5 | Establishing communication and consultation |
| iso-31000-2018::5.5 | Implementation |
| iso-31000-2018::5.6 | Evaluation |
| iso-31000-2018::5.7.1 | Adapting |
| iso-31000-2018::5.7.2 | Continually improving |
Principles – ISO 31000:2018
| Code | Title |
|---|---|
| iso-31000-2018::4 | Principles |
Process – ISO 31000:2018
| Code | Title |
|---|---|
| iso-31000-2018::6.1 | General |
| iso-31000-2018::6.2 | Communication and consultation |
| iso-31000-2018::6.3.1 | General |
| iso-31000-2018::6.3.2 | Defining the scope |
| iso-31000-2018::6.3.3 | External and internal context |
| iso-31000-2018::6.3.4 | Defining risk criteria |
| iso-31000-2018::6.4.1 | General |
| iso-31000-2018::6.4.2 | Risk identification |
| iso-31000-2018::6.4.3 | Risk analysis |
| iso-31000-2018::6.4.4 | Risk evaluation |
| iso-31000-2018::6.5.1 | General |
| iso-31000-2018::6.5.2 | Selection of risk treatment options |
| iso-31000-2018::6.5.3 | Preparing and implementing risk treatment plans |
| iso-31000-2018::6.6 | Monitoring and review |
| iso-31000-2018::6.7 | Recording and reporting |
Your Compliance Coverage
If you comply with ISO 31000:2018, you already cover:
ISO/IEC 23894:2023
71%
24 controls mapped
Compare →ISO 19011:2018
62%
21 controls mapped
Compare →ISO 14004:2016
26%
9 controls mapped
Compare →+ 57 more: ISO 27005:2022 (18%), ISO/IEC 27557:2022 - Organisational Privacy Risk Management (18%)
See all 60 mapped frameworks ↓Maps to 60 other frameworks
Coverage is not the same as your position
This page shows what ISO 31000:2018 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is ISO 31000:2018 and who does it apply to?
ISO 31000:2018 is a compliance framework from International with 3 domains and 28 controls. ISO 31000:2018 Risk management, Guidelines: the eight principles, the framework (leadership and commitment, integration, design, implementation, evaluation, improvement) and the risk management process (communication and consultation, scope, context and criteria, assessment, treatment, monitoring and review, recording and reporting). Guidance, not certifiable. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ISO 31000:2018 actually require?
ISO 31000:2018 has 28 controls organised across 3 domains. The largest domains are Process – ISO 31000:2018 (15 controls), Framework – ISO 31000:2018 (12 controls), Principles – ISO 31000:2018 (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ISO 31000:2018 do I already cover?
ISO 31000:2018 maps to 60 other compliance frameworks. The top mapping partners are ISO/IEC 23894:2023 (71% coverage), ISO 19011:2018 (62% coverage), ISO 14004:2016 (26% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement ISO 31000:2018?
Start your ISO 31000:2018 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 31000:2018 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required