Business Advice
Risk Management to ISO 31000: Building a Register Someone Actually Uses
Open the risk register of almost any certified company. You will find between eight and twelve rows, created the day before the first certification audit. “Loss of a key customer — likelihood medium, impact high, measure: maintain good relations.” The document has not been touched since.
That is not risk management. That is a document for an auditor. The difference comes down to one thing: a working register changes decisions rather than merely existing.
Key Takeaways
- ISO 31000 is guidance, not a requirement. You cannot be certified against it — it offers principles, a framework and a process that each organisation adapts.
- ISO 9001 does not require ISO 31000. Clause 6.1 requires you to determine risks and opportunities and plan actions — it prescribes no methodology, form or matrix.
- The process has six steps: scope and context, identification, analysis, evaluation, treatment, plus continuous communication and monitoring.
- Risk is not only threat. The definition is “the effect of uncertainty on objectives” — and that effect can be positive.
- The likelihood–impact matrix is a tool, not the method. ISO 31010 describes more than thirty techniques; most companies need three or four.
- A register with no owner and no deadline does not work. Every risk needs an owner, a treatment and a review date — otherwise it stays a description.
What ISO 31000 is and is not
ISO 31000 is the international standard providing guidelines on risk management. It is not a certification standard — no body issues an ISO 31000 certificate to an organisation, and any offer of one is a reason for caution.
| Element | What it contains | The question it answers |
|---|---|---|
| Principles | Integrated, structured, customised, inclusive, dynamic, best available information, human and cultural factors, continual improvement | What makes risk management effective? |
| Framework | Leadership and commitment, integration, design, implementation, evaluation, improvement | How is it embedded in the organisation? |
| Process | Scope and context, identification, analysis, evaluation, treatment, communication, monitoring, recording | How is an individual risk handled? |
Most companies apply only the process and skip the framework. The result is familiar: there is a register, but nobody maintains it, because risk management is not built into how decisions are made.
The definition that changes the thinking: risk is “the effect of uncertainty on objectives”. Three consequences follow: risk is always relative to an objective — with no objectives there are no risks; the effect may be positive, that is, an opportunity; and uncertainty is the source, not the event itself.
What ISO 9001 actually requires
The most common misunderstanding is that ISO 9001 requires a risk register. It does not. Clause 6.1 says the organisation shall determine the risks and opportunities that need to be addressed and plan actions to address them. There is no requirement for:
- a documented risk management procedure;
- a register in a prescribed format;
- a likelihood–impact matrix;
- numerical scoring or a scale;
- applying ISO 31000.
In practice most organisations keep a register anyway, because it is the most convenient evidence. But the format is your choice — which is exactly why it is worth choosing one you will actually use.
The process in six steps
- Define scope, context and criteria. What exactly are we talking about — the whole company, one process, one project? What are the objectives? What level of risk is acceptable? Without criteria, evaluation is a feeling.
- Identify the risks. What could happen, why and how. Most value is lost here when identification is done by one person at a desk rather than by the people doing the work.
- Analyse them. Understand the nature of the risk, its sources, consequences and likelihood. The analysis may be qualitative, quantitative or a mix.
- Evaluate them against the criteria. Decide which risks require action and in what order. This is a decision, not a calculation.
- Treat them. Avoid, take the risk to pursue an opportunity, remove the source, change the likelihood, change the consequences, share the risk through insurance or contract, or accept it knowingly.
- Monitor and review. Risks change. Review at a planned frequency and after any significant change in context.
The methods: which, when
| Method | Suited to | Effort |
|---|---|---|
| Structured process walkthrough | Identifying operational risks with the team | Low |
| Likelihood–impact matrix | Prioritisation and visualisation | Low |
| Scenario analysis | Strategic risks, supply disruption | Medium |
| FMEA | Product and process risks in manufacturing | High |
| Cause-and-consequence analysis | Risks with complex causation | Medium |
| Business impact analysis | Continuity, an input to ISO 22301 | Medium |
On the matrix: it is a communication tool, not a precision instrument. Multiplying “likelihood 3” by “impact 4” produces a number that looks objective but rests on two subjective judgements. Use it to prioritise and to talk about risk — not to replace the conversation with arithmetic.
What a register that gets used looks like
- Risk owner — a named person, not a department. Departments do not make decisions.
- Treatment with a deadline — what will be done and by when, not “monitor the situation”.
- Residual risk — the rating after the treatment. If it does not change, the treatment is not working.
- Next review date — different for different risks.
And one more practical point: a register with 60 rows is read by nobody. Ten to fifteen genuinely managed risks are more useful than an exhaustive list opened once a year.
How it connects to the other standards
| Standard | Risk focus |
|---|---|
| ISO 9001 | Ability to deliver conforming product and customer satisfaction |
| ISO 14001 | Environmental aspects and impacts, compliance obligations |
| ISO 45001 | Health and safety hazards, including psychosocial ones |
| ISO 27001 | Confidentiality, integrity and availability of information |
With an integrated system, a shared ISO 31000 methodology allows one process and one register with different categories, instead of four parallel documents nobody connects.
Does your register only get opened before an audit?
We build a risk management process sized to your company — with a working identification session alongside your team, not a form filled in by a consultant.
Conclusion
Risk management fails not because of poor methodology but because of the wrong owner. When the register belongs to the quality manager, it is a document. When each risk belongs to the person who would bear the consequences, it starts to influence decisions.
To check which of the two situations you are in, run one experiment: ask three people outside the quality function what the biggest risk to the company is. If their answers do not match the top three rows of your register, you know what to fix.
Frequently Asked Questions
Can a company be certified to ISO 31000?
No. ISO 31000 is a guidance standard rather than a requirements standard, and certificates are not issued to organisations against it. An offer of “ISO 31000 certification” is a warning sign about the provider. Training and personal qualifications exist, but system certification does not.
Does ISO 9001 require a risk register?
No. Clause 6.1 requires the organisation to determine the risks and opportunities that need to be addressed and to plan actions for them, but prescribes no documented procedure, register format, matrix or numerical scoring. A register is the most convenient evidence, but it is not a mandatory form.
What is the ISO 31000 definition of risk?
Risk is defined as the effect of uncertainty on objectives. It follows that risk is always considered relative to a specific objective, that the effect may be negative or positive, and that the source is uncertainty rather than the event itself.
How many risks should a register contain?
There is no required number. In practice a register with 10 to 15 genuinely managed risks works better than a list of 60 rows opened once a year. The number should be such that every risk has an owner, a treatment with a deadline and a real review.
Is a likelihood–impact matrix mandatory?
It is not mandatory. It is one of more than thirty techniques described in ISO 31010 and is convenient for prioritisation and communication. The rating remains subjective, so the matrix should structure the conversation about risk rather than replace it.
What are the risk treatment options?
The options include avoiding the risk by not starting the activity, taking the risk to pursue an opportunity, removing the source, changing the likelihood, changing the consequences, sharing the risk through insurance or contract, and knowingly accepting it. The choice is made against previously defined criteria.
Should an integrated system use one register?
One register is preferable, with categories for quality, environment, health and safety and information security. A shared methodology allows a single identification and review process instead of several parallel documents that are not connected and are maintained by different people.