ISO 31000 was published in 2009 as an internationally agreed standard for the implementation of risk management principles, and provides generic guidelines for the design, implementation and maintenance of risk management processes throughout an organisation.

ISO 31000 also describes the components of a risk management implementation framework. It includes the essential steps in the implementation and ongoing support of the risk management process. The initial component of the ISO 31000 framework is ‘mandate and commitment’ by the Board and this is followed by:

• design of framework
• implement risk management
• monitor and review framework
• improve framework

ISO 31000 is to be applied within existing management systems, formalising and improving risk management processes as opposed to replacing existing risk management practices. As a result, attention is to be given to integrating existing risk management processes addressed in the standard.

The focus of many ISO 31000 programmes have centred on:

• Transferring accountability gaps in enterprise risk management
• Aligning objectives of the governance frameworks
• Embedding management system reporting mechanisms
• Creating uniform risk criteria and evaluation metrics