ISO 31000 Risk Assessment Process Explained Step by Step

Risk can show up in many parts of a business. A supplier could miss a delivery, a new service might not perform as expected, information could be exposed, or a project could fall behind schedule. The ISO 31000 Risk Assessment Process helps teams examine possible risks before making decisions. The process involves identifying what could go wrong, judging how likely it is, considering the possible impact, and deciding which risks require action first. The process sits within the wider ISO 31000 Risk Management Framework, which also includes risk treatment, communication, monitoring, and reporting. This guide breaks down the process, key requirements, assessment criteria, responsibilities, records, formulas, and a simple real-world example.

What Is the ISO 31000 Risk Assessment Process?

The process is the part of ISO 31000 used to identify, analyze, and evaluate uncertainty connected to organizational objectives. It turns concerns, incomplete information, previous incidents, and possible future events into structured information for decision-making.

The assessment contains three connected stages:

1. 1. Identification: List the events or situations that could affect the objective.
2. 2. Analysis: Look at what may cause each risk, what could happen, how likely it is, and what controls are already in place.
3. 3. Evaluation: Check the results against the organization’s risk criteria and determine which risks require action.

These stages do not operate alone. An organization first defines the scope, context, and criteria for the assessment. Communication supports each stage, while the findings may later lead to treatment, acceptance, escalation, monitoring, or further analysis.

Risk can lead to problems, but it can also bring useful results. For instance, a new technology may cause setup issues at first, while also cutting costs or improving the quality of service.

Why Is Risk Assessment Important in ISO 31000?

A structured assessment helps organizations:

• Tie each risk to a specific business objective.
• Use one consistent method to rate and compare risks.
• Review existing controls to see if they are actually effective.
• Give priority to risks that could have the greatest impact.
• Record the reasoning behind important risk decisions.
• Consider opportunities that could benefit the business, not only potential threats.
• Reassess risks when circumstances change.

The process cannot predict every event. Its purpose is to help decision-makers work with uncertainty in a more consistent and informed manner.

ISO 31000 Structure, Clauses, and Assessment Boundary

The ISO 31000 Standard is built around three main elements: principles, a framework, and a process. Each element serves a different purpose.

The ISO 31000 Risk Management Principles state that effective risk practices should be integrated, structured, tailored, inclusive, adaptable, informed by reliable evidence, mindful of people and cultural differences, and regularly improved.

Clauses Related to Risk Assessment

Risk Management vs Risk Assessment

Risk assessment identifies, analyzes, and evaluates risk. Risk management is broader because it also includes context, communication, treatment, monitoring, recording, and reporting.

How Does ISO 31000 Help Manage Risk? It connects objectives, uncertainty, evidence, decisions, ownership, and review through a consistent process.

ISO 31000:2018 vs ISO 31000:2009

ISO 31000 came out in 2009 and was revised in 2018. Older references may still use the 2009 version, so the way the standard is presented can vary between articles, guides, and diagrams.

The three assessment activities remain identification, analysis, and evaluation. The main changes concern the structure, terminology, principles, leadership involvement, and integration of risk considerations into organizational decisions.

Current articles should use the 2018 clause references. The official ISO page shows that a future replacement is under development. Until that replacement is published, ISO 31000:2018 remains the current published edition.

Is ISO 31000 Certifiable?

The ISO 31000 Standard offers guidance for managing risk rather than requirements for certification, so organizations do not receive an accredited ISO 31000 management system certificate.

Professional courses based on the standard are available for individuals, but completing such training does not mean the organization itself is ISO 31000 certified.

During ISO 31000 Implementation, the approach can be adjusted to suit the organization, its goals, industry, size, available information, and working environment, with no fixed requirement for a particular risk matrix, scoring method, risk register, or set of documents.

Preparing Scope, Risk Criteria, and Evidence

First, decide what the assessment will cover and its goal. Then understand the current situation, involve the right people, agree on how risks will be judged, and collect the needed information before identifying risks.

Define the Objective

Risk makes sense only when there is a clear goal. The goal should state what the project, team, process, or organization needs to achieve

For example, “assess technology risk” is too general. A clearer goal would be:

Keep the online examination platform available for all scheduled exams over the next six months

Set the Assessment Scope

The scope should define:

• Activities included in the assessment
• Locations, systems, and assets covered
• Departments and suppliers involved
• Time period being examined
• Important exclusions
• Assumptions and limitations
• Intended users of the findings

Understand the Context

Internal and external context may include:

• Business plans
• Legal requirements
• Market changes
• Technology in use
• Staff skills
• Supplier performance
• Financial position
• Stakeholder needs
• Past problems

Establish Risk Assessment Criteria

Risk assessment criteria help decide how serious a risk is and whether it needs action, consider the chance of it happening, its impact, risk limits, when to escalate it, legal requirements, review periods, and how effective the existing controls are.

Example Likelihood Scale

Example Consequence Scale

The Risk Assessment Methodology should clearly set out how each scale is used and interpreted, with the criteria agreed and approved before the assessment starts. Changing the thresholds after seeing the results can affect the ranking of risks and lead to the wrong priorities.

Gather Supporting Evidence

Useful information for a risk assessment can come from several sources, including:

• Company policies and objectives.
• Process flowcharts and maps.
• Past incident reports.
• Internal and external audit results.
• Supplier information and reports.
• Records showing how controls are working.
• Performance and operational data.
• Applicable laws and regulations.
• Notes from interviews and team discussions.

Missing information should be recorded as uncertainty instead of being hidden or replaced with an unsupported assumption.

How to Conduct an ISO 31000 Risk Assessment

The ISO 31000 Risk Assessment Process is carried out in three related stages, with each one covering a specific part of the assessment. The process should identify what is needed, what needs to be done, who is responsible, and what records are kept at each stage.

Step 1: Risk Identification

Risk Identification is the process of spotting anything that could affect an objective, whether it creates a problem or an opportunity. It looks at possible causes, events, consequences, threats, existing controls, weak points, and areas where information is missing.

Main Inputs

Risk identification can draw on information such as:

• Objectives and scope.
• Internal and external factors.
• Process documents.
• Details of key assets.
• Previous incidents.
• Audit findings.
• Input from relevant stakeholders.
• Details of controls already in place.

Practical Activities

Common ways to identify risks include:

• Team discussions and workshops.
• One-to-one interviews.
• Reviewing processes step by step.
• Using checklists.
• Looking at possible scenarios.
• Examining past incidents.
• Reviewing audit findings.
• Applying lessons from previous projects.

A useful statement format is:

Because of [source or cause], [uncertain event] may occur, resulting in [effect on the objective].

If the examination platform’s only hosting region becomes unavailable, scheduled assessments may be disrupted and course completion could be delayed.

Output, Owner, and Evidence

The output is an initial list of clearly described risks, causes, consequences, controls, assumptions, and knowledge gaps. This information is usually documented in a Risk Register.

The person responsible for the process or risk still owns the responsibility. Facilitators can run the session, and subject experts can explain how the work is carried out.

Useful records may include workshop notes, interview notes, process maps, audit results, incident reports, and approved risk statements.

Step 2: Risk Analysis

Risk analysis looks at a known risk and works out how serious it could be. It considers what could cause the risk, how likely it is to happen, what the outcome might be, and how well the existing controls work.

Main Activities

The analysis should examine:

• What could cause the risk.
• How likely it is to happen.
• What could go wrong.
• When and how badly it could affect the organization.
• Controls already in place.
• How well those controls are designed and working.
• Links between different risks.
• Information that is not available.
• Assumptions and areas of uncertainty.

Risk Likelihood and Impact may be expressed through descriptions, numerical ratings, probabilities, financial estimates, or a combination of methods.

Basic Risk Formula

A common semi-quantitative formula is:

ISO 31000 does not require this formula. The result provides a starting point for discussion, not an automatic decision.

Types of Assessment Methods

The selected Risk Assessment Methodology should fit the objective, available evidence, complexity, and importance of the decision.

Inherent, Residual, and Target Risk

• Inherent risk: The amount of risk present when no safeguards are applied.
• Residual risk: The amount left after existing safeguards are taken into account.
• Target risk: The acceptable level expected once the planned changes are completed.

The assessment may use earlier incident reports, control test findings, cost details, performance data, calculations, and practical input from staff who carry out the work.

Step 3: Risk Evaluation

Risk Evaluation checks the analyzed risk against the agreed limits and priorities agreed on before the assessment starts.

The evaluator should:

1. 1. Review what the risk analysis found.
2. 2. Compare the risk with the agreed limits.
3. 3. Check relevant legal and contract obligations.
4. 4. Consider concerns raised by stakeholders.
5. 5. Identify effects that may reach other parts of the organization.
6. 6. Decide whether the risk needs another review.
7. 7. Choose whether to accept the risk, escalate it, or treat it as a higher priority.
8. 8. Record the reason behind the decision.

The correct decision-maker depends on the nature of the risk. Process managers may approve routine operational exposure. Senior leaders may need to approve strategic, legal, safety-related, or high-value risks.

Why Scores Are Not Enough

A risk score does not always show the full picture, for example:

• Likelihood 5 × consequence 2 = 10
• Likelihood 2 × consequence 5 = 10

Both risks have the same score, but the situations are quite different. The second case may be less likely to occur, but its impact on safety, legal compliance, or daily operations could be much more serious, so the score should be used as a guide rather than the final basis for a decision, with the actual situation, possible impact, and professional judgment also taken into account.

Inputs, Activities, Outputs, Owners, and Evidence

Worked Example, Assessment Template, and Practical Execution

A practical example shows how the different assessment stages fit together

Assessment Objective

Maintain access to an online examination platform during scheduled assessments.

Identification Findings

Backups protect stored information, but they do not restore immediate platform availability when the active region becomes unavailable.

Evaluation Decision

The expected downtime is above the approved limit, so the risk should not be left unchanged. A serious outage could interrupt exams, cause problems for learners, delay services, and damage the organization’s reputation.

The assessment recommends:

• Adding service capacity in another region
• Testing regional failover
• Assigning an infrastructure manager as owner
• Reviewing the findings after major platform changes

These actions belong to Risk Treatment, which begins after the assessment decision.

Practical Assessment Template

Professionals responsible for conducting assessments also need to understand how risk criteria, evidence, ownership, and treatment decisions work together. ISO 31000 Risk Manager training can provide structured practice in applying these activities across projects, operations, compliance, and organizational decision-making. 

Roles in Practical Execution

• Assessment sponsor: Approves the purpose and scope
• Facilitator: Organizes meetings and guides the method
• Process owner: Supplies operational knowledge
• Risk owner: Remains accountable for the exposure
• Control owner: Explains and tests controls
• Decision-maker: Approves acceptance or escalation
• Subject specialist: Provides technical, legal, financial, or safety knowledge

Who Should Use the ISO 31000 Risk Management Framework? It can support businesses, government bodies, nonprofit organizations, project teams, healthcare providers, financial institutions, manufacturers, technology teams, and educational organizations. The assessment should be scaled according to the complexity and importance of the decision.

Evidence, Treatment, Monitoring, and Common Mistakes

Assessment record should show what evidence was reviewed, how each rating was decided, who approved the result, and when the risk will be reviewed again.

Evidence Checklist

The records can include:

• Why the assessment was performed.
• What the assessment covers.
• The scales used to rate likelihood and impact.
• Names of those who took part.
• Important points discussed.
• Details of earlier incidents.
• Past performance information.
• Controls already in place.
• Control test results.
• Reasons for the ratings.
• Any calculations used.
• Assumptions made.
• Missing or uncertain information.
• Approval and escalation decisions.
• The next review date.

ISO 31000 does not ask every organization to keep identical records, level of detail should match the size, difficulty, and possible impact of the risk.

Moving From Assessment to Action

Assessment findings may lead to acceptance, escalation, further study, or Risk Treatment. Possible treatment decisions include:

• Avoiding the activity
• Removing the source
• Changing the likelihood
• Reducing the consequences
• Sharing the exposure
• Retaining it through an informed decision
• Increasing exposure to pursue an opportunity

Treatment is connected to assessment but remains outside its three core stages.

Monitoring and Reassessment

Risk Monitoring and Review checks whether anything has changed that could affect the risk, such as the operating context, assumptions, controls, or level of exposure.

A new assessment may be needed after:

• An incident occurs
• A control stops working as expected
• A new legal or regulatory requirement takes effect
• A supplier or service provider changes
• A major system update
• A change in objectives
• A new project stage
• Significant new information

This connection supports consistent ISO 31000 Implementation without reducing the assessment to an annual paperwork exercise. 

A consistent assessment process depends on clear criteria, reliable evidence, and regular review. SterlingNext risk management learning supports a broader understanding of risk across projects, operations, compliance, and organizational decisions.

Common Assessment Mistakes

1. 1. Starting Without a Clear Objective: A risk assessment needs a defined purpose so the risk can be understood and judged against the right criteria.
2. 2. Using Vague Statements: Terms such as “cyberattack” or “supplier issue” give little useful detail about what could happen, why it could happen, or what the result might be.
3. 3. Copying Generic Criteria: A scoring scale taken from another organization may not fit the risks, priorities, or working conditions of the current organization.
4. 4. Changing Criteria After Scoring: Adjusting thresholds after seeing the scores can affect the ranking and lead to the wrong priorities.
5. 5. Treating Every Risk as Negative: Focusing only on threats can cause useful opportunities to be missed.
6. 6. Assuming Controls Work: Having a control documented does not mean it works properly in practice or is applied consistently.
7. 7. Depending Only on Scores: A number does not always show the full picture, especially when legal, safety, financial, or strategic issues are involved.
8. 8. Ignoring Connected Risks: Risks can have common causes or trigger other problems, creating wider effects across the organization.
9. 9. Hiding Uncertainty: Gaps in information, assumptions, and areas of doubt should be clearly noted rather than left unexplained.
10. 10. Providing Findings Without Evidence: Ratings need supporting information so the reasoning can be checked, approved, and justified.

Conclusion

The ISO 31000 Risk Assessment Process helps organizations understand uncertainty and make better decisions by defining the purpose and scope, setting suitable criteria, involving people who know the work, and collecting reliable information. The process identifies what could happen, examines how likely it is and what effect it may have, then compares the result with the agreed criteria to decide whether the risk needs treatment, escalation, acceptance, or further review. Keeping the evidence, calculations, assumptions, and reasons for each decision clear also makes ISO 31000 Risk Management easier to apply in projects, routine operations, and business planning.