Framework

ISO 31000:2018

ISO 31000:2018 Risk Management (principles/framework/process)

22 requirements · 11 connected unified controls

Open ISO 31000:2018 in the map

Version: 2018
Published: 2018-02
Amendments: none

Requirements and control mappings

“Full” and “Partial” describe the catalog mapping to a unified control. A partial mapping includes the remaining requirement. These mappings do not establish an organization’s implementation or certification.

Principles

Requirement	Unified control and mapping
31000-P1Integrated	UC-RISK-02 — Integrate risk management into enterprise processes and projectsFull
31000-P2Structured and comprehensive	UC-RISK-03 — Define risk appetite, tolerance, and risk assessment criteriaFull
31000-P3Customized	UC-RISK-01 — Establish and maintain a tailored risk management frameworkFull
31000-P4Inclusive	UC-RISK-05 — Communicate and consult with stakeholders on riskFull
31000-P5Dynamic	UC-RISK-11 — Assess changes that could significantly affect risk and controlFull
31000-P6Best available information	UC-RISK-07 — Identify and analyze risks and opportunities to objectivesFull
31000-P7Human and cultural factors	UC-RISK-05 — Communicate and consult with stakeholders on riskFull
31000-P8Continual improvement	UC-RISK-15 — Continually improve the risk management programFull

Framework

Requirement	Unified control and mapping
31000-FW1Leadership and commitment	UC-RISK-01 — Establish and maintain a tailored risk management frameworkFull
31000-FW2Integration	UC-RISK-02 — Integrate risk management into enterprise processes and projectsFull
31000-FW3Design	UC-RISK-01 — Establish and maintain a tailored risk management frameworkFull
31000-FW4Implementation	UC-RISK-01 — Establish and maintain a tailored risk management frameworkFull
31000-FW5Evaluation	UC-RISK-13 — Monitor and review risk management performanceFull
31000-FW6Improvement	UC-RISK-15 — Continually improve the risk management programFull

Process

Requirement	Unified control and mapping
31000-PR1Communication and consultation	UC-RISK-05 — Communicate and consult with stakeholders on riskFull
31000-PR2Scope, context and criteria	UC-RISK-03 — Define risk appetite, tolerance, and risk assessment criteriaFull
31000-PR3Risk assessment: risk identification	UC-RISK-07 — Identify and analyze risks and opportunities to objectivesFull
31000-PR4Risk assessment: risk analysis	UC-RISK-07 — Identify and analyze risks and opportunities to objectivesFull
31000-PR5Risk assessment: risk evaluation	UC-RISK-08 — Evaluate and prioritize risks against risk criteriaFull
31000-PR6Risk treatment	UC-RISK-09 — Select, plan, and implement risk treatmentsFull
31000-PR7Monitoring and review	UC-RISK-13 — Monitor and review risk management performanceFull
31000-PR8Recording and reporting	UC-RISK-10 — Maintain a risk register and report the portfolio viewFull