Digital Lexicon Hub

An international guideline for integrating risk management principles, a framework and a process into organizational governance and decision-making.

It gives leaders a common, adaptable approach for making uncertainty explicit in strategy, operations, projects and investment decisions.

An organization defines risk criteria for an automation program, identifies and analyzes operational, security and compliance risks, selects treatments, assigns owners and reviews residual risk at governance meetings.

ISO 31000 provides guidelines rather than certifiable requirements. Applying the vocabulary or maintaining a risk register does not demonstrate effective risk management without leadership, integration and evidence-based review.

The standard describes principles for effective risk management, a leadership and governance framework, and a process covering communication, scope and context, risk assessment, treatment, monitoring, review, recording and reporting. Its guidance can be tailored to an organization's context.