ISO 31000 Certification: What Is Possible, and How to Show Your Risk Management Works
ISO 31000 is the international standard for managing risk across an organization. It is a set of guidelines, so it cannot be certified by any accredited certification body. What you can get is an independent ISO 31000 alignment assessment, and accredited certification to the management system standards your risk work supports. Accredify Global offers both. You get a tailored proposal after a free scoping review.
What Is ISO 31000, and Can It Be Certified?
ISO 31000 is the international standard that gives principles, a framework, and a process for managing risk of any kind. It uses the word "should," not "shall," because it is guidance rather than requirements. That is why ISO 31000 cannot be certified: there are no requirements for an auditor to check conformity against. Any certificate that claims to certify it is not accredited.
That does not make it less useful. Boards, regulators, and rating agencies often name these guidelines as the expected approach to enterprise risk management. They want to see it applied, not a certificate on the wall.
Accredify Global offers two honest routes. We run an independent alignment assessment against the guidelines and report what we find. We also certify the management system standards that contain risk requirements, so your risk approach is tested inside an accredited audit.
The 2018 Edition and the Third Edition in Development
ISO 31000:2018 is the current edition. ISO published it in February 2018, replacing the 2009 edition. It is shorter, more strategic, and puts leadership and integration into governance at its center.
A third edition is being drafted. The committee draft was registered in December 2025 and its comment period closed on 1 March 2026. It must still pass enquiry and approval stages, so publication is some time away.
It will still be guidance. The draft keeps the title Risk management — Guidelines, so the new edition will not become a requirements standard. Plan on using certified management systems to show your risk approach in action.
Sources: ISO 31000:2018 (ISO) · ISO/CD 31000 (ISO)
ISO 31000 Certification Alternatives That Hold Up
What you can show, who issues it, and when each option fits.
| Option | What you receive | When it fits |
|---|---|---|
| ISO 31000 alignment assessment | An independent written report on your principles, framework, and process | Board assurance, investor or regulator requests |
| ISO 22301 certification | Accredited certificate for business continuity | Operational resilience and disruption risk |
| ISO 27001 certification | Accredited certificate for information security | Cyber and data risk |
| ISO 9001 certification | Accredited certificate for quality management | Risk-based thinking in operations |
| ISO 45001 certification | Accredited certificate for health and safety | Hazard and safety risk |
| ISO 37001 certification | Certificate for anti-bribery management | Integrity and compliance risk |
ISO 37001 is within our UAF accreditation scope. An alignment assessment report is not a certificate and is never presented as one.
You will still see offers of an "ISO 31000 certificate" online. These certificates are not issued under accreditation, so customers, auditors, and regulators can reject them. A certification body that issues them also risks its reputation for impartiality. Our trust and impartiality page explains how we keep assessment and certification separate and honest.
The Principles, Framework, and Process of the Standard
The three parts of the standard, and what an assessment looks for in each.
| Part | What the guidelines describe | What we look for |
|---|---|---|
| Principles | Integrated, structured, customized, inclusive, dynamic, informed, human-aware, and improving | Risk work that changes real decisions |
| Leadership and integration | Board oversight and risk built into governance | Risk on board and committee agendas |
| Design and implementation | Roles, resources, criteria, and communication | Clear risk appetite and named owners |
| Assessment | Identification, analysis, and evaluation of risk | Risks ranked with consistent criteria |
| Treatment | Selecting and carrying out risk responses | Actions with owners, dates, and follow-up |
| Monitoring, review, and reporting | Checking that controls work and reporting results | Key risk indicators and reports used by leaders |
The most common weakness is a risk register that nobody uses. An assessment traces a few major decisions, such as an acquisition, a new product, or a capital project. It then checks whether risk information shaped them. If it did, the framework is working; if not, the report shows where it breaks down.
How It Compares: COSO ERM, IEC 31010, ISO 27005, and ISO 14971
The risk standards and frameworks organizations most often mix together.
| Framework | Focus | Certifiable? |
|---|---|---|
| ISO 31000 | Enterprise-wide risk management guidelines | No |
| COSO ERM | Enterprise risk linked to strategy and performance | No |
| IEC 31010 | Risk assessment techniques such as FMEA and bow-tie | No |
| ISO/IEC 27005 | Information security risk management guidance | No, but supports ISO 27001, which is |
| ISO 14971 | Risk management for medical devices | Assessed within ISO 13485 and regulatory reviews |
| ISO 22301 | Business continuity requirements | Yes |
You do not have to choose one framework. Many organizations use the international guidelines for language and process, borrow COSO's link between risk and strategy, and use IEC 31010 techniques for detailed analysis. What matters to an assessor is that one consistent method runs from the board's risk appetite down to the controls in each certified management system.
How an Alignment Assessment Works
Independent, evidence-based, and reported in plain language. It can run alongside a certification audit.
Preparing for a board review, a regulator visit, or a rating? Tell us the date in your scoping review.
Book a free scoping reviewISO 31000 Assessment Cost and Timeline
There is no price list. The days your scope needs set one tailored proposal.
What sets the assessment days
- Units: business units and subsidiaries in scope
- Sites: locations where interviews take place
- Risks: categories such as strategic, financial, and operational
- Evidence: how organized your records are
- Combination: alongside a certification audit or alone
How long it takes
| Proposal | Days after scoping |
|---|---|
| Assessment | Usually a few weeks |
| Report | After the closing meeting |
| Repeat | Often yearly, before board review |
If you are also planning a certification audit, ask for both in one proposal. The same interviews and records often serve the alignment assessment and the audit, which cuts time for your managers. The report and the certificate stay separate documents, so each one means exactly what it says.
Questions to Ask Anyone Offering ISO 31000 Certification
Simple checks that protect you from paying for a certificate with no standing.
| Question | What a good answer looks like |
|---|---|
| Is the certificate accredited? | It cannot be. A provider that says yes is misleading you. |
| What exactly will we receive? | A clearly labeled assessment report, not a certificate. |
| Who carries out the work? | Assessors independent of anyone who built your framework. |
| Can it link to certification? | Yes, through ISO 22301, 27001, 9001, or 45001. |
| Can others verify our certificates? | Yes. Ours appear on our verification page. |
| How is it priced? | Assessment days in writing, in a tailored proposal. |
Frequently Asked Questions About ISO 31000 Certification
Straight answers on certification, principles, COSO, cost, and timeline.
Can ISO 31000 be certified?
No. ISO 31000 is a guidelines standard, so it contains recommendations rather than requirements. No accredited certification body can issue an ISO 31000 certificate. Any certificate claiming to certify it is not accredited.
What is ISO 31000?
ISO 31000 is the international standard that gives principles, a framework and a process for managing risk. Any organization can use it, whatever its size, sector or type of risk.
What is the current version of ISO 31000?
ISO 31000:2018, published in February 2018, is the current edition. A third edition is being drafted; its committee draft closed for comment on 1 March 2026.
What can Accredify Global provide?
We run an independent alignment assessment and give you a written report on how your risk practice compares with the guidelines. We also certify management system standards that require risk-based controls, such as ISO 9001, 27001, 22301 and 45001.
Is an alignment assessment report the same as a certificate?
No. It is an independent opinion on alignment, useful for boards, regulators and investors. It is not an accredited certificate, and we do not present it as one.
What are the eight principles of ISO 31000?
Risk management should be integrated, structured and comprehensive, customized, and inclusive. It should also be dynamic, use the best available information, take account of human and cultural factors, and improve continually.
What is the risk management process in the standard?
Communication and consultation; scope, context and criteria; risk assessment, which covers identification, analysis and evaluation; risk treatment; monitoring and review; and recording and reporting.
How is the standard different from COSO ERM?
Both describe enterprise risk management. COSO's framework is widely used in the US and links closely to internal control and financial reporting. The ISO standard is international, shorter and sector-neutral. Many organizations use ideas from both.
How does it relate to ISO 27001 or ISO 45001?
Those standards include specific risk requirements and can be certified. The guidelines give the wider approach that can sit above them, so one risk method serves every management system.
What is IEC 31010?
IEC 31010 describes techniques for assessing risk, such as bow-tie analysis, FMEA and scenario analysis. It supports the risk management guidelines and is also guidance, not a certifiable standard.
Can individuals get certified in risk management?
Some training providers certify people as risk managers based on the guidelines. That is personal training certification, not certification of an organization.
Who uses the standard?
Boards, risk committees, internal auditors and risk managers in banks, insurers, public bodies, healthcare, energy, mining and many other sectors.
How long does an alignment assessment take?
Most assessments take a few weeks, depending on the size of the organization, the number of business units and how much evidence is available.
How much does an alignment assessment cost?
The cost follows the assessment days your scope needs. Business units, sites, risk categories and interviews set the days. A free scoping review gives you a tailored proposal.
Does Accredify Global write our risk framework?
No. We assess independently and report what we find. Your team, or a consultant you choose, designs and improves the framework.
Show Your Board That Risk Management Really Works
Tell us about your organization, your risk framework, and what you need to show. We'll recommend the right mix of assessment and certification.
Book your free scoping review →Last reviewed by the Accredify Global certification team.