ISO 31000 Principles, Framework, and Process

Why ISO 31000 Matters for the CRMA Candidate

The Certification in Risk Management Assurance (CRMA) tests your ability to evaluate and advise on an organization's risk management activities. To do that credibly, you need a reference point for what good risk management looks like. ISO 31000 is one of the two globally recognized benchmarks (the other being the COSO Enterprise Risk Management framework), and it is the one most frequently adopted outside North America and in the public sector.

For the exam, ISO 31000 is important for three reasons:
1. It provides the vocabulary of risk management that question writers use: risk, risk source, risk criteria, risk treatment, residual risk, and so on.
2. It gives internal auditors a structured set of criteria against which to assess the design and effectiveness of a risk management program, which is the core of the CRMA domain on risk management governance.
3. It is principles-based rather than prescriptive, which means exam questions will test your judgment about how the standard should be applied, not just rote recall of its parts.

In practice, an internal auditor performing a risk management assurance engagement will often map the organization's activities against the ISO 31000 structure to identify gaps in governance, leadership commitment, integration, or process maturity.

What ISO 31000 Is

ISO 31000 is an international standard published by the International Organization for Standardization. The current edition is ISO 31000:2018, titled Risk management – Guidelines. Key characteristics you must remember:

• It is guidance, not a certifiable standard. Organizations cannot be certified to ISO 31000 the way they can to ISO 9001 or ISO 27001. Exam questions sometimes try to trap you on this point.
• It is generic and universal. It applies to any organization regardless of size, sector, or type of risk, and to any activity, including decision-making at all levels.
• It defines risk as the effect of uncertainty on objectives. The effect may be positive, negative, or both. This definition deliberately includes opportunity, not just downside threat.
• It is built on three interlocking components: Principles, Framework, and Process. Understanding how these fit together is the single most important thing for the exam.

The relationship can be summarized this way: the Principles describe what effective risk management should be like (the foundation and the purpose). The Framework describes how risk management is governed and embedded in the organization (the structure). The Process describes the activities performed to actually manage risk (the operations). The 2018 revision streamlined all three and placed value creation and protection at the center of the principles and leadership and commitment at the center of the framework.

Component 1: The Principles

ISO 31000:2018 states that the purpose of risk management is the creation and protection of value. Surrounding this purpose are eight principles that characterize effective risk management. A useful way to remember them is that they describe how risk management should behave:

1. Integrated – Risk management is an integral part of all organizational activities, not a separate function or an afterthought.
2. Structured and comprehensive – A systematic approach contributes to consistent and comparable results.
3. Customized – The framework and process are tailored to the organization's external and internal context and its objectives.
4. Inclusive – Appropriate and timely involvement of stakeholders enables their knowledge, views, and perceptions to be considered, leading to improved awareness and informed risk management.
5. Dynamic – Risks emerge, change, or disappear as context shifts; risk management anticipates, detects, acknowledges, and responds to change in a timely manner.
6. Best available information – Inputs are based on historical and current information and future expectations, while explicitly taking into account limitations and uncertainties in that information.
7. Human and cultural factors – Human behavior and culture significantly influence all aspects of risk management at every level and stage.
8. Continual improvement – Risk management is continually improved through learning and experience.

Exam note: The 2009 edition had eleven principles. The 2018 edition consolidated them to eight. If a question lists items such as creates and protects value or part of decision making as principles, it is drawing on the older version. In the 2018 edition, value creation and protection is the purpose, and being part of decision-making is absorbed into the Integrated principle.

Component 2: The Framework

The framework exists to help the organization integrate risk management into significant activities and functions. Its effectiveness depends on integration into governance and all activities, including decision-making. The framework is a continuous cycle with Leadership and Commitment at its center, surrounded by five components:

Leadership and Commitment (the center) – Top management and oversight bodies must ensure risk management is integrated into all activities. This includes customizing and implementing the framework components, issuing a policy or statement that establishes the risk management approach, allocating resources, assigning authority and accountability, and aligning risk management with strategy, objectives, and culture. Oversight bodies are specifically expected to ensure risks are adequately considered when setting objectives, understand the risks facing the organization, and ensure systems to manage those risks are implemented and operating effectively.

Integration – Risk management should be part of, and not separate from, the organizational purpose, governance, leadership and commitment, strategy, objectives, and operations. Everyone in the organization has responsibility for managing risk. Governance guides the organization's course; risk management is part of that governance.

Design – This involves understanding the organization and its context (external and internal), articulating risk management commitment (often through a policy), assigning organizational roles, authorities, responsibilities, and accountabilities, allocating resources (people, skills, methods, tools, information systems, training), and establishing communication and consultation mechanisms.

Implementation – Developing an appropriate plan including time and resources, identifying where, when, and how different types of decisions are made and by whom, modifying decision-making processes where necessary, and ensuring the organization's arrangements for managing risk are clearly understood and practiced.

Evaluation – Periodically measuring framework performance against its purpose, implementation plans, indicators, and expected behavior, and determining whether it remains suitable to support achieving objectives.

Improvement – Continually monitoring and adapting the framework to address external and internal changes, and developing plans and tasks to improve risk management. The framework is a Plan-Do-Check-Act style loop: Design, Implementation, Evaluation, Improvement, all anchored by Integration and Leadership.

CRMA relevance: When assessing the framework, internal audit looks for evidence such as a board-approved risk management policy, a defined risk appetite, clear ownership of risks, documented roles and accountabilities, adequate resourcing of the risk function, and periodic board-level review of the framework's effectiveness.

Component 3: The Process

The risk management process involves the systematic application of policies, procedures, and practices to a set of activities. It should be an integral part of management and decision-making and can be applied at strategic, operational, program, or project levels. The process consists of the following elements:

Communication and Consultation – This runs throughout the entire process, not as a single step. Communication seeks to promote awareness and understanding of risk; consultation seeks to obtain feedback and information to support decision-making. It brings different areas of expertise together, ensures different views are considered, provides sufficient information for oversight, and builds a sense of inclusiveness and ownership.

Scope, Context, and Criteria – The organization defines the scope of its risk management activities, establishes the external and internal context (the environment in which it seeks to achieve objectives), and defines risk criteria. Risk criteria specify the amount and type of risk the organization may or may not take relative to objectives, and how significance will be evaluated. Criteria should reflect values, objectives, resources, and obligations, and should be aligned with the risk management framework and customized to the specific purpose and scope of the activity. This step is where risk appetite and tolerance translate into measurable criteria.

Risk Assessment – This is the overall process of three sub-steps:
• Risk Identification – Finding, recognizing, and describing risks that might help or prevent the organization from achieving its objectives. Factors to consider include tangible and intangible sources, causes and events, threats and opportunities, vulnerabilities and capabilities, changes in context, indicators of emerging risks, nature and value of assets, consequences, knowledge limitations, time-related factors, and assumptions or biases. Identification should capture risks whether or not their sources are under the organization's control.
• Risk Analysis – Comprehending the nature of risk and its characteristics, including the level of risk. Analysis considers likelihood, consequences, event scenarios, complexity and connectivity, time-related factors and volatility, effectiveness of existing controls, and sensitivity and confidence levels. It can be qualitative, quantitative, or a combination. The 2018 standard explicitly notes that highly uncertain events can be difficult to quantify and that analysis should account for divergent opinions, biases, and limitations of information.
• Risk Evaluation – Comparing the results of analysis with the established risk criteria to determine where additional action is required. Possible decisions include doing nothing further, considering treatment options, undertaking further analysis, maintaining existing controls, or reconsidering objectives. Evaluation outcomes should be recorded, communicated, and validated at appropriate levels.

Risk Treatment – Selecting and implementing options for addressing risk. This is an iterative process: formulate and select options, plan and implement treatment, assess effectiveness, decide whether residual risk is acceptable, and if not, take further treatment. The standard lists treatment options that are not mutually exclusive:
• Avoiding the risk by deciding not to start or continue the activity.
• Taking or increasing the risk in order to pursue an opportunity.
• Removing the risk source.
• Changing the likelihood.
• Changing the consequences.
• Sharing the risk (for example through contracts or insurance).
• Retaining the risk by informed decision.
Treatment plans should specify the rationale, who is accountable, proposed actions, resources required, performance measures, constraints, reporting and monitoring requirements, and timing. Note that treatment can itself introduce new risks, which must be managed.

Monitoring and Review – This also occurs throughout the process. Its purpose is to assure and improve the quality and effectiveness of process design, implementation, and outcomes. It includes planning, gathering and analyzing information, recording results, and providing feedback. Results feed into performance management, measurement, and reporting.

Recording and Reporting – The process and its outcomes should be documented and reported to communicate activities and outcomes across the organization, provide information for decision-making, improve risk management activities, and assist interaction with stakeholders, including those with responsibility and accountability for risk management. Decisions about what to record and report should consider use, sensitivity, and the external and internal context.

How the Three Components Work Together

Think of the architecture as a set of nested loops. The Principles sit at the top as design criteria: any framework or process the organization builds should be integrated, structured, customized, inclusive, dynamic, informed, culturally aware, and continually improving. The Framework is the governance envelope: leadership commits, integrates risk management into the organization, designs the arrangements, implements them, evaluates them, and improves them. Within that envelope, the Process runs continuously at every level: set scope and criteria, assess risks, treat them, monitor, record, and report, with communication and consultation woven through every step.

An organization can fail at any layer. It might have an excellent process documented in a manual but no leadership commitment, so the framework is hollow. It might have strong leadership but a process that is not customized to its context, violating a core principle. Internal audit's job under the CRMA body of knowledge is to detect these disconnects.

ISO 31000 Versus COSO ERM: A Common Exam Comparison

Questions may ask you to distinguish the two. Key contrasts:
• ISO 31000 is shorter, principles-based, and applicable to any organization or activity; COSO ERM (2017) is more detailed and oriented toward enterprise strategy and performance.
• ISO 31000 is structured as Principles, Framework, Process; COSO ERM 2017 is structured as five components and twenty principles (Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication, and Reporting).
• Both define risk in terms of uncertainty affecting objectives, both emphasize integration with strategy and decision-making, and both are non-certifiable guidance.
• ISO 31000 explicitly uses the term risk treatment; COSO uses risk response. Watch for terminology cues that signal which framework a question is based on.

The Internal Auditor's Role Relative to ISO 31000

The CRMA emphasizes that internal audit provides independent assurance over risk management rather than owning it. Using ISO 31000 as criteria, an auditor might evaluate:
• Whether the board and senior management demonstrate leadership and commitment (policy, appetite, resources, tone).
• Whether risk management is integrated into strategic planning, budgeting, project approval, and performance management.
• Whether risk criteria are defined, documented, and consistently applied.
• Whether risk identification is comprehensive and includes emerging risks and opportunities.
• Whether analysis considers control effectiveness and reflects best available information.
• Whether treatment plans have owners, timelines, and measures, and whether residual risk is explicitly accepted at the right level.
• Whether monitoring, review, recording, and reporting actually occur and inform decisions.
• Whether the framework itself is periodically evaluated and improved.

Internal audit must avoid taking on management responsibilities such as setting risk appetite, deciding on risk responses, or owning risks. It may facilitate workshops or coordinate reporting as consulting activities, but with appropriate safeguards to independence.

Exam Tips: Answering Questions on ISO 31000 Principles, Framework, and Process

Tip 1: Classify the item first. When a question names a concept, immediately ask yourself whether it is a Principle, a Framework component, or a Process step. Integrated is a Principle. Integration is a Framework component. Communication and consultation is a Process element. Many distractors work by placing a term in the wrong layer.

Tip 2: Know what sits at the center. Value creation and protection is the center of the Principles. Leadership and commitment is the center of the Framework. If a question asks what is foundational or central, those are the answers.

Tip 3: Remember the count. Eight principles, five framework components plus the leadership center, and a process with assessment broken into identification, analysis, and evaluation. If an answer choice lists eleven principles, it reflects the 2009 version and is likely a distractor on a current exam.

Tip 4: Treat communication and consultation, and monitoring and review, as continuous. They are not single sequential steps. A question asking which process element occurs throughout all other steps is pointing to one of these two.

Tip 5: Distinguish analysis from evaluation. Analysis determines the level of risk (likelihood, consequence, control effectiveness). Evaluation compares that level against the risk criteria to decide whether action is needed. If the question mentions comparing to criteria or deciding on acceptability, the answer is evaluation, not analysis.

Tip 6: Know that risk includes upside. ISO 31000 defines risk as the effect of uncertainty on objectives, which can be positive or negative. An answer that limits risk to negative outcomes is incomplete under ISO 31000. Also recall that one treatment option is deliberately taking or increasing risk to pursue an opportunity.

Tip 7: Treatment options are not mutually exclusive. An organization may share part of a risk, reduce the likelihood of another part, and retain the remainder. If a question implies that only one option can be chosen, be skeptical.

Tip 8: Watch for the certification trap. ISO 31000 provides guidelines; it is not intended for certification purposes. Any answer suggesting an organization can be certified compliant with ISO 31000 is incorrect.

Tip 9: Apply the principles to scenarios. Scenario questions often describe a dysfunction and ask which principle is violated. A risk register updated only once a year violates Dynamic. A one-size-fits-all framework copied from another company violates Customized. A risk function operating in isolation from the business violates Integrated. Excluding frontline staff from identification violates Inclusive. Ignoring data limitations violates Best available information.

Tip 10: Keep internal audit in its lane. When a question asks what internal audit should do regarding risk management, the correct answer is almost always to provide assurance or advice, never to set appetite, own risks, or implement treatments. Use ISO 31000 as assessment criteria, not as a mandate for internal audit to run the process.

Tip 11: Use terminology as a clue. If a question uses risk treatment, risk criteria, or scope, context and criteria, it is framed in ISO 31000 language. If it uses risk response, components and principles, or strategy and objective-setting, it is COSO ERM language. Answer within the framework the question invokes.

Tip 12: Prefer the governance-oriented answer. ISO 31000:2018 repeatedly stresses that risk management is part of governance and decision-making at all levels. When choosing among plausible options, the one that connects risk management to objectives, decisions, and leadership accountability is usually the best answer.

Quick Review Summary

Purpose: creation and protection of value.
Eight Principles: Integrated; Structured and comprehensive; Customized; Inclusive; Dynamic; Best available information; Human and cultural factors; Continual improvement.
Framework: Leadership and commitment at the center; Integration; Design; Implementation; Evaluation; Improvement.
Process: Communication and consultation (throughout); Scope, context, and criteria; Risk assessment (identification, analysis, evaluation); Risk treatment; Monitoring and review (throughout); Recording and reporting.
Risk definition: effect of uncertainty on objectives, positive or negative.
Nature of the standard: guidelines, universally applicable, not certifiable.
Internal audit's role: independent assurance and advice, using ISO 31000 as criteria, without assuming management responsibility.

Master these relationships, practice classifying terms into the correct layer, and apply the principles to scenarios, and you will be well prepared for every ISO 31000 question the CRMA exam presents.