ISO 31000 risk management assessment, from $800

What the ISO 31000 assessment covers

ISO 31000:2018 gives guidelines on managing risk. It applies to any organization and any type of risk, whether strategic, operational, financial, legal, reputational or related to safety, and it is used by companies, public bodies and not-for-profit organizations as the reference for how risk management should work.

The guidelines are built on three parts. The principles describe what effective risk management looks like, for example integrated, structured, customized, inclusive and based on the best available information. The framework describes how risk management is built into governance and decision making, with leadership commitment. The process describes the steps: establishing scope and context, risk assessment, risk treatment, monitoring and review, communication and recording.

Our assessment compares your organization with all three parts and reports where you are strong, where practice falls short of the guidelines and what would make the biggest difference.

• Review of risk policy, governance and roles
• Assessment of the risk process from context to treatment and monitoring
• Sample review of risk registers and decisions informed by risk
• Interviews with leadership and risk owners
• Written assessment report with findings, maturity view and recommendations

The assessment is tailored to your size. A small company with a simple risk register is assessed against what is proportionate for it, while a large group is assessed on how risk management works across units and at board level.

Assessment, not certification: what that means for you

ISO 31000 states that it is not intended for certification, so we assess against it rather than certify. What we offer is an independent assessment, with a report and a statement of the result.

The assessment is still valuable. Boards, regulators, lenders and insurers often want an independent view of risk management, and a structured comparison with the international guidelines gives them one. Internally, the report gives you a prioritized improvement plan.

If you need a certifiable standard that uses risk-based thinking, consider the management system standards that build on it: ISO 22301 for business continuity, ISO/IEC 27001 for information security, ISO 37301 for compliance or ISO 9001 for quality. Many organizations use ISO 31000 as the common risk method across all of them.

The statement we issue describes exactly what was assessed, against which edition of the guidelines and with what result, so readers understand what it does and does not say.

What decides the price

An ISO 31000 assessment with EUROTECH starts at $800. Time depends on the breadth of risk management to be assessed.

• Size of the organization and number of business units
• Scope: enterprise-wide risk management or a specific area
• Number of risk owners to interview
• Depth: overview assessment or detailed sampling of risk files
• Sites and whether interviews are online or in person

We confirm days and every fee in a written quote. A current risk register and recent board risk reports are the most useful documents to share in advance.

Organizations that want a deeper review of specific areas, such as project risk, supplier risk or information risk, can add them to the scope, which increases the days needed for sampling and interviews.

We can also assess a single business unit first and extend the scope later.