Risk management with ISO 31000: a starter framework
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.
Most small suppliers already manage risk. They do it in their heads, in email threads, and in the memory of one experienced person. ISO 31000 gives you a structure to write that down so it survives staff turnover and answers the risk questions that now appear in tenders. This guide covers what the standard says, how to build a register you will keep updated, and how ComplyTrain supports ISO 31000 risk management.
What ISO 31000 is, and what it is not
ISO 31000 is a guidance standard for risk management. You do not certify against it. There is no auditor who awards an ISO 31000 certificate, so any vendor claiming one is misreading the standard. It exists to give organisations a common vocabulary and a repeatable process.
The standard rests on a few principles. Risk management should be integrated into how you run the business, not bolted on. It should be structured, so two people running the same process reach comparable results. It should use the best information you have, and it should be reviewed as conditions change. None of this requires a large team. It requires a habit.
The core process in four steps
Strip ISO 31000 down and you get a loop you can run in a monthly meeting. First, establish context: what does the business do, and what are you trying to protect? Second, identify risks: what could go wrong that affects delivery, quality, or your customers. Third, analyse and evaluate: how likely is each risk, how bad is the impact, and which ones cross your tolerance line. Fourth, treat the risks you cannot accept, then monitor and review the whole set on a schedule.
The trap is building something too heavy. A twelve-column register with quantitative scoring models looks impressive and gets abandoned by month three. Start smaller.
A lightweight risk register you can maintain
For a small supplier, one table is enough. Give each row an ID, a short risk description, the affected area, a likelihood rating, an impact rating, a combined priority, the current controls, the planned treatment, and an owner. Use three levels for likelihood and impact, such as low, medium, and high. Three levels are defensible and quick to agree on. Five levels invite arguments that add no value.
Review the register on a fixed cadence, monthly or quarterly, and log the review date. A register with review dates shows a working process. A register last touched two years ago shows the opposite, and an assessor will notice.
Managing ISO 31000 risk in ComplyTrain
ComplyTrain supports ISO 31000 risk management directly. The risk register lives in one place, not across spreadsheets and inboxes. Each entry carries an ID, a description, likelihood and impact ratings, a priority, current controls, a treatment plan, and a named owner. This matches the fields the four-step process produces, so the record and the method stay in step.
The platform runs the review cadence for you. You set a monthly or quarterly schedule, and ComplyTrain prompts the owner when a review is due and logs the date it happens. That log is the evidence an assessor asks for: a register that moves on a known schedule, with people attached to each line. When conditions change, you update the entry and the history records what changed and when.
ComplyTrain is broader than any single standard. It gives your risk work a fixed home alongside your other compliance records, so the register is not a stranded document but part of how you run the business. That is the integration ISO 31000 asks for, in practice rather than principle.
How risk connects to ISO 9001
ISO 9001 asks you to address risks and opportunities as part of your quality management system. It does not prescribe ISO 31000, but the two fit together cleanly. Your ISO 9001 processes define what you do, and your risk register records what could stop those processes from working. When you plan changes or set quality objectives, the register is your evidence that you considered what might go wrong.
If you are building a QMS from scratch, our overview at /standards/iso-9001 explains where risk sits within the wider requirements.
Why tenders now ask about risk
Buyers in regulated and public-sector markets increasingly ask suppliers to describe their risk management approach. They are checking that you will not fail mid-contract and leave them exposed. A maintained register, a named owner, and a review schedule answer most of these questions directly. You do not need to overstate anything. You need a real process and the records to show it runs.
Keeping the register current is the hard part, and that is where tooling helps.
Where ComplyTrain fits
ComplyTrain gives your risk register a fixed home with review dates and owners, and connects risk to the rest of your compliance records, on EU hosting in AWS eu-central-1 (Frankfurt). To see the register, the review cadence, and the standards mapping in one place, read the product detail at /product/qms.