Risk management with ISO 31000: a starter framework
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.
ISO
ISO management system standards
Quality and security teams running an ISO-based management system, and suppliers whose customers require one.
The ISO standards behind a management system, and how they divide: a few you can be certified against, and many more that are guidance or control sets supporting them. Knowing which is which decides what you can claim.
What it is
The distinction that decides what you can claim
ISO publishes tens of thousands of standards, and the ones a compliance team meets fall into two groups that are constantly confused. A small number are management system standards: they state requirements, and an accredited certification body can audit you against them and issue a certificate. The rest are guidance, codes of practice or control sets. They are just as useful, and you cannot be certified to them.
Getting this wrong is expensive in a tender. A supplier that writes "ISO 31000 certified" on a bid has told the evaluator something that cannot be true, because ISO 31000 is guidance and has no certification scheme. The same trap catches ISO 27002 and ISO 27005.
Quality
ISO 9001 is the quality management system standard, and the one most contracts mean when they ask for "a quality system". It is certifiable, and it is also the foundation the defence world builds on: AQAP 2110 contains its requirements and adds NATO's on top.
Information security
One certifiable standard, surrounded by publications that make it workable:
- ISO 27001 - the information security management system. This is the certifiable one; everything below supports it.
- ISO 27002 - the control set behind an ISO 27001 certificate: what each control actually means in practice.
- ISO 27005 - guidance for the information security risk assessment that ISO 27001 clauses 6.1.2 and 6.1.3 require you to do.
- ISO 27017 - cloud-specific controls, and the shared-responsibility boundary between you and your provider.
- ISO 27018 - protection of personal data processed in the cloud.
ISO 27017 and ISO 27018 are codes of practice rather than separate certifications. You are certified against ISO 27001; those two extend the control set and can be brought inside that certificate's scope.
Risk
ISO 31000 is the international guidance for managing risk of any kind, and it is deliberately not certifiable. Its value is a common vocabulary and a defensible process, which is what an auditor is looking for when they ask how you decided something was acceptable.
How ISO fits with the defence standards
If you supply defence, ISO 9001 is rarely the whole ask. The AQAP publications build on it: AQAP 2110 contains the ISO 9001 requirements and adds configuration management, government quality assurance and contract risk, while AQAP 2310 does the same with EN 9100. So an ISO 9001 system is the foundation you would build either way, and the defence work is the delta on top.
Not the standard you were looking for?
ComplyTrain is not limited to the standards written up on this site. The product is built around a requirement tree, and a requirement tree can be built for any standard, agreement or contractual specification that has requirements in it - ISO 13485, ISO 14001, ISO 45001, IEC 62443, EN 9100 and the rest included. The pages here are what we have documented so far, not the boundary of what the system handles.
We add standards on request, and the list grows steadily. If the standard your customer or contract requires is not here, tell us which one you need and we will tell you what supporting it in your workspace involves.
How we help
How ComplyTrain helps you run an ISO management system
Most teams end up holding more than one of these at once - a quality system, a security system and a risk framework - and the overlap between them is where the duplicated effort lives:
- The ISO 9001-structured quality system: audits, findings, corrective action to closure - Quality Management
- Each standard's requirements as a tracked set, traced to the evidence that satisfies it, so one piece of evidence can answer several standards at once - Requirements Management
- Manuals, procedures and documented information under revision control with sign-off - Document Control
- A risk register on a consistent, calibrated scale, which is what ISO 31000 asks for and what ISO 27001 clause 6.1 needs - Risk Management
- Competence records that prove understanding rather than attendance - Training Management
Because the requirement tree is the product's core rather than a per-standard feature, a standard we have not written a page for is a content job, not an engineering one. Ask, and it can be added.
ComplyTrain holds no ISO certification of its own and does not claim one. It is the system you build and run your own management system in, and where the evidence for your certificate lives.
Request access to this standard
Tell us how you need to work with ISO and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Questions
Which ISO standards can you actually be certified against?
Of the ones covered here, ISO 9001 and ISO 27001. They state requirements, and an accredited certification body audits you against them. ISO 27002, ISO 27005, ISO 27017, ISO 27018 and ISO 31000 are guidance, codes of practice or control sets: they support a certification without being one. Claiming certification to any of those on a bid is a claim an evaluator can disprove.
Can we be certified to ISO 27017 or ISO 27018?
Not as standalone certificates. They are codes of practice that extend the ISO 27002 control set for cloud services and for personal data in the cloud. The certificate you hold is ISO 27001, and those controls can be brought inside its scope.
Is ISO 31000 certifiable?
No, and deliberately so. ISO 31000 is guidance for managing risk, not a set of auditable requirements. What it gives you is a common vocabulary and a defensible process - which is what an auditor is really asking for when they want to know how you concluded a risk was acceptable.
How does ISO 9001 relate to AQAP 2110?
AQAP 2110 contains the requirements of ISO 9001 and adds NATO's on top: configuration management, government quality assurance, risk to contract performance and the customer's right of access. So an ISO 9001 system is the foundation, and the AQAP work is the delta. AQAP 2310 does the same thing with EN 9100 for aviation and space.
The ISO standard we need is not listed here. Can you support it?
Yes. The pages on this site are the standards documented so far, not the limit of what the product handles - ComplyTrain is built around a requirement tree, and one can be built for any standard with requirements in it, ISO 13485, ISO 14001, ISO 45001 and IEC 62443 included. We add standards on request. Tell us which one you need and we will explain what supporting it in your workspace involves.
Implementation
Running more than one ISO standard without doing the work twice
The overlap between a quality system, a security system and a risk framework is where most of the duplicated effort hides.
Separate the certifiable from the supporting
Know which of your standards can carry a certificate and which cannot. It decides what you may write on a bid, and what an auditor will actually ask to see.
Hold each standard as a requirement set
Not as a manual. A tracked set is countable, and gaps are visible before somebody else finds them.
Let one piece of evidence answer several standards
Access control, supplier assessment and competence records appear in more than one standard. Traced properly, the same record satisfies each without being rewritten.
Keep the risk assessment defensible
A consistent, calibrated scale with the reasoning recorded is what ISO 31000 describes and what ISO 27001 clause 6.1 expects to see.
If you need to get there and have no quality function
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
Gap assessment
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversGuided implementation
Our consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksFull-service quality function
We run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service means
Official sources
The primary sources behind this page. Where a standard is quoted here, the publisher's own page is the authority.
What ComplyTrain does
One system for the whole compliance programme. Start with the module you need most.
Forms & Follow-up
Collect information the same way every time, and decide in advance what happens next.
Controls & Assurance
Know whether your controls are operating, not just whether a policy says they exist.
Project Planner
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Product Compliance
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Reporting & Analytics
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
Media Monitoring
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
Grants & Tenders
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
Stakeholder/Vendor Management
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
Requirements Management
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Risk Management
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Training Management
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Document Control
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Quality Management
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Latest from ComplyTrain
ISO 9001:2026: what changed from 2015, and what to do now
ISO 9001:2026 was published in September 2026. What changed from the 2015 edition, the transition deadlines, and a practical checklist for your next audit.
Compliance for two-person defence suppliers: where to start
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.