Platform
Modules
By sector
By sector
By standard
Blog
News
Company
Events
Standards · Risk management
ISO 31000 and the IEC 31010 techniques, and what each sector calls the same process: ISO/IEC 27005, ISO 14971, ICH Q9, NIST, COSO, FMEA and HAZOP. Explained in plain words, in one catalogue, with every entry linked to its source.
Overview
Four things to know before the detail. The sector standards differ in vocabulary and in the record they require, not in the process.
Context, identification, analysis, evaluation, treatment, monitoring and review. Guidance, not a certificate: an auditor looks for the process running and its records.
FMEA, HAZOP, bow-tie, fault and event trees, Monte Carlo and FAIR, with a table of which fits which step. The most used ones have method standards of their own.
ISO/IEC 27005 for security, ISO 14971 for devices, ICH Q9 for pharma, NIST RMF and COSO for systems and the enterprise, risk-based thinking for ISO 9001 and AQAP 2110.
Every one of them ends in a record: the risk, its owner, the analysis, the treatment, the residual risk and the review date. Search the catalogue below for yours.
Every management-system standard on this site asks you to manage risk, and every sector has its own standard for how. ISO 9001 and AQAP 2110 call it risk-based thinking. Information security has ISO/IEC 27005 and the NIST Risk Management Framework. Medical devices have ISO 14971, pharma has ICH Q9, corporate governance has COSO, and the safety disciplines have functional safety and process hazard analysis. They are one process wearing different names, and the standard that describes the process itself is ISO 31000. This page explains that process, the techniques it draws on, what each sector adds, and where the documents come from. The explorer below then finds the ones that apply to you.
ISO 31000, in its 2018 edition, is guidance on managing risk of any kind. It sets out principles, a framework for putting risk management into an organisation's governance, and the process itself: establish the scope, the context and the criteria; identify what can happen and how; analyse likelihood and consequence; evaluate against the criteria; treat the risk by avoiding, reducing, sharing or accepting it; and monitor, review, record and report. It cannot be certified against, deliberately. What an auditor or an inspector looks for is the process running and its records, and every sector standard below is that process with its own vocabulary and its own required outputs. See ISO 31000.
IEC 31010 is the companion catalogue of techniques, around forty of them, with a table of which suit which step. Some elicit views: brainstorming, structured interviews, the Delphi method. Some identify: checklists, hazard and operability studies, structured what-if analysis, scenario analysis. Some analyse: failure modes and effects analysis with or without criticality, fault tree and event tree analysis, bow-tie analysis, Bayesian networks, Markov analysis, Monte Carlo simulation. Some evaluate: as low as reasonably practicable, cost-benefit analysis, risk matrices. The most used ones have method standards of their own. IEC 60812 is the standard for FMEA and FMECA, the technique behind design and process reliability work. IEC 61882 is the standard for HAZOP, the structured team study of deviations in a process design that the chemical and pharmaceutical industries run. IEC 61508 is functional safety, the safety life cycle and the safety integrity levels that the sector standards for machinery, rail, automotive and process plants derive from.
In quality management, ISO 9001 asks for risk-based thinking in planning the system and its processes, and AQAP 2110 makes it a requirement: a defence supplier identifies and manages risk across the contract and the customer may ask to see the analysis. In information security, ISO/IEC 27005 describes the assessment and treatment ISO/IEC 27001 requires, NIST SP 800-30 describes an assessment and SP 800-37 the seven-step framework that ties categorisation, control selection, assessment and authorisation together, and FAIR quantifies cyber risk in loss frequency and loss magnitude instead of colours. For medical devices, ISO 14971 runs the process over hazards, hazardous situations and harm, requires risk control and a benefit-risk judgement, and continues through production and post-production; every design decision in the technical file traces back to it. In pharma, ICH Q9 is quality risk management, revised in 2023 to say how formal the process should be and how to keep subjectivity out of it, and its annex lists the same techniques IEC 31010 does. In corporate governance, the COSO framework integrates enterprise risk with strategy and performance and is what a board and an external auditor recognise. Business continuity, ISO 22301, is the same process pointed at disruption, with a business impact analysis in place of the hazard list. And the newest name is AI: ISO/IEC 23894 and the NIST AI Risk Management Framework apply the process to artificial intelligence systems, and the EU AI Act makes a risk management system mandatory for the high-risk ones. See ISO/IEC 27005, and the defence, cybersecurity and pharma and medical device pages for the sector standards themselves.
Whatever the sector calls it, the process ends in a record, and the record is what an auditor, an inspector, a notified body or a customer reads. A risk register holds each risk, its owner, the analysis in whatever scale the standard prescribes, the treatment chosen, the residual risk after it, and when it was last reviewed. A medical device's risk management file, an information security risk treatment plan, a defence contract's risk analysis and a pharmaceutical quality risk assessment are the same register with different columns. The review history matters as much as the entries: a register that was written once and never touched shows a process that ran once.
ISO 31000, IEC 31010, ISO 14971 and ISO/IEC 27005 are bought from ISO, IEC or your national standards body, and the IEC method standards likewise. Every NIST publication, including SP 800-30, SP 800-37 and the AI Risk Management Framework, is free from NIST. ICH Q9 is free from ICH, the Open FAIR standard from The Open Group with registration, and the COSO framework is bought from COSO. Every entry in the explorer below links to its source.
Not this page, and not us. The management-system standard you hold names the risk process it expects, the contract names the standard, and the regulation names the file. What the explorer can do is show you the whole map: search it by name, browse it by family, or answer four questions about where your requirement comes from and see which standards and techniques companies like you are commonly asked about. Each entry links to its source, to its ComplyTrain page where one exists, and otherwise to a request. ComplyTrain holds a standard as a requirement tree with the evidence against each requirement, and a risk register is one of the records it keeps.
Standards explorer
Search ISO 31000 and IEC 31010, the method standards, the sector risk standards and the frameworks together, browse them by family, or answer four questions about where your requirement comes from.
Nothing matches that. Try a number, a code, or browse by family.
Which risk standard applies to you is set by the management-system standard you hold, the contract that names it and the regulation that requires the file. Treat this as a map, not a verdict.
Four questions, pick everything that applies. Nothing is stored.
The standards and techniques companies like you are commonly asked about. Confirm against your management system and your contract.
Which risk standard applies to you is set by the management-system standard you hold, the contract that names it and the regulation that requires the file. Treat this as a map, not a verdict.
Each page sets out what the standard asks of you and how a ComplyTrain workspace is organised around it. The catalogue above holds far more than these, and any entry in it can be requested. Adding a standard to a workspace is usually a matter of days, not a project.
ISO 31000
ISO 31000 is the international guidance for managing risk. ComplyTrain’s risk management is structured around its process, so risk is a living framework across the organisation, not a spreadsheet reviewed once a year.
ISO 27005
ISO 27005 is the guidance for managing information security risk - the assessment and treatment that ISO 27001 requires but does not describe. ComplyTrain runs it as a living register, not an annual document.
A standard usually arrives as a contract condition or a regulator's letter rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract or your regulator cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the audit or the inspection.
How an engagement worksWe run and maintain the system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansNo. ISO 31000 is guidance, written so that it cannot be used for certification, and a certificate that claims otherwise is not worth the paper. What is certified is the management system that uses the process, ISO 9001, ISO/IEC 27001 or ISO 13485, and the auditor checks that the risk process the system requires is running and recorded. See ISO 31000.
One process, and as many views of it as your standards require. A company that holds ISO 9001 and ISO/IEC 27001 and makes a medical device has quality risks, information security risks and a device risk management file, each with the columns its standard prescribes, and an auditor for one will not want to read the others. Keeping them in one system with one method and one review cadence is what makes that manageable.
The one that fits the question and that your standard or your customer expects. FMEA is for the failure modes of a design or a process and is what a reliability engineer or a device notified body expects to see. HAZOP is for deviations in a process design and is standard in chemical and pharmaceutical plants. Bow-tie is for showing barriers between causes and consequences and reads well for management. Quantitative methods such as FAIR and Monte Carlo are for when a number is needed, in cyber risk and in finance. IEC 31010 has the full table.
A hazard is a source of potential harm; a risk is the combination of how likely the harm is and how severe. ISO 14971 adds a third term, the hazardous situation, the circumstance in which people are exposed to the hazard, and asks you to estimate the risk of each one. Most of the vocabulary differences between sector standards are of this kind: the same process, with the steps named more or less finely.
No. Certification is issued by an accredited certification body, a licence by your authority, and government quality assurance is exercised by the acquisition authority. ComplyTrain is the system you build, run and evidence your compliance in, and Skylen's consultants can take you through the work. The certificate stays yours to earn.
Yes, and that is what the Request access button on every entry is for. Tell us which standard and where the requirement comes from, and we come back to you on what holding it in your workspace involves, usually within one business day. Adding a standard to a workspace is usually a matter of days, not a project. ComplyTrain holds a standard as a requirement tree with your evidence against each requirement, and the tree is what we build.