ISO 31000 Risk Management Training and Gap Assessment
ISO 31000 risk management training and independent gap assessment against the standard's principles, framework and process. ISO 31000 is not certifiable.
ISO 31000 is the international standard giving principles and guidelines for risk management, and itmad provides ISO 31000 training and independent gap assessment. The standard applies to risk of any type in any organisation, and it is designed to be built into decision-making and not run as a separate exercise. itmad operates across the Middle East, Asia and Europe.
Why there is no ISO 31000 certification
ISO 31000 offers guidance and not auditable requirements. ISO itself states that the standard is not intended for certification, and no certificate issued against it carries recognised accreditation. itmad does not offer ISO 31000 certification, and any offer of one should be treated with caution. What itmad provides instead is training and independent gap assessment, which is what the standard is built to support.
The training
The course covers the principles of risk management and the vocabulary of ISO Guide 73, and the framework of leadership, integration, design, implementation, evaluation and improvement. It covers the process of scope and context, risk identification, analysis, evaluation and treatment, and risk assessment techniques drawn from IEC 31010. Delegates also learn how to build and maintain a risk register that is used and not filed, how to set risk criteria and a risk appetite that management will actually apply, and how to monitor, review, record and report.
The gap assessment
The gap assessment is an independent review of an organisation's existing risk management arrangements against the principles, framework and process of ISO 31000. The report states where practice aligns with the standard, where it does not and what would need to change, with findings prioritised so that the significant gaps are addressed first. The output is a benchmark and an improvement plan, not a certificate, and it is deliberately described that way.
How it supports certified management systems
ISO 9001, ISO 14001, ISO 45001, ISO 27001 and ISO 22301 all require risk-based thinking, but none of them explains how to do it, and ISO 31000 is the reference that they point toward. Organisations whose auditors have raised weak risk assessment as a finding usually need this material and not more management system documentation.
Online learning
ITMAD Academy offers self-paced online courses that can be taken from anywhere, across management system and accreditation standards, with certificates issued on completion and online verification.
Frequently asked questions
Can an organisation be certified to ISO 31000?
No. ISO 31000 provides guidance and not auditable requirements, and ISO states that it is not intended for certification. No certificate issued against it carries recognised accreditation, and itmad does not offer one.
What does ISO 31000 training cover?
The principles of risk management and the vocabulary of ISO Guide 73, the framework, and the process of identification, analysis, evaluation and treatment. It also covers techniques from IEC 31010, building a risk register that is used, and setting risk criteria and appetite.
What is an ISO 31000 gap assessment?
An independent review of an organisation's existing risk management arrangements against the principles, framework and process of ISO 31000. It produces a report on where practice aligns, where it does not and what must change, with the significant gaps prioritised.
What do you receive from a gap assessment?
A benchmark and an improvement plan, not a certificate. The report is deliberately described that way, because ISO 31000 is not certifiable.
How does ISO 31000 relate to ISO 9001 and ISO 27001?
ISO 9001, ISO 14001, ISO 45001, ISO 27001 and ISO 22301 all require risk-based thinking without explaining how to do it. ISO 31000 is the reference they point toward.
When is this training most useful?
Where auditors have raised weak risk assessment as a finding. Such organisations usually need this material and not more management system documentation.