- ISO 31000:2018 provides guidelines for managing risk in any organisation, and its process starts with establishing the context and ends with monitoring and reporting.
- A good risk register writes each risk as one sentence: a cause that leads to an event with an impact.
- The attached template is ready to use and calculates the risk score and rating automatically from likelihood and impact.
Every organisation manages risk one way or another. The difference between an organisation that is surprised by crises and one that prepares for them is a living risk register: written, updated, and discussed in management meetings. This article explains how to build that register under ISO 31000, with a ready-to-use template at the end.
What is ISO 31000?
ISO 31000:2018 is an international standard that provides guidelines for managing risk in any organisation, whatever its size or sector. It has three parts: the principles of risk management, a framework for integrating it into governance and management, and a practical risk management process.
It is a guidance standard, not a requirements standard. Organisations cannot be certified to it, but they use it as the reference for building their frameworks, and many national and sector regulations in the Gulf build on it.
The risk management process
- 1Scope and contextObjectives and risk criteria
- 2Identify risksCause → event → impact
- 3AnalyseLikelihood × impact
- 4EvaluateCompare the score with criteria
- 5TreatAvoid, reduce, transfer, accept
- 6Monitor and reportRegular review, register updated
The process starts by setting the scope, context and risk criteria, then assesses risk in three steps: identification, analysis and evaluation. Treatment follows, then monitoring and review. Throughout, the organisation communicates with stakeholders and records results, and that is where the risk register comes in.
How do you write a risk correctly?
The most common mistake in risk registers is writing a risk as one word, such as “cybersecurity” or “human resources”. Those are areas, not risks. The correct wording links three parts in one sentence:
Because of [cause], [event] may occur, leading to [impact on objectives].
Example: “Because we rely on a single provider for the online payment system, the system may be down for an extended period, disrupting fee collection and increasing complaints.”
This wording immediately shows where treatment should go: at the cause to reduce likelihood, or at the impact to reduce harm.
Analysing risk with the matrix
For each risk, the organisation rates likelihood and impact from 1 to 5, and the risk score is their product. The score is then grouped into levels that set priority.
The key is to write a clear definition for each number. An impact of “5” might mean a critical service down for more than two days, or a financial loss above a set limit. Without these definitions every manager scores in their own way, and the matrix loses its meaning.
Risk register columns
The attached template includes the columns most organisations need:
| Column | What to write |
|---|---|
| Risk ID and category | A unique code and the risk area (operational, financial, technology, compliance…) |
| Risk description | Cause → event → impact |
| Risk owner | The manager with authority |
| Existing controls | What is actually in place today |
| Likelihood and impact | 1 to 5 for each |
| Score and rating | Calculated automatically in the template |
| Treatment plan | The action, its owner and deadline |
| Residual risk | Expected level after treatment |
| Status and review date | Open, in progress, closed |
Treatment options
Each risk has four basic options: avoid it by stopping the activity that causes it, reduce it with controls that lower likelihood or impact, transfer it through insurance or contracts, or accept it if the score is within tolerance or treatment costs more than the impact. Acceptance is a documented decision by someone with authority, not neglect.
How do you keep the register alive?
- Clear ownership: every risk has an owner who answers for it in meetings.
- Regular review: high and critical risks monthly, the full register quarterly.
- Link to decisions: critical risks go to top management with their treatment plans.
- Update on change: a new project, a new system, or an incident all call for a register review.
Conclusion
A risk register is not a file prepared once for an audit and then forgotten. Write risks correctly, define your scales clearly, give every risk an owner, and review it regularly. Start from the attached template and adapt it to your organisation.
Frequently asked questions
Can you be certified to ISO 31000?
No. ISO 31000 provides guidelines rather than requirements, so there is no certification of conformity, but organisations use it to build their risk management frameworks.
What is the difference between inherent and residual risk?
Inherent risk is the level before controls or with current controls; residual risk is the expected level after the treatment plan is implemented.
How often should the risk register be reviewed?
High and critical risks at least monthly, the full register quarterly, and whenever there is a major change in the organisation or its environment.
Who owns a risk?
The manager with authority over the related activity, not the risk department. The risk function coordinates and follows up.
References
- International Organization for Standardization (ISO). ISO 31000 Risk management (2018)
- ISO. ISO 31000:2018 Risk management — Guidelines (2018)
- PECB. ISO 31000:2018 Risk Management Guidelines (white paper)
Recommended programmes
