You’ve been asked to “get ISO 31000 in place”. A few workshops later, there’s a thick risk register, a heat map and a slide deck. Then nothing changes. Decisions are still made on gut feel, the register gathers dust, and at the next review everyone is surprised the risks haven’t shifted.
We see this pattern a lot. Risk management is meant to improve choices, not generate paperwork. Here are the common mistakes organisations make with ISO 31000—and how to avoid them.
A familiar trap: treating ISO 31000 as a document, not a discipline
In one audit last quarter, a services business proudly showed us a 400-line register. It was accurate, well-formatted and unused. Project managers didn’t open it, and leaders made investment calls without reference to it. The issue wasn’t effort; it was focus. ISO 31000 expects a living process built into planning and decisions, not a standalone artefact.
- Start with decisions: list the key choices you make (budgeting, product release, supplier selection) and make risk part of those routines.
- Keep outputs short: a single-page risk profile for each decision beats a sprawling central register no one reads.
Common mistakes that derail ISO 31000
No clear risk criteria or appetite
Without agreed risk criteria and a plain-English risk appetite, heat maps become opinion polls. One manager’s “high” is another’s “moderate”.
- Define what “low, medium, high” mean for impact and likelihood with numbers or thresholds relevant to your context.
- Express appetite per category (e.g. zero tolerance for safety breaches, measured flexibility for delivery delay) to guide trade-offs.
- Test criteria against real cases and refine until they drive consistent scoring.
Overcomplicating the method
We often see fancy scoring models, Monte Carlo add-ons and a dozen risk categories. Impressive, until no one uses them under pressure.
- Choose the simplest method that works for your size and maturity; you can add sophistication later.
- Limit categories to what you manage (e.g. strategic, financial, operational, compliance, information), not an encyclopaedia.
- Write a two-page procedure that any manager can follow without a workshop.
Weak ownership and accountability
Risks sit in a register with no named risk owner, or the owner can’t influence the controls. Result: drift.
- Assign a single owner per risk who has authority over controls and budget.
- Record clear actions, deadlines and measures for each treatment plan.
- Report slippage the same way you report missed KPIs—openly and promptly.
Not integrating with core processes
Risk workshops once a year won’t change behaviour if day-to-day processes ignore them.
- Embed risk prompts in planning templates, business cases and project gates.
- Make change control (new suppliers, systems, products) trigger a risk review by default.
- Link risk controls to existing systems (quality procedures, H&S controls, information security) rather than creating duplicates.
Focusing only on threats, not opportunities
ISO 31000 is clear: manage the effect of uncertainty on objectives—good and bad. Many organisations ignore upside risk entirely.
- Ask explicitly: “What could go better than planned, and how would we capitalise?”
- Capture opportunities with owners, triggers and early indicators, not just a hopeful note.
- Balance your reports: threats and opportunities side-by-side.
Static risk registers with no feedback loop
Risk plans are agreed and then vanish into the ether. Three months later, controls haven’t changed and risk levels are identical.
- Set review cycles by risk level (e.g. monthly for “high”, quarterly for “medium”).
- Use a small set of leading indicators (KRIs) to track movement, not just lagging incidents.
- Hold short, focused reviews that challenge assumptions and close actions.
Culture and communication left behind
If risk is seen as a compliance tick, people are reluctant to raise concerns or share near misses.
- Leaders should talk openly about uncertainty in town halls and team meetings.
- Make it safe to surface issues early; thank people who flag emerging risks.
- Close the loop: communicate outcomes of risk reviews and what changed.
Make ISO 31000 work in your context
A technology start-up and a housing provider both face uncertainty, but their criteria, appetite and controls will differ. Tailor the framework consciously.
- Define the scope and context: objectives, stakeholders, obligations and constraints that shape your risk picture.
- Write plain-language risk criteria with examples (e.g. what a “major” customer impact looks like for you).
- Map where risk fits today: planning, procurement, engineering, H&S, finance, information security—then integrate the prompts and outputs.
One manufacturer we assessed replaced a monolithic register with three concise risk views: enterprise, projects and suppliers. Each used the same criteria but lived in the tools people already used—board packs, project dashboards and vendor scorecards. Engagement went up because it felt relevant.
Keep it alive: monitoring, review and learning
ISO 31000 expects continual improvement. That means evidence that you learn and adapt, not just maintain a list.
- Set a small number of KRIs for key risks (e.g. overdue maintenance, churn in critical roles, supplier OTIF) and trend them.
- Use management review to examine top risks, treatment effectiveness and resourcing decisions.
- Run short post-incident and post-project reviews to update risk causes, controls and scenarios.
- Plan internal audits that sample both design (is the framework sound?) and operation (is it used?).
Make reporting visual and brief. A single page showing risk movement, actions due and emerging issues will be read; a fifteen-page pack won’t.
What certification or assurance looks like
ISO 31000 is guidance rather than a certifiable standard. Some organisations still ask for external assurance against it—usually to give their board or stakeholders confidence. That can take the form of a gap assessment, a statement of conformity or an integrated audit alongside other standards. If you’re weighing what people call ISO 31000 certification, understand it typically means independent evaluation of alignment and effectiveness, not accredited certification.
- Be clear on your goal: internal improvement, stakeholder assurance or both.
- Ask for evidence-based findings that prioritise actions, not just a score.
- Align timing with planning cycles so assurance informs real decisions.
Getting started—or resetting your approach
If your risk register feels stale, don’t bin everything. A focused reset works.
- Identify three priority decisions in the next quarter and build risk into those.
- Refresh your risk criteria and appetite with the executive team in one working session.
- Assign owners to the top ten risks with clear actions and dates.
- Introduce two or three KRIs and review them monthly.
- Schedule a short internal audit in three months to test what’s changed.
Done consistently, this moves risk management from the shelf to the table where decisions are made.
If you’d like an honest view of your current risk framework and how it supports your certification aims, speak to UKCTL. We’re happy to discuss what good looks like for your organisation and the practical steps to get there.