ISO 31000 RM common mistakes
ISO 31000 RM · Understand the traps and how to avoid them.
Defining risk as 'the probability of a negative event occurring' or as 'likelihood multiplied by consequence', and rejecting answer options that describe risk as having positive effects.
Everyday language and most legacy enterprise risk practice frame risk as loss avoidance; candidates answer from workplace habit rather than from the Standard's wording, and the word 'uncertainty' feels too abstract to select.
What to do instead
Memorise the exact ISO 31000:2018 definition - 'risk is the effect of uncertainty on objectives' - and drill its three implications: the effect is a deviation from what is expected (not automatically bad), it can be positive or negative, and risk only exists relative to stated objectives. On any item, first ask 'what objective is in play here?' before choosing.
Selecting options that say an organisation can be certified or audited against ISO 31000, or that the Standard requires a specific risk matrix, risk register template, or scoring scale.
ISO 31000 sits alongside certifiable standards such as ISO 9001 and ISO 27001 on training lists, so candidates assume the same conformity regime applies, and they import tooling from their own organisation's practice.
What to do instead
Anchor on the fact that ISO 31000 provides guidelines and principles for managing risk; it is not intended for certification, contractual or regulatory use, and it prescribes no specific techniques, tools or risk-scoring arithmetic. When an option names a mandatory template or a 'shall', treat it as a distractor unless the item is about the framework's general components.
Using 'risk criteria', 'risk appetite' and 'risk tolerance' interchangeably, or stating that risk criteria must be set once at the outset and then fixed for the life of the process.
The three terms appear in adjacent text and are all 'levels of risk' language, so recall blurs them; and because criteria are established during scope-setting, candidates freeze them at that step and miss the requirement to revisit them.
What to do instead
Separate them explicitly: risk criteria are the terms of reference used to evaluate the significance of risk (the test); risk appetite is the amount and type of risk an organisation is willing to pursue or retain (the preference); tolerance is the practical bandwidth around that appetite. Note also that criteria are established early but may be revised throughout, and evaluation is the sub-step that compares analysed risk against them.
Listing the framework components in the same order as the process steps, or describing 'design' as the drafting of a risk policy document and 'implementation' as the roll-out of a process flowchart.
Both diagrams live on facing pages of the Standard and share overlapping vocabulary ('communication', 'monitoring', 'improvement'), so candidates merge the two structures into one sequence they can recite.
What to do instead
Practise drawing them as three separate pictures and naming each layer aloud: principles (why risk management matters), framework (leadership and commitment, integration, design, implementation, evaluation, improvement), process (communication and consultation; scope, context and criteria; risk assessment - identification, analysis, evaluation; risk treatment; monitoring and review; recording and reporting). Use the presence of 'leadership' as the tell that the item is about the framework, and 'assessment sub-steps' as the tell that it is about the process.
Describing the risk management framework as a documented manual, a policy binder, or an IT risk system, and choosing options that define it as written procedures.
In practice the visible artefact of a framework is a document, so candidates equate the artefact with the concept, and audit-oriented training reinforces 'if it isn't written down it doesn't exist'.
What to do instead
Recall the definition as a set of components that provide the foundations and arrangements for designing, implementing, monitoring, reviewing and continually improving risk management across the organisation - arrangements includes governance, accountability, resources and authority, not just documents. Documentation may support the framework but is not the framework.
Choosing options where risk management is delegated to a dedicated risk function, treated as an add-on project or parallel activity, or implemented once as a project with an end date.
Standalone risk teams are common in mature organisations, and 'leverage the risk function to implement it' sounds like a reasonable answer, so candidates miss that the principle is that risk management is integrated into all activities and is part of decision-making and governance.
What to do instead
Whenever a domain-2 item mentions ownership or embedding, ask whether the option makes risk management everyone's responsibility across all levels and functions, embedded in governance, strategy, planning and reporting. Reject options that isolate it in a specialist unit, a separate process, a one-off project, or a 'check-the-box' annual exercise.
Placing communication and consultation at the start of the process only, monitoring and review at the end, and omitting communication and consultation from the stages of treatment and monitoring.
Process diagrams are conventionally drawn left to right, so candidates read ISO 31000's process as a linear pipeline and lose the feedback loops shown in the source figure.
What to do instead
Learn these three as continuous, iterative activities that run through every stage: communication and consultation (bringing stakeholders into identification, analysis, evaluation and treatment), monitoring and review (detecting change in context, criteria and risk), and recording and reporting. If an option confines them to a single stage, it is wrong.
Mixing up the three risk assessment sub-steps - for example saying risk evaluation is where consequences and likelihood are estimated, or risk analysis is where risks are prioritised against criteria to decide whether treatment is needed.
The three terms sound like a single 'assess the risk' activity and in practice most organisations do them in one meeting, so candidates choose whichever label feels familiar rather than matching the activity to the sub-step.
What to do instead
Memorise the through-line: identification finds, recognises and describes risks including sources, events, consequences and likelihood; analysis comprehends the nature and characteristics of the risk and its level, considering uncertainty and controls; evaluation compares analysis results with risk criteria to support decisions on whether and how much treatment is needed. Match each verb in a question stem ('estimate', 'compare', 'discover') to one sub-step.
Answering treatment items with the classic four-option taxonomy (avoid, reduce, transfer, accept) and assuming treatment is complete once an option is chosen, without acknowledging that treatment can create new risks.
The 4T model is ubiquitous in business continuity and insurance training, so it crowds out the Standard's own list of treatment options and its iterative framing.
What to do instead
Use the ISO 31000:2018 option set: avoiding the risk, taking or increasing the risk to pursue an opportunity, removing the risk source, changing the likelihood, changing the consequences, sharing the risk, and retaining the risk by informed decision. Add the two habits the exam tests: selecting options considers values, perceptions and resources and balances costs against benefits, and treated risk is re-assessed because treatment can introduce new risks.
Skipping scope, context and criteria as 'preliminary set-up', or treating recording and reporting as an optional documentation step to be done after the process finishes.
These steps produce no risk list and no mitigation action, so they feel administrative, and candidates under time pressure gravitate to the stages that sound like real risk work.
What to do instead
Learn scope, context and criteria as the stage that defines the organisation's objectives, external and internal context, the risk criteria, and the boundaries of the risk management process - without it, analysis and evaluation have no yardstick. Learn recording and reporting as an ongoing stage that documents the process and its outcomes and shares information with stakeholders, supporting accountability at all levels. Treat 'we'll document it later' and 'criteria can be settled once risks are known' as automatic distractors.