Fundamental principles and concepts of risk management
This domain tests whether you understand what ISO 31000:2018 means by risk, why the principles exist, and how they shape decisions. Expect definition-level questions plus scenario items that ask which principle is being applied or violated.
Core rules
- Risk is the effect of uncertainty on objectives. The effect is a deviation from what is expected and can be positive or negative. An opportunity is therefore a risk.
- Uncertainty is a deficiency of information related to understanding or knowledge of an event, its consequence or likelihood.
- The purpose of risk management is value creation and protection - not merely loss prevention.
- The eight principles: integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, continual improvement.
- Principles are not optional decoration: each one changes how the framework and process are designed. For example, “inclusive” requires timely involvement of stakeholders, and “dynamic” requires revisiting risk as context changes.
- Risk management is proportionate to the organization’s context, not a fixed checklist.
Worked example
A logistics firm wants to bid for a cold-chain contract. The bid team treats the new contract only as an opportunity and does not record downside risks. The risk manager points out that under ISO 31000, risk is the effect of uncertainty on objectives and includes positive deviation; the opportunity and its threats must both be analysed against the objective of profitable service delivery. Because the principle “best available information” applies, the team uses historical spoilage data and customer demand forecasts, and records the assumptions and limitations of that data. This is not box-ticking: it changes the decision criteria and the treatment plan.
Traps that cost marks
- Defining risk as “probability × impact” - ISO 31000 does not define risk that way.
- Treating risk as only negative.
- Confusing the principles with the framework or process steps.
- Ignoring that communication and consultation is continuous, not a single launch meeting.