01 · 1990s
Integrated risk precedents
National standards and enterprise practice began joining safety, financial and operational risk into common decision processes.
ASSURANCE DNA · RISK MANAGEMENT
ISO 31000
Principles, framework and process for making decisions under uncertainty while protecting and creating value.
Which uncertainties change the decision, who owns them and what treatment preserves value?
REFERENCEISO 31000:2018CURRENT STATE · 21 AUG 2026Published guidance, not a certifiable requirements standard. Its principles and process can be integrated into governance and decision-making.BID ENTRYSense · Qualify · Capture · Map · Assemble · Model · Story · Comply · Review · Negotiate · BAFO · Measure
ISO 31000 is guidance and is not certifiable. It does not require one scoring matrix, eliminate uncertainty or replace accountable judgement. Source-bounded interpretation: no certification, protected text reproduction or award prediction.
LIVING EXPERIMENT · TERRAIN
The Uncertainty Terrain
Assumptions create elevation, dependencies create passes and controls create traversable routes. The instrument never collapses uncertainty into one reassuring score.
MODEL STATESME · SENSE · APPLYDeterministic teaching model · no award prediction
ORIGIN × EVOLUTION × CURRENT PRACTICE
Why this reference exists—and what changed.
Any organisation making material commercial, operational, safety, technology or investment decisions under uncertainty.
02 · 2009
First ISO 31000 edition
ISO published common principles and a framework and process intended for organisations of any kind.
03 · 2018
Simplified second edition
The current edition sharpened leadership, integration, dynamic context, human factors and value creation.
04 · 2023–2026
Confirmed and under review
ISO confirmed the 2018 edition in 2023 and records it at a revision stage in 2026.
Risk technique does not remove uncertainty or substitute for commercial judgement. A low-looking rating can still hide catastrophic or unowned exposure.
OFFICIAL SOURCE FRESHNESS MONITOR
SOURCE CHECK PENDING
Monthly official-source reachability and change review.
LAST SOURCE CHECKloading…
What this date means
The check records source reachability and a content fingerprint. It does not silently change the page or claim that an edition changed.
PUBLICLY DESCRIBABLE ANATOMY
Every domain gets a specific bid-management translation.
These are navigational interpretations, not substitute clauses. Use the official publication for normative wording.
- 01
Principles for effective risk management
Use risk principles to improve qualification and solution decisions, not to create administrative theatre.
- Evidence object
- Pursuit risk design principles
- Decision test
- Does risk work change the decision while information can still change?
- 02
Leadership, integration and framework design
Integrate risk authority into governance, strategy, pricing, solution and delivery design.
- Evidence object
- Risk governance and escalation framework
- Decision test
- Can a cross-functional owner resolve a risk that sits between departments?
- 03
Scope, context and criteria
Define objectives, scope, context and decision criteria before rating uncertainty.
- Evidence object
- Risk context and criteria statement
- Decision test
- Would two informed reviewers interpret impact and likelihood consistently?
- 04
Risk identification, analysis and evaluation
Identify uncertainty, analyse drivers and consequences, and evaluate against explicit criteria.
- Evidence object
- Assumption-led risk assessment
- Decision test
- Are causes, events and consequences separated instead of collapsed into a vague sentence?
- 05
Risk treatment and decision ownership
Select treatment, owner, resources, timing and residual acceptance.
- Evidence object
- Treatment and residual-risk decision
- Decision test
- Is the treatment funded and embedded in the proposed operating model?
- 06
Communication, consultation and recording
Consult affected disciplines and retain the reasoning behind material decisions.
- Evidence object
- Risk consultation and decision record
- Decision test
- Can delivery explain why the bid accepted, transferred or avoided the exposure?
- 07
Monitoring, review and improvement
Monitor changing context and realised outcomes; update criteria and future qualification.
- Evidence object
- Risk review and outcome learning
- Decision test
- Did a realised risk alter the next pursuit threshold?
BEFORE × INTERVENTION × AFTER
Worked case · fixed-price data migration
A fictional bidder must migrate 18 million records from undocumented legacy systems within a fixed timetable and liability cap.
The landscape shows decision quality, not a probability of loss or award.
What the team can observe
“Data quality” is rated amber, but the team has no sample, error taxonomy, owner, treatment cost or walk-away threshold.
What changes in the operating system
The risk is decomposed into source completeness, extractability, mapping, reconciliation and buyer decision latency; treatments and residual authority are priced.
The bid conditions price and timetable on a sampled baseline, defines buyer dependencies and records the residual exposure accepted by the authorised executive.
PROPORTIONATE IMPLEMENTATION
Scale the control—not the integrity of the decision.
ISO 31000 is guidance and is not certifiable. It does not require one scoring matrix, eliminate uncertainty or replace accountable judgement.
WORKED CASEISO-31000–01Teaching scenario · no claimed outcome
Use five explicit pursuit thresholds, an assumption register and a second-person stop review.
Decision criteria, assumptions, review note
Integrate risk with price, solution, contract and mobilisation decisions.
Treatment costs, authority, residual acceptance
Compare forecast risk with realised delivery outcomes and tune qualification.
Portfolio loss events, calibration decisions
SOURCE TRAIL · REVIEWED 21 AUG 2026
Trace each interpretation to its authority.
Publication status can change. Exact conformity questions belong with the current licensed publication and competent assurance.
ISO
ISO 31000:2018 official record
Current status, public abstract and non-certifiable boundary
Open primary source ↗ISOISO 31000 public overview
Principles, framework and process overview
Open primary source ↗HM GovernmentUK Orange Book risk guidance
Public governance and risk-management context
Open primary source ↗