ISO 31000 is a set of international standards for risk management. It was developed in November 2009 by International Organization for Standardization. The goal of these standards is to provide a consistent vocabulary and methodology for assessing and managing risk, resolving the historic ambiguities and differences in the ways risk are described. The standards were designed to fit into an integrated management system.

ISO 31000 was published as a standard on 13 November 2009, and provides a standard on the implementation of risk management. A revised and harmonized ISO/IEC Guide 73 was published at the same time. The purpose of ISO 31000 is to provide a guideline on managing risk faced by organizations Using a common approach for any type of risk and is not industry or sector specific. Users are "any public, private or community enterprise, association, group or individual."

An updated version of ISO 31000 was published in February 2018, replacing the original 2009 edition. The 2018 revision introduced clearer and more concise language, placing greater emphasis on the integration of risk management into core business activities, decision-making processes, and organizational culture. It also reinforced the leadership role of top management in embedding risk management throughout the organization and promoted a more flexible, principles-based approach adaptable to organizations of all sizes and sectors.

The version ISO 31000:2018 was confirmed in October 2023 and valid for the next five years.

ISO 31000 provides a set of principles, guidelines for the design, implementation of a risk management framework and recommendations for the application of a risk management process. The risk management process as described in ISO 31000 can be applied to any activity, including decision-making at all levels.

ISO 31000 helps companies establish the backbone of their Enterprise Risk Management (ERM) by providing a structured and principles-based framework for integrating risk management into all aspects of the organization. It guides companies in:

By following ISO 31000, organizations can build a consistent, organization-wide approach to managing risk that supports strategic goals and operational resilience.

ISO 31000 defines eight key terms related to the management of risk, forming the foundation for a consistent understanding of risk-related concepts across organizations. These terms are: risk, risk source, event, consequence, likelihood, risk identification, risk analysis, and risk evaluation. They are aligned with ISO 31073:2022 (formerly ISO Guide 73), which provides a standardized vocabulary for risk management. ISO 31073 supports the implementation of ISO 31000 by ensuring clarity and consistency in risk communication, helping organizations align their terminology internally and externally across various sectors and disciplines.