Risk management

Risk management is useful when uncertainty can change the outcome of a decision. A procurement decision may expose an organization to supply interruption, unsuitable materials or loss of traceability; a process change may affect safety, delivery or customer commitments. The starting point is the decision and the objectives at stake. A risk register has little value if its entries cannot be connected to an owner, a decision or evidence that changes the understanding of the situation.

ISO 31000 is a general guidance document, not a collection of product-specific safety limits. It can provide a common organizational approach while different functions use different technical analyses. A chemical hazard evaluation, an information security assessment and a financial sensitivity analysis need not share the same measurement scale. Their results become useful to management when assumptions, consequences and uncertainties are made explicit. The official document identity and publication record are available through ISO Open Data.

The selected publication records are ISO 31000:2018 (edition 2, published 2018-02-14). These identities were checked on 19 October 2026 in ISO Open Data. The recorded ISO 31000:2018 publication is a general risk management guide. NIST SP 800-30 Revision 1 addresses information systems and organizations in its own context. These are different documents with different purposes; their publication dates do not establish that one replaces or is legally equivalent to the other.

For a supplier supplying a single critical component, the risk picture includes manufacturing capability, recovery capacity, replacement lead time and the consequences of an interrupted supply. A credible treatment may involve qualifying another source, holding controlled stock or redesigning the component. Each option changes costs and residual exposure. The decision record connects the chosen treatment to the actual concern and identifies the information that would trigger a review, such as a supplier change, a failure trend or a new use condition.

A general risk guide does not determine the obligations of a regulated activity. NIST SP 800-30, for example, addresses the assessment of information security risk within a defined U.S. technical context. Its threat and vulnerability analysis is not a universal product safety procedure. Medical devices, machinery and dangerous goods have their own risk and safety frameworks. The relevant law, contract or scheme determines whether a specific assessment, control or submission is required.

Look for a clear statement of the decision boundary, relevant objectives, evidence sources and assumptions. Are consequences described in a form that the decision owner can understand? Does an estimated likelihood reflect usable data or a stated judgment? Who can accept the remaining exposure, and what evidence shows that treatment has been implemented? A colored matrix without this context can conceal large differences in severity or confidence. Uncertainty in the assessment itself deserves attention, especially where the evidence is sparse.

Risk analysis is an aid to judgment rather than a device for making uncertainty disappear. Two assessments can reach different results because they use different boundaries, time horizons or assumptions. That difference needs explanation before the scores are compared. Public source information supports the distinction between general guidance and sector methods; it cannot establish the adequacy of a particular organization’s analysis. This reference therefore concentrates on decision records, evidence and escalation rather than inventing a universal formula for acceptable risk.

The quality governance subject places risk in organizational decisions. For a medical device, continue to ISO 14971; for machinery, use ISO 12100. These technical topics narrow the object, hazards and lifecycle evidence. The standards and regulations study explains why a general risk framework does not displace a specific legal duty.

Official sources were checked on 19 October 2026. Publication identifiers, editions and dates are based on the ISO deliverables dataset, licensed under ODC Attribution License 1.0; ISO is the source of that metadata. The ISO entry supplies licensed publication metadata. The NIST source supplies a defined cybersecurity risk context; neither source establishes a universal risk score or acceptance threshold. Full standards remain available through their publishers. Send a correction request with the reference, source and disputed statement so the evidence can be reviewed.