ISO 31000:2018 provides principles, a framework and a process for managing risk of any kind across an organisation. Unlike most ISO standards it is a guideline rather than a certifiable requirements standard, so certification bodies issue a conformity or attestation certificate against it. Listed companies, lenders and large groups use it to structure the enterprise risk management that SEBI's LODR Regulations and the Companies Act expect boards to oversee, and to make risk registers consistent across plants, subsidiaries and functions.
Legal basis: ISO 31000:2018 (voluntary guidance standard); supports Regulation 21 of the SEBI (LODR) Regulations, 2015 on Risk Management Committees, Section 134(3)(n) of the Companies Act, 2013 on the board's report on risk management policy, and lender and audit committee expectations
Who needs it
- Listed companies in the top 1,000 by market capitalisation that must constitute a Risk Management Committee under SEBI LODR
- Boards and audit committees that want a documented, consistent ERM framework rather than scattered risk registers
- Companies raising debt or equity where lenders and investors assess risk governance in due diligence
- Groups with multiple plants or subsidiaries that need one method for rating and reporting operational, environmental, financial and compliance risks
- Organisations implementing ISO 9001, 14001, 45001 or 27001 that want a common risk methodology underneath all of them
Common in:Manufacturing & Industrial UnitsPharma & Chemicals
Documents required
- 1Existing risk management policy, risk registers and risk committee or audit committee minutes
- 2Organisation chart, business segments, sites and key processes
- 3Strategic plan, annual report and management discussion of risks
- 4Internal audit reports, insurance schedules and major incident history
- 5Compliance registers and regulatory correspondence
- 6Board and committee charters relevant to risk oversight
Missing something? We help you obtain or regularise supporting documents before filing.
How we get it done
- 1
Scoping and maturity assessment
Day 1–7We review how risk is currently identified, rated and reported and benchmark it against the ISO 31000 principles and framework.
- 2
Framework design
Day 5–20Risk policy, appetite and criteria, governance roles, the risk process and the reporting structure are designed with the board or risk committee.
- 3
Risk assessment workshops
Day 15–35Facilitated workshops with functional and plant heads build a consistent, prioritised risk register with owners and treatment plans.
- 4
Documentation, reporting and training
Day 30–45Procedures, templates, dashboards and the committee reporting pack are documented and risk owners are trained.
- 5
Internal review and attestation audit
Day 40–60We review the framework in operation, then the certification body audits it and issues the ISO 31000 conformity attestation.
If you skip certification
ISO 31000 carries no statutory penalty, but weak risk governance does: SEBI can act against listed entities that fail to constitute or operate a Risk Management Committee, auditors report on the adequacy of risk systems, and directors who cannot show a documented risk process are exposed when an incident occurs. Lenders and rating agencies price inadequate risk management into the cost of capital.
Why MYDA Group
Specialists, not generalists
Environmental compliance is our only practice, so your file is handled by people who do this every day.
Fixed fee, written scope
You know the professional fee and the statutory fees before we start. No surprise add-ons.
Inspection and audit-ready
We prepare your site and team for the board visit or certification audit and attend it with you.
Lifetime reminders
Every condition, return and renewal goes into your compliance calendar with alerts.
Frequently asked questions
Can an organisation really be certified to ISO 31000?
Strictly, no. ISO 31000 is a guidance standard without auditable requirements, so there is no accredited certification scheme. Certification bodies instead issue a statement of conformity or attestation after auditing your framework against its principles and process. Anyone offering an accredited ISO 31000 certificate should be treated with caution.
How does ISO 31000 relate to SEBI's risk committee requirement?
SEBI LODR Regulation 21 requires the top 1,000 listed companies to have a Risk Management Committee that formulates a detailed risk policy, including ESG, cyber and business continuity risks, and meets at least twice a year. ISO 31000 gives that committee the framework, criteria and reporting structure and makes the policy defensible.
Is this only for large companies?
No. Mid-sized manufacturers use it to standardise how plant managers rate and escalate risks, and companies implementing other ISO standards use it as the common risk-based-thinking method those standards require.