ISO 27001 and ISO 31000 sit at the point where board scrutiny, supply-chain assurance demands, and cyber risk must connect with wider business decisions.
ISO/IEC 27001 and ISO 31000 both deal with risk, but they serve different purposes. ISO/IEC 27001:2022 sets requirements for a certifiable information security management system, while ISO 31000:2018 provides guidance for managing risk across an organisation and is not a certifiable standard.
ISO 27001 and ISO 31000 at a glance
The simplest distinction is scope. ISO/IEC 27001 is concerned with information security risk and the management system needed to protect confidentiality, integrity, and availability of information. ISO 31000 is broader: it describes principles, a framework, and a process for managing uncertainty in any area of organisational activity, including financial, operational, strategic, safety, and technology risk.
This difference matters because the two standards produce different outcomes. An organisation can be audited and certified against ISO/IEC 27001 because it contains requirements. ISO 31000 is guidance, so it can shape an enterprise risk management approach, but it is not something an organisation can be certified against in the same way.
| Area |
ISO/IEC 27001 |
ISO 31000 |
| Primary focus |
Information security management |
Enterprise risk management |
| Scope |
Information assets, security risks, ISMS governance, controls, and continual improvement |
Risk across business functions, objectives, decisions, and operating contexts |
| Certifiability |
Certifiable through an accredited audit against ISO/IEC 27001 requirements |
Not certifiable; it provides guidance, principles, framework, and process |
| Main outputs |
ISMS scope, risk assessment, risk treatment plan, Statement of Applicability, policies, controls, audit evidence, management review records |
Risk management framework, risk criteria, risk process, communication approach, monitoring and review practices |
| Typical audience |
CISOs, security managers, compliance teams, IT governance, internal auditors, and control owners |
Boards, executives, risk managers, operational leaders, project leaders, and governance teams |
| How they work together |
Turns information security risk decisions into an auditable management system |
Provides a common risk language and process that can align the ISMS with enterprise risk appetite |
What ISO 27001 adds that ISO 31000 does not
ISO/IEC 27001 is designed around the structure of a management system. Clauses 4 to 10 cover organisational context, leadership, planning, support, operation, performance evaluation, and improvement. This structure requires the organisation to define the ISMS scope, understand interested parties, assess and treat information security risk, monitor performance, run internal audits, hold management reviews, and improve the system over time.
Annex A in ISO/IEC 27001 points to security controls that may be selected as part of risk treatment. These controls are supported by ISO/IEC 27002:2022, which provides implementation guidance and groups controls into updated themes. A common mistake is to treat Annex A as a mandatory checklist. In practice, ISO/IEC 27001 expects risk-driven control selection: the organisation should justify which controls are applicable, which are not, and why those decisions make sense in relation to its risk assessment and treatment plan.
The 2022 version of ISO/IEC 27001 also makes integration with enterprise risk easier than older approaches that treated security as a separate compliance exercise. The updated control structure places more emphasis on organisational controls and governance, which helps security teams express information security risk in terms that risk committees and boards already understand. A security control decision can then be discussed as a business risk treatment decision rather than as a purely technical configuration choice.
What ISO 31000 adds that ISO 27001 does not
ISO 31000 gives organisations a broader way to think about risk. It is useful when the goal is to create a consistent risk management approach across departments, projects, suppliers, strategic planning, and operational decision-making. It can help prevent a common governance problem: security, finance, operations, and compliance teams each maintaining separate risk registers with different scoring methods and little shared understanding.
ISO 31000 is built around eight principles. The correct principles are that risk management should be integrated, structured and comprehensive, customised, inclusive, dynamic, based on the best available information, influenced by human and cultural factors, and continually improved.
These principles influence how a risk management system is designed; they do not replace controls, audits, or management-system requirements. For example, the principle of being customised means risk criteria should reflect the organisation’s objectives and appetite, not a generic scoring model copied from another business. The principle of inclusiveness means risk decisions should involve relevant stakeholders, because procurement, legal, operations, security, and business owners often understand different parts of the same risk.
Choosing where to start
The choice between ISO/IEC 27001 and ISO 31000 should start with the outcome the organisation needs. If customers, regulators, tenders, or business partners expect evidence of a formal information security management system, ISO/IEC 27001 is usually the practical starting point because it leads to an auditable and certifiable ISMS. If the organisation’s bigger challenge is inconsistent risk ownership, fragmented risk scoring, or weak board visibility across all risk categories, ISO 31000 may be the better foundation.
In many cases, organisations do not need to choose one permanently over the other. ISO 31000 can provide the enterprise risk language, while ISO/IEC 27001 provides the security management system and audit trail. A risk manager may define enterprise risk appetite and escalation thresholds, while the security team uses those thresholds to set ISMS risk acceptance criteria and determine when information security risk must be escalated.
There is also a skills question. Teams working toward a certifiable ISMS may benefit from structured ISO/IEC 27001 implementation knowledge, while risk teams may need deeper practice in enterprise risk principles and risk communication. Readynez groups its broader ISO training options in one place for readers comparing these routes, but the more important decision is whether the immediate priority is certification evidence, enterprise risk maturity, or both.
How to integrate ISO 31000 with ISO 27001
The strongest integrations begin with language. Enterprise risk management and information security should use a compatible taxonomy, scoring approach, and escalation model. If one team scores risk by financial exposure and another scores it by technical severity alone, the board will struggle to compare risks or understand trade-offs. A shared risk register view can avoid duplicate tracking while still allowing the ISMS to retain the evidence needed for certification.
ISO 31000’s process can map cleanly into ISO/IEC 27001 activities. Establishing context aligns with ISO/IEC 27001 clause 4, where the organisation defines internal and external issues, interested parties, and ISMS scope. Risk criteria connect to clauses 6 and 8, where planning and operational risk assessment take place. Risk assessment feeds the ISMS risk assessment process, while risk treatment supports the risk treatment plan, control selection, and Statement of Applicability. Monitoring and review support clause 9 performance evaluation, and improvement connects to clause 10.
A practical example shows how this works. A healthcare technology supplier preparing for an enterprise customer audit identifies ransomware as both an operational risk and an information security risk. The enterprise risk team defines the risk appetite: disruption to customer-facing services above an agreed threshold requires executive visibility. The ISMS team then uses that risk appetite to set information security risk acceptance criteria, assess ransomware scenarios, choose relevant Annex A controls, record treatment decisions, and prepare audit evidence showing why those controls were selected.
ISO/IEC 27005:2022 can support the information security risk method, while ISO 31010 can help teams choose risk assessment techniques. These standards are especially useful when organisations want more rigour than a simple likelihood-and-impact spreadsheet. The mistake is not using a matrix; the mistake is using one without clear criteria, ownership, evidence, review dates, and a route for escalating risk decisions.
Governance and audit evidence
Good integration becomes visible in governance records. Auditors and boards do not need abstract claims that ISO 31000 and ISO/IEC 27001 are aligned; they need to see how risk decisions were made, who approved them, what evidence was considered, and how those decisions were reviewed. This is where an organisation’s risk register, treatment plan, Statement of Applicability, internal audit programme, and management review minutes should tell a consistent story.
For ISO/IEC 27001 certification, the organisation must be able to demonstrate that its ISMS conforms to the standard’s requirements. ISO 31000 can support that by giving the ISMS a stronger connection to enterprise risk appetite, but it does not remove the need for ISO/IEC 27001-specific evidence. Clause 9 activities such as monitoring, measurement, internal audit, and management review are especially important because they show whether risk management is operating, reviewed, and improved rather than documented once and forgotten.
Boards typically need a different level of information from auditors. An auditor may look for traceability from risk assessment to treatment and control selection. A board may want to know whether residual information security risk sits within appetite, where exceptions exist, and whether investment decisions are reducing material exposure. The same underlying risk data can serve both audiences if the taxonomy and reporting structure are designed carefully.
Common misunderstandings
The most serious misunderstanding is the belief that an organisation can become certified to ISO 31000. It cannot. A provider may offer training or an internal assessment aligned with ISO 31000, but ISO 31000 itself is guidance rather than a certifiable management-system standard.
Another misunderstanding is that ISO/IEC 27001 and ISO/IEC 27002 are interchangeable. ISO/IEC 27001 contains the certifiable ISMS requirements. ISO/IEC 27002 provides guidance on information security controls and helps organisations understand how controls may be implemented. Confusing the two can lead to weak audit preparation, because certification is assessed against ISO/IEC 27001 requirements, not against a general reading of control guidance.
A third problem is treating risk acceptance as a technical decision made inside the security team. Risk acceptance should reflect enterprise risk appetite, ownership, and accountability. If a business owner accepts a high residual risk, the evidence should show the rationale, approval, timeframe, compensating actions, and conditions for review. Without that trail, risk decisions can look informal even when the underlying technical work is sound.
Applying the two standards well
ISO/IEC 27001 and ISO 31000 are strongest when their roles are kept distinct. ISO/IEC 27001 gives information security risk management an auditable system, while ISO 31000 helps align risk thinking with wider organisational decision-making. Used together, they help security teams avoid isolation and help enterprise risk teams understand information security in terms of business impact.
A practical next step is to compare the organisation’s enterprise risk criteria with its ISMS risk assessment method. If they conflict, the gap should be resolved before risk acceptance, control selection, and board reporting become disconnected. Readers planning ISO-related training can review the wider security training options available through Readynez, or contact the team to discuss which route fits their current risk and certification goals.
FAQ
What are the key differences between ISO 27001 and ISO 31000?
ISO/IEC 27001 is a certifiable standard for establishing, operating, monitoring, and improving an information security management system. ISO 31000 is guidance for managing risk across an organisation and is broader than information security. The main differences are scope, certifiability, required evidence, and the type of outputs each standard produces.
Can an organisation be certified to ISO 31000?
No. ISO 31000 provides risk management guidelines and is not a certifiable management-system standard. Organisations can align their risk management approach with ISO 31000, but certification normally applies to standards with auditable requirements, such as ISO/IEC 27001.
Can ISO 27001 and ISO 31000 be used together?
Yes. ISO 31000 can provide the enterprise risk framework, common language, and risk appetite context, while ISO/IEC 27001 applies those ideas to information security through an ISMS. Together they can improve consistency between board-level risk reporting and information security risk treatment.
Which standard should an organisation start with?
If the immediate goal is to demonstrate a formal information security management system to customers, regulators, or auditors, ISO/IEC 27001 is usually the clearer starting point. If the main problem is inconsistent risk management across departments or weak enterprise risk governance, ISO 31000 may be the better first step. Many mature organisations use both, with ISO 31000 shaping enterprise risk practice and ISO/IEC 27001 governing information security.
Does ISO 27001 require every Annex A control?
No. Annex A supports control selection, but ISO/IEC 27001 expects a risk-based decision. Organisations should determine which controls are applicable, document exclusions and justifications, and maintain a Statement of Applicability that connects control decisions to risk assessment and treatment.
