Most enterprise risk frameworks fail at the same point: nobody can say how much risk the organisation is willing to take, so every risk looks equally worth escalating. A usable risk appetite statement fixes that, and it is the document this pack is built around. 31 editable files, downloadable the moment you check out. On this page:
- What is in the risk appetite statement pack
- ISO 31000 is guidance, not a certifiable standard
- Who needs risk appetite statement
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the risk appetite statement pack
Documents carry ISO31K reference codes and are grouped by purpose:
- Foundation – the framework overview, risk management policy, charter and mandate, the risk appetite statement and the maturity assessment
- Principles and framework – integration into governance and decision-making, leadership and commitment, and the design of the framework to context
- Process – risk identification, analysis, evaluation and treatment procedures, with the risk criteria definition that makes evaluation consistent
- Communication and consultation – the procedure for engaging stakeholders through the process rather than reporting to them afterwards
- Monitoring and review – the framework review cycle and the effectiveness assessment
- Workbooks – the risk register, the risk appetite workshop guide, the maturity self-assessment workbook, a bow-tie analysis template and the three lines mapping workbook
- Welcome pack and implementation guidance for rolling the framework out
ISO 31000 is guidance, not a certifiable standard
ISO 31000:2018 is the second edition and remains current. A revision is at committee draft stage but has not been published.
The critical thing to understand before buying is that ISO 31000 cannot be certified. It contains guidelines rather than requirements, and any body offering ISO 31000 certification for an organisation is offering something the standard does not support. Individuals can hold risk management qualifications; organisations cannot hold an ISO 31000 certificate.
That makes its value internal rather than commercial. It gives you a recognised, coherent framework for risk that a board and an auditor will recognise – and the risk appetite statement, risk criteria and three lines mapping are what turn that framework from a document into something that changes decisions.
Who needs risk appetite statement
Organisations building an enterprise risk function from nothing. Boards and audit committees who have asked for a risk framework and received a risk register. Organisations whose ISO 27001, ISO 22301 or ISO 9001 systems each contain their own risk process and now want one consistent method underneath them. And risk managers who need a maturity baseline to argue for investment.
How the risk appetite statement maps to the framework
The bow-tie template earns its place because it is the one analysis technique that non-specialists read fluently – threats on the left, consequences on the right, controls in between. For board reporting and for workshops with operational managers it consistently outperforms a risk matrix, which is why it is included alongside the standard register.
Frequently asked questions
Can we get certified to ISO 31000?
No. It provides guidelines rather than requirements and is not certifiable for organisations. Anyone offering organisational certification to it is misrepresenting the standard.
Which edition is current?
ISO 31000:2018, the second edition. A revision is at committee draft stage but is not published.
How does this relate to COSO ERM?
Both are risk frameworks. COSO is more common in US financial reporting contexts, ISO 31000 in international and operational ones. See the COSO Toolkit if COSO is your reference.
Do we still need risk processes inside our other management systems?
You need risk assessment within them, but it should use one consistent method. That is the main argument for an overarching framework rather than three unrelated ones.
How many documents are included?
31 editable files – 24 Word documents and 7 Excel workbooks – plus guidance and a licence file.
Related toolkits
A risk framework underpins most management systems. See the ISO 27001 Toolkit for information security risk, the ISO 22301 Toolkit for continuity, the COSO Toolkit for internal control and the ISO 37301 Toolkit for compliance risk. For information security risk specifically, the NIST cyber risk management toolkit supplies the SP 800-30 method, and the third-party risk toolkit covers the vendor lifecycle.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your risk appetite statement downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the risk appetite statement are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.