ISO 31000 risk management
We support risk review with scored risks, controls, owners and mitigation records, helping your team examine its decisions and follow up the actions it assigns.
Set by ISO
Subject type: guidance. ISO 31000 gives guidelines on risk management. It is not a certification scheme, and no certification is claimed. This page describes the records Flow keeps. It does not describe a risk framework.
What is built
- Flow records risks with likelihood and impact scores.
- Risk records include threats, vulnerabilities and controls.
- Mitigation or acceptance records retain owners and due dates.
- Reminders and escalation history support follow-up.
Governance judgement stays with your team
Your organisation defines its risk criteria, scoring scales and appetite, and reviews how they are applied. The software stores a matrix, an owner and a review date. A score helps organise a discussion. It does not establish that the assessment is correct or that a control works.
Illustrative example: one risk review
This example uses synthetic data. A synthetic clinic records the risk of a refrigerator temperature excursion in its medicines store. The record carries likelihood and impact scores, the controls in place, a named owner and a due date for mitigation. Your risk policy defines what each score means, not the software. When the due date passes, reminders and the escalation history show who was told and when. A reviewer can read the assumptions and the evidence behind the decision.
Related workflow
Use the Flow Risk module page for the detailed workflow. The confirmed scope is a structured risk management record, and no complete implementation of ISO 31000 guidance is claimed.
Official source
ISO 31000. ISO publishes the guidelines.
What we claim, precisely
The system holds the evidence; the facility's accountable person attests. Nothing here asserts that a facility is compliant.
Common questions
-
No. The score records an assessment made within your process. Your team must examine the underlying assumptions, control evidence and follow-up work before accepting the conclusion.
-
From your organisation. You define the likelihood and impact scales, the thresholds and the appetite in your risk policy. Flow records the scores and decisions made under them.
-
ISO 31000 provides guidelines, not requirements for certification. This page does not claim certification. It describes the risk records Flow keeps for your own review.
Not answered here? Contact the team
NXH Flow