Risk register, heat map and treatment in 3 seconds.

ISO 9001:2015 clause 6.1 requires «risk-based thinking» applied to the quality management system: the organisation must identify risks that could affect product and service conformity and plan actions to address them, but does not require a formal framework or specific methodology. ISO 31000:2018, on the other hand, is a standard dedicated exclusively to risk management and provides the full principles, framework and process: from establishing the context through to communication and monitoring. ISO 31000 is the reference organisations use to give substance to the ISO 9001 clause 6.1 requirement, as well as the equivalent requirements in ISO 14001, ISO 45001 and ISO 27001. They are not certifiable in place of one another; they are complementary.

The risk register is the central document of the ISO 31000 process. According to the standard (clauses 6.4 and 6.5), each entry must include: (1) risk identification with a description of the event and its causes; (2) risk category (strategic, operational, financial, compliance, reputational); (3) likelihood of occurrence on a defined scale (e.g. 1–5 or percentage); (4) impact on a defined scale (1–5); (5) inherent risk level (likelihood × impact before controls); (6) existing controls; (7) residual risk level (after controls); (8) chosen treatment option (mitigate/transfer/accept/avoid); (9) treatment action with owner and deadline; (10) status. IgeraIndustria can generate the register structure and populate entries from the organisation’s context documents.

Risk appetite is the level of risk the organisation is willing to accept in pursuit of its objectives (ISO 31000:2018, clause 6.3.1). It is not a single number: it is defined by risk category and organisational level. For example, a company may have zero appetite for occupational safety risks (any risk at level 3 or above requires immediate action) but a moderate appetite for commercial risks (it accepts level 3 risks if the expected return justifies it). Defining risk appetite is the responsibility of senior management (clause 5.4) and must be communicated throughout the organisation. It is typically expressed as thresholds on the heat map: red cells are risks that exceed appetite and require mandatory action.

The heat map is the most widely used visualisation tool for inherent or residual risk in ISO 31000 implementations. It is built with likelihood on one axis (typically 1–5, from rare to almost certain) and impact on the other (1–5, from negligible to catastrophic). The result (likelihood × impact) generates a score from 1 to 25, visualised with colours: green (1–4, low risk), yellow (5–9, moderate risk), orange (10–16, high risk), red (17–25, critical risk). The exact thresholds are defined by the organisation based on its risk appetite. ISO 31000 does not prescribe a specific matrix; the standard requires the methodology to be appropriate, proportional to the context and consistent. IgeraIndustria can explain how to calibrate the matrix according to the sector and size of the organisation.

ISO 31000:2018 clause 6.5.2 establishes four risk treatment options: (1) Avoid the risk: decide not to start or not to continue the activity that gives rise to the risk (e.g. not entering a market with excessive regulatory risk); (2) Take or increase the risk to pursue an opportunity (e.g. accept higher operational risk in exchange for higher margin); (3) Remove the risk source or reduce likelihood/impact through controls (mitigate): the most common option; (4) Share the risk: share it with another party through insurance, contracts or subcontracting arrangements. For risks that exceed the defined appetite, the valid options are avoid, mitigate or transfer; accept is only valid if the residual risk is within appetite. The choice must be documented in the treatment plan (6.5.3).

ISO 31000 is the horizontal risk management framework that serves as the methodological base for all management system standards that include risk requirements. ISO 27001:2022 (information security) requires a formal risk assessment and treatment process (clauses 6.1.2 and 6.1.3) aligned with ISO 31000. ISO 14001:2015 (environment) requires identification of environmental risks and opportunities (clause 6.1). ISO 45001:2018 (health and safety) requires identification of hazards and assessment of OH&S risks (clause 6.1.2). Practical integration involves using a single corporate risk register with categories per standard, a unified assessment process and a risk committee that consolidates risks across all disciplines. IgeraIndustria can query the requirements of each standard in a single question and map the overlaps.