What is the primary objective of ISO 31000?

ISO 31000's primary objective is to provide principles, a framework, and process for managing risk to create and protect value. It defines risk as the effect of uncertainty on objectives, applicable to any organization. The standard (Clauses 4-6) emphasizes systematic identification, analysis, evaluation, treatment, monitoring, review, and reporting of risks, integrated into governance and operations for better decision-making and resilience.

Who is legally or professionally required to comply with ISO 31000?

No organization is legally required to comply with ISO 31000, as it provides voluntary guidelines, not mandatory requirements. It applies universally to any size, type, or sector—public, private, or non-profit—for professional risk management. Executives, boards, and risk officers adopt it to enhance governance, strategy, and accountability, though regulated industries may reference it for best practices.

Does ISO 31000 require an external audit or third-party certification?

No, ISO 31000 does not require external audit or third-party certification. As guidelines rather than requirements, it is explicitly "not intended for certification purposes" (ISO statement). Alignment is demonstrated via internal governance, records, monitoring, reviews, and evidence of principles, framework, and process application.

How often should an assessment for ISO 31000 be performed?

ISO 31000 assessments should be performed iteratively and dynamically, not on a fixed schedule. The dynamic principle and Clause 6.5 (monitoring and review) require continual monitoring of controls, periodic reviews triggered by changes in context, incidents, or performance data, and event-driven reassessments to ensure suitability, adequacy, and effectiveness.

What are the consequences of non-compliance with ISO 31000?

Non-compliance with ISO 31000 carries no direct penalties, as it is a non-certifiable guideline. Indirect consequences include poor decision-making, operational losses, regulatory scrutiny in aligned regimes, reputational damage, and missed opportunities, stemming from unmanaged uncertainty on objectives without its principles, framework, and process.

Can ISO 31000 be mapped to other international frameworks?

Yes, ISO 31000 can be mapped to other international frameworks as its foundational risk management architecture. Its principles, framework (Clause 5), and process (Clause 6) underpin specialized standards, enabling integration for consistent risk language, though mappings depend on specific contexts and are not prescribed.

What is the first step to begin implementing ISO 31000?

The first step to implement ISO 31000 is securing leadership commitment and establishing the risk management framework (Clause 5). Top management must issue a policy, allocate resources, define roles, integrate into governance, and understand organizational context before scaling the process (Clause 6).

What is the primary objective of EN 1090?

EN 1090 ensures controlled execution and conformity assessment of structural steel and aluminium components for CE marking under the Construction Products Regulation (CPR). It comprises EN 1090-1 (conformity assessment via Factory Production Control, FPC), EN 1090-2 (steel execution requirements like welding, tolerances, and inspection), and EN 1090-3 (aluminium equivalents). Risk-based Execution Classes (EXC1–EXC4) scale controls for consequence class (CC1–CC3), service category (SC1–SC2), and production category (PC1–PC2), enabling lawful market placement in the EEA.

Who is legally or professionally required to comply with EN 1090?

Manufacturers of load-bearing steel and aluminium structural components and kits for permanent construction works must comply with EN 1090 to affix CE marking. This includes fabricators supplying to EU/EEA markets, such as steelwork contractors for buildings, bridges, and stadia. Notified Bodies certify FPC; non-compliance bars market access.

Does EN 1090 require an external audit or third-party certification?

Yes, EN 1090-1 mandates third-party certification of Factory Production Control (FPC) by a Notified Body under AVCP systems. This involves initial inspection, type testing/calculation (ITT/ITC), and ongoing surveillance audits to verify performance constancy before issuing the Declaration of Performance (DoP) and enabling CE marking.

How often should an assessment for EN 1090 be performed?

EN 1090 requires initial Notified Body certification followed by continuous surveillance audits, typically annually. Frequency scales with Execution Class (EXC) per EN 1090-1 Table B.3; higher EXC (e.g., EXC4) demands more intensive monitoring. Internal FPC audits ensure ongoing compliance.

What are the consequences of non-compliance with EN 1090?

Non-compliance with EN 1090 prohibits CE marking, blocking EEA market access and risking product withdrawal, fines, or certificate suspension by Notified Bodies. Manufacturers face CPR enforcement, liability for structural failures, and public NB reporting of suspensions for major non-conformities like poor traceability or unauthorized changes.

Can EN 1090 be mapped to other international frameworks?

EN 1090 integrates with standards like ISO 3834 for welding quality, but direct mappings to other frameworks are not specified in its scope. It aligns with Eurocodes for design but stands as the standalone CPR harmonized route for structural metal components; organizations adapt FPC using ISO 9001 as a base where applicable.

What is the first step to begin implementing EN 1090?

The first step is to determine product scope and Execution Class (EXC1–EXC4) via risk assessment of consequence class, service, and production categories. Default to EXC2 if unspecified, then conduct a gap analysis of current FPC against EN 1090-1 before Notified Body engagement.

Standards Comparison

ISO 31000 vs EN 1090

ISO 31000

Voluntary

2018

International guidelines for enterprise risk management

EN 1090

Mandatory

2009

EU standard for steel and aluminium structural execution.

Quick Verdict

ISO 31000 provides voluntary risk management guidelines for all organizations worldwide, enhancing decision-making. EN 1090 mandates CE marking for EU structural steel/aluminium via certified FPC. Companies adopt ISO 31000 for resilience, EN 1090 for legal market access.

Risk Management

ISO 31000

ISO 31000:2018 Risk management — Guidelines

Cost

€€€

Complexity

Medium

Implementation Time

12-18 months

Key Features

Defines risk as effect of uncertainty on objectives
Eight principles guiding integrated risk management
Framework embedding risk into governance and operations
Iterative six-step risk management process
Non-certifiable guidelines for any organization

Structural Metalwork

EN 1090

EN 1090: Execution of steel and aluminium structures

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Risk-based Execution Classes (EXC1-EXC4)
Factory Production Control (FPC) certification
CE marking and Declaration of Performance
Welding quality via ISO 3834 alignment
Material traceability and NDT inspection

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISO 31000 Details

What It Is

ISO 31000:2018, Risk management — Guidelines is a non-certifiable international standard providing principles-based guidance for systematic risk management. Its primary purpose is to help organizations of any size or sector manage uncertainty affecting objectives, using an integrated, iterative approach.

Key Components

**Three pillarsEight principles (e.g., integrated, customized, dynamic), framework (leadership, design, implementation, evaluation, improvement), and process (communication, scope/context/criteria, assessment, treatment, monitoring/review, recording/reporting).
No fixed controls; flexible, PDCA-aligned model.
Non-certifiable guidelines emphasizing leadership accountability.

Why Organizations Use It

Enhances decision-making, value creation/protection, resilience.
Builds stakeholder trust, supports governance, reduces losses.
Aligns with regulations indirectly; competitive edge via better risk intelligence.

Implementation Overview

Phased roadmap: leadership alignment, gap analysis, pilot, scale, monitor.
Applies universally; involves policy, training, tools like GRC platforms.
No certification; internal assurance via audits, reviews.

EN 1090 Details

What It Is

EN 1090 is the harmonized European standard family for execution of steel and aluminium structures. It provides technical requirements and conformity assessment under the EU Construction Products Regulation (CPR), enabling CE marking for load-bearing components. Its risk-based approach uses Execution Classes (EXC1-EXC4) to scale requirements by failure consequences, service, and production categories.

Key Components

**EN 1090-1Conformity assessment, Factory Production Control (FPC), Declaration of Performance (DoP).
**EN 1090-2/-3Technical rules for steel/aluminium (materials, welding, tolerances, corrosion protection, inspection/NDT).
Core principles: Traceability, welding quality (ISO 3834), risk-scaled controls.
**Certification modelNotified Body audits FPC with ongoing surveillance.

Why Organizations Use It

Mandatory for EU market access via CE marking.
Reduces liability, ensures safety, cuts rework via disciplined processes.
Builds trust, enables high-risk projects (bridges, stadia).

Implementation Overview

Phased: Gap analysis, FPC development, welding qualification, NB certification. Applies to fabricators in construction; 6-12 months typical for medium firms, with audits/surveillance.

Key Differences

Aspect	ISO 31000	EN 1090
Scope	Enterprise risk management guidelines	Structural steel/aluminium execution & conformity
Industry	All sectors worldwide, any organization	Construction, steel/aluminium fabrication, EU-focused
Nature	Voluntary non-certifiable guidelines	Mandatory harmonized standard for CE marking
Testing	Internal monitoring, reviews, no certification	Notified Body FPC certification, surveillance audits
Penalties	No legal penalties, internal consequences only	Market exclusion, fines, legal liability without CE

Scope

ISO 31000

Enterprise risk management guidelines

EN 1090

Structural steel/aluminium execution & conformity

Industry

ISO 31000

All sectors worldwide, any organization

EN 1090

Construction, steel/aluminium fabrication, EU-focused

Nature

ISO 31000

Voluntary non-certifiable guidelines

EN 1090

Mandatory harmonized standard for CE marking

Testing

ISO 31000

Internal monitoring, reviews, no certification

EN 1090

Notified Body FPC certification, surveillance audits

Penalties

ISO 31000

No legal penalties, internal consequences only

EN 1090

Market exclusion, fines, legal liability without CE

Frequently Asked Questions

Common questions about ISO 31000 and EN 1090

ISO 31000 FAQ

EN 1090 FAQ

You Might also be Interested in These Articles...

Top 5 Audit Survival Secrets for Your First SOC 2 Type 2: What Auditors Really Check (and How to Pass)

Master your first SOC 2 Type 2 audit with proven strategies: 40-sample testing, vendor gaps, CPA walkthroughs. Get checklists, scripts & tips from SignWell to s

Top 5 Reasons NIST SP 800-53 Rev 5 Overlays Unlock AI Risk Management for Private Sector Enterprises in 2025

Top 5 reasons NIST SP 800-53 Rev 5 AI overlays unlock risk management for private enterprises. Tailorable controls combat model poisoning & data leakage. CISO i

HITRUST CSF MyCSF Platform Mastery: Infograph of Evidence Tagging Workflows and Top 5 Maturity Tier Acceleration Takeaways

Master MyCSF platform with infographics on evidence tagging for 1,400+ HITRUST controls across 19 domains. Cut documentation by 30%, boost Measured/Managed tier

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how ISO 31000 and EN 1090 compare against other standards

Other ISO 31000 Comparisons

Other EN 1090 Comparisons

What It Is

Key Components

**Three pillarsEight principles (e.g., integrated, customized, dynamic), framework (leadership, design, implementation, evaluation, improvement), and process (communication, scope/context/criteria, assessment, treatment, monitoring/review, recording/reporting).

No fixed controls; flexible, PDCA-aligned model.

Non-certifiable guidelines emphasizing leadership accountability.

What It Is

Key Components

**EN 1090-1Conformity assessment, Factory Production Control (FPC), Declaration of Performance (DoP).

**EN 1090-2/-3Technical rules for steel/aluminium (materials, welding, tolerances, corrosion protection, inspection/NDT).

Core principles: Traceability, welding quality (ISO 3834), risk-scaled controls.

**Certification modelNotified Body audits FPC with ongoing surveillance.

Aspect

ISO 31000

EN 1090

Scope

Enterprise risk management guidelines

Structural steel/aluminium execution & conformity

Industry

All sectors worldwide, any organization

Construction, steel/aluminium fabrication, EU-focused

Nature

Voluntary non-certifiable guidelines

Mandatory harmonized standard for CE marking

Testing

Internal monitoring, reviews, no certification

Notified Body FPC certification, surveillance audits

Penalties

No legal penalties, internal consequences only

Market exclusion, fines, legal liability without CE