ISO 31000 Risk Management in the Philippines

Build enterprise risk management to ISO 31000 — and make it stand up to your board, your regulator and your overseas client

Sterling International Consulting designs, builds and embeds an enterprise risk management (ERM) framework aligned to ISO 31000, the international reference for how organisations handle uncertainty. Read the next line carefully, because most providers will not say it plainly: ISO 31000 is a guidance standard, and no organisation is certified to it. ISO itself states the standard “cannot be used for certification purposes.” There is no ISO 31000 certificate for a company, and any consultant who offers to “certify your business to ISO 31000” is selling something that does not exist. What Sterling delivers instead is real, and it is what a board actually wants: a risk policy your directors can sign, a live risk register your managers use to make decisions, and a repeatable process that surfaces the exposures that would otherwise blindside you. Where you also need a certificate — to satisfy a client, a tender or a parent company — we channel the same risk discipline into a standard that can be certified, and we get that done through an accredited certification body.

Done properly, ISO 31000 is not a compliance ornament that sits in a binder. It changes how decisions get made. Sterling’s clients use an ISO 31000-aligned framework to:

• Give the board and audit committee genuine assurance — a single, credible view of the risks that could derail strategy, with named owners and treatment plans, rather than a spreadsheet nobody trusts.
• Make sharper calls under uncertainty — capital projects, market entry, new suppliers, technology bets — with risk assessed the same disciplined way every time.
• Win work — answer the “describe your enterprise risk management framework” question in RFPs, bank facilities and client due-diligence with a framework that references a recognised international standard.
• Satisfy an overseas parent or head office that runs group ERM to ISO 31000 or COSO and expects the Philippine entity to align.
• Reduce the number of nasty surprises — fewer incidents, fewer write-offs, fewer “how did nobody see this coming” post-mortems.
• Build the risk engine that certifiable systems require anyway — ISO 9001, ISO 27001, ISO 45001 and ISO 22301 all demand risk-based thinking; ISO 31000 is where that thinking is properly done.

That is the honest proposition. It is also the commercially useful one, because a risk framework that only exists to pass an audit is worthless, and a board can tell the difference.

The business case: why enterprise risk management earns its keep

Every organisation already manages risk. The question is whether it does so by accident or by design — in scattered heads and inboxes, or through a framework the whole enterprise shares. ISO 31000 exists because the accidental version fails in predictable ways: the risk that sinks you is the one no single person owned, the one that fell between two departments, or the one everybody assumed someone else was watching.

The financial argument is straightforward. Unmanaged risk shows up as cost — as incidents, rework, fraud losses, project overruns, regulatory penalties, insurance premiums priced for a business that looks disorganised, and deals lost because a client’s risk team was not satisfied. A structured ERM framework does not eliminate those exposures, but it makes them visible early, owned clearly and treated deliberately, which is where the money is saved. Insurers and lenders increasingly ask how you govern risk before they price it; a demonstrable framework is a negotiating asset.

The governance argument is just as real. Boards in the Philippines are under rising expectation — from regulators, from institutional investors, and from their own audit committees — to show that risk is overseen, not just insured. A directors’ report that can point to a live, ISO 31000-aligned framework, with a risk appetite the board has actually set and a register the board actually reviews, is a different conversation from “management assures us the risks are under control.” One of those survives a hard question in a board meeting. The other does not.

And there is a strategic dividend that gets overlooked. Because ISO 31000 puts risk management inside decision-making rather than beside it, a mature framework makes the organisation faster, not slower. Teams that share a risk vocabulary and a treatment process stop re-litigating every decision from scratch. They know what “high” means, who signs off, and what evidence is needed. That is where risk management stops being a brake and starts being a steering wheel.

Who needs ISO 31000 in the Philippines — and what is driving the demand

ISO 31000 is not industry-specific; ISO states it can be used by “any organization regardless of its size, activity or sector.” In practice, Sterling sees the strongest pull from a recognisable set of Philippine buyers.

• Boards and audit committees that want an enterprise-wide risk framework they can stand behind — and a Board Risk Oversight Committee that has something substantive to oversee.
• Publicly-listed companies operating under the SEC’s corporate-governance expectations, which include maintaining an enterprise risk management system and board-level risk oversight. Confirm the current requirements with the Securities and Exchange Commission, then use ISO 31000 as the framework that satisfies them.
• Banks and financial institutions supervised by the Bangko Sentral ng Pilipinas, which operate under detailed risk-management expectations. Confirm the current requirements with the BSP; ISO 31000 gives the enterprise a common language to sit above the specific credit, market, operational and liquidity risk disciplines.
• Government-owned and -controlled corporations under the Governance Commission for GOCCs, where enterprise risk management is an expectation of good governance. Confirm the current requirements with the GCG.
• Insurers, utilities, energy, infrastructure and PPP project companies, where a defensible risk register is effectively a condition of doing business and of financing.
• Any organisation already pursuing or holding a certifiable ISO management system — ISO 9001, ISO 27001, ISO 14001, ISO 45001 or ISO 22301 — that wants the risk-based thinking underneath it done properly and once, rather than reinvented clause by clause.

The overseas-HQ and overseas-client buyer

Two of the strongest demand drivers on this list have nothing to do with local regulation, and both matter more each year as the Philippines deepens its place in global operations.

The first is the overseas-headquartered subsidiary. When a multinational runs group ERM — very often to ISO 31000, or to COSO, or to both — it pushes that framework down to every operating entity, including its Philippine BPO, shared-service centre, factory or sales office. The local management team is handed a group risk policy, a risk taxonomy and a reporting cadence, and told to comply. Sterling’s job is to translate that group framework into something that genuinely works on the ground here — a local risk register that rolls up cleanly into the parent’s, owned by real people, in a language the local team uses — so that the Philippine entity stops being the weak line in the group’s risk report.

The second is the overseas client. Philippine exporters, BPOs, IT-BPM firms and manufacturers increasingly sell to buyers in the United States, Europe, Japan, Australia and the Gulf who run supplier due-diligence. Somewhere in that questionnaire is a question about your risk management framework, your business continuity posture, or how you identify and treat operational risk. “We handle it as issues come up” loses the account. A framework aligned to ISO 31000 — and, where the client wants an actual certificate, an ISO 27001 or ISO 22301 certification behind it — is the answer that keeps you on the shortlist.

What ISO 31000 actually requires — the principles, the framework and the process

Because ISO 31000 is guidance, it is written in the language of recommendation (“should”), not obligation (“shall”). There are no auditable clauses to be certified against and no mandatory controls to implement. What the standard gives you is a coherent architecture in three parts — principles, framework and process — that a good practitioner turns into something concrete for your organisation. Here is what each part means in practice.

The eight principles

The principles describe what effective risk management looks like. Their stated purpose is the creation and protection of value. In plain terms, good risk management is:

• Integrated — part of every activity and decision, not a separate department that gets consulted afterwards.
• Structured and comprehensive — applied consistently, so results can be compared and relied upon.
• Customized — proportionate to your context, objectives and risk profile, not a template photocopied from another company.
• Inclusive — informed by the people who actually understand the risks, so the register reflects reality rather than the view from head office.
• Dynamic — updated as circumstances change, because a risk register that is a year old is usually a work of fiction.
• Based on the best available information — using the data you have, honestly acknowledging its limits.
• Attentive to human and cultural factors — because behaviour and culture drive how risk is actually taken and treated.
• Committed to continual improvement — the framework learns from experience and gets better.

The framework

The framework is how risk management gets embedded into the organisation’s governance and decision-making — the difference between a company that “does risk assessments” and one that manages risk. At its centre sits leadership and commitment: without the board and top management setting risk appetite, allocating authority and holding the framework to account, everything downstream is theatre. Around that centre, the standard describes a cycle of integration, design, implementation, evaluation and improvement — the same continual-improvement logic (Plan-Do-Check-Act) that runs through every modern ISO management system. This is why an ISO 31000 framework slots so naturally under a certifiable system: the machinery is the same.

The process

The process is the part your teams touch every day. ISO 31000 sets it out as:

• Communication and consultation — running throughout, not bolted on at the end.
• Scope, context and criteria — defining what you are assessing and what “acceptable” means before you start, so risk ratings are consistent instead of arbitrary.
• Risk assessment — the core, made of three steps: identification (what could happen), analysis (how likely, how bad, what drives it) and evaluation (does it exceed our criteria, and does it need treatment).
• Risk treatment — deciding and implementing the response: avoid the risk, reduce its likelihood or consequences, share it (for example through contracts or insurance) or retain it by informed decision — then checking that the treatment worked and did not create new risk.
• Monitoring and review — keeping the whole thing current.
• Recording and reporting — the evidence trail that turns activity into board-level assurance and into the answer you give a client’s due-diligence team.

ISO 31000 is supported by a companion, IEC 31010 (developed jointly with ISO), which catalogues the specific risk-assessment techniques — from the simple to the quantitative — that you can plug into the “analysis” step, plus a vocabulary guide that keeps everyone using risk terms the same way. A practitioner’s value is knowing which techniques fit your context and which are overkill.

How Sterling delivers it — the Sterling OS approach to ERM

Sterling runs every engagement on Sterling OS, our delivery operating system. Because ISO 31000 is an advisory build rather than a certification, the emphasis falls on designing a framework that fits, running it until it is genuinely part of how you work, and keeping it alive — but the operating system is the same one that has taken thousands of organisations through certifiable standards.

Design is where we build the framework to your organisation, not to a template. We start by understanding your objectives, your governance structure and the risks that actually matter to you — an honest baseline of where your current risk maturity actually sits. From there we set the architecture: risk policy, risk appetite and criteria the board can own, a risk taxonomy that fits your sector, roles and authorities, and a register structure that will report cleanly upward. In this mode we guide and you build internal capability alongside us — the right choice when you want risk ownership to live inside the business permanently.

Drive is the done-for-you mode: we develop, implement and manage the framework end to end. For groups under time pressure, or a Philippine entity told by an overseas parent to “have ERM in place” by a date, Drive puts an experienced risk practitioner in the driving seat — we build the register, run the first assessment cycles, stand up the reporting, and hand you a working system rather than a manual.

Sustain is where most risk frameworks quietly die and where Sterling refuses to let them. A risk register is only worth having if it is reviewed, challenged and updated — the standard’s “monitoring and review” and “recording and reporting” steps are the ones organisations abandon first. Sustain keeps the cadence: scheduled reviews, refreshed assessments, board and committee reporting packs, and the discipline that stops your framework becoming shelfware six months after go-live.

Automate takes the risk register off the fragile spreadsheet and into a proper system. Through the Effivity and Vegam AI platforms we digitise the register, workflow the treatment actions, automate the review reminders and generate the board-ready reports — so risk reporting stops being a quarterly fire drill and becomes a live picture. It is also what makes group roll-ups across multiple sites actually work.

Revise keeps you aligned as things change — including the standard itself. ISO 31000 is currently under revision: a committee draft was in circulation through early 2026, with its comment period closing on 1 March 2026. The 2018 edition remains the current, valid standard, and the revision will remain guidance — it will not turn ISO 31000 into a certifiable standard. Revise is how we keep your framework current with the standard as it evolves, and with the certifiable systems you layer on top of it over time.

The honest mechanism behind our success claims

Sterling is a consultancy, not a certification body, and for ISO 31000 there is no certificate to issue — so we will not dress an advisory engagement up as one. What we promise is that your framework will survive contact with a hard audience. Before you put your risk framework in front of your board, a regulator or a client’s due-diligence team, we pressure-test it ourselves the way that audience will — because a framework that looks tidy but collapses under the first serious question is worse than no framework at all.

And when the engagement extends to a certifiable standard — when you decide the risk work should carry an ISO 27001, ISO 22301 or ISO 9001 certificate that a buyer will accept — the mechanism is exact and unchanged: we do not put you in front of the certification body until your system has passed our own internal audit. That is how the certification itself gets done, through an accredited certification body, with the risk framework already load-bearing underneath it.

Timeline and cost — what actually drives them

We do not publish day-counts or fees on this page, for a simple reason: an ISO 31000 engagement is scoped to your organisation, and quoting a number before we understand it would be dishonest. What we can do is tell you plainly what moves the timeline and the investment, so you can see where you sit.

• Size and complexity of the organisation — the number of business units, sites and distinct risk domains you need to cover.
• Maturity of what exists today — building on a functioning governance structure and some risk discipline is faster than starting from a blank page.
• Scope of the mandate — a focused framework for one entity is a different exercise from a group-wide ERM roll-up across multiple Philippine sites reporting into an overseas parent.
• Advisory only, or coupled to a certifiable standard — a pure ISO 31000 framework build is a smaller commitment than one designed to also carry an ISO 27001 or ISO 22301 certification through an accredited body.
• Delivery mode — guided Design, where your team builds capability alongside us, versus fully outsourced Drive.
• Level of automation — a spreadsheet-based register versus a digitised, workflow-driven system with automated board reporting.
• Board and reporting expectations — the depth of risk appetite work, committee reporting and assurance mapping your governance requires.

Tell us the shape of your organisation and what you are trying to satisfy, and we will scope it honestly. Detailed pricing is handled directly — talk to our team and we will put a proposal in front of you against your actual context.

Common mistakes — and the anti-shortcut way to do this

Most failed risk programmes fail the same handful of ways. Sterling’s method is built specifically to avoid them.

• Paying for “ISO 31000 certification.” It does not exist for organisations. If a provider offers to certify your company to ISO 31000, that tells you more about the provider than about your risk. (Individuals can hold ISO 31000 training credentials — that is a personal qualification, not a company certificate.)
• The shelfware register. A risk register built for a launch workshop, filed, and never opened again is the single most common outcome. It is precisely why our Sustain discipline exists — the framework only creates value if it stays live.
• The copy-paste framework. A risk taxonomy lifted from another company violates the standard’s own “customized” principle and produces a register full of risks that are not yours while missing the ones that are.
• Treating it as a compliance tick, not a decision tool. If risk assessment happens only to satisfy an auditor and never informs an actual decision, you have paid for paperwork. ISO 31000’s whole point is to put risk inside decisions.
• Confusing individual training with organisational capability. Sending one manager on a risk course does not give the enterprise a framework. The framework is the system, the ownership and the cadence — not a certificate on a wall.
• Skipping risk appetite. Without a board-agreed view of how much risk is acceptable, every rating is a private opinion, and the register cannot tell anyone what to actually do.
• Building risk twice. Organisations pursuing ISO 9001 or ISO 27001 often build a separate, throwaway “risk assessment” for the auditor while their real risks live elsewhere. Do it once, to ISO 31000, and let the certifiable systems draw from it.

The anti-shortcut principle behind all of this is simple: Sterling builds a framework to be used, not to be shown. A programme designed only to look good in a document is the shortcut, and it is the one that costs you when a real risk arrives.

Why Sterling

Sterling International Consulting has been built over 20-plus years, having supported 8,100-plus clients across 60-plus countries. That scale matters for risk work specifically, because we have seen how risk actually goes wrong across sectors and borders — not in theory, but in the incidents, near-misses and audit findings of thousands of real organisations.

Three things separate a Sterling ERM engagement from the alternatives. First, we tell you the truth about the standard — including the inconvenient part, that no organisation is certified to ISO 31000 — because a firm that will mislead you about what you are buying will mislead you about whether it works. Second, we build frameworks that are load-bearing: risk registers your managers use, reporting your board reads, and a process that survives a hard question. Third, we connect the risk work to the certificates you actually need — feeding one well-built ISO 31000 framework into the certifiable standards, delivered through an accredited certification body, so you are not paying to build risk management twice. That same risk engine is what underpins an integrated management system and the digital-trust stack our clients build on top of it.

If your board, a regulator or a client is asking how you manage risk, the honest answer should be a framework you can show them — and defend. That is what we build.

Frequently asked questions about ISO 31000 in the Philippines

Can my organisation be certified to ISO 31000?

No. ISO 31000 is a guidance standard, and ISO states plainly that it “cannot be used for certification purposes.” There is no ISO 31000 certificate for a company. Any provider offering to certify your business to ISO 31000 is offering something that does not exist — treat it as a warning sign. Individuals can earn ISO 31000 risk-management training credentials, but that is a personal qualification held by a person, not a certification held by your organisation. If you need a certificate a client or tender will accept, Sterling channels your risk work into a certifiable standard such as ISO 27001, ISO 22301 or ISO 9001 and gets it done through an accredited certification body.

If there is no certificate, what do we actually get from Sterling?

A working enterprise risk management framework and the evidence that it works: a board-approved risk policy and risk appetite, a risk taxonomy fitted to your organisation, a live risk register with named owners and treatment plans, a repeatable assessment process, board and committee reporting, and a documented statement of alignment to ISO 31000 you can put in front of a client, an auditor or a parent company. In short — everything a certificate is meant to signal, except the certificate, because for ISO 31000 none is issued to organisations.

Our overseas parent runs group ERM to ISO 31000 or COSO — can you align our Philippine entity?

Yes, and it is one of the most common reasons clients call us. We translate the group framework — its risk policy, taxonomy, criteria and reporting cadence — into a Philippine-entity framework that genuinely works locally and rolls up cleanly into the parent’s consolidated risk report. The goal is that your entity stops being the weak line in the group’s risk picture and becomes one head office does not worry about.

A client’s due-diligence asks us to describe our risk management framework. Does ISO 31000 alignment satisfy that?

Usually yes — a framework aligned to ISO 31000, with a real register and evidence of a working process, is exactly the kind of answer supplier due-diligence is looking for. The nuance is that some buyers specifically want a certificate — most often ISO 27001 for information security or ISO 22301 for business continuity. We help you read what the buyer will actually accept, and where a certificate is required we build the certifiable system on top of the same risk framework. Confirm the specific evidence your client needs before you assume alignment alone will clear it.

How does ISO 31000 relate to the risk requirements in ISO 9001 and ISO 27001?

ISO 9001, ISO 27001, ISO 45001 and ISO 22301 all require “risk-based thinking” but leave the method to you. ISO 31000 is that method, done properly. Building one ISO 31000-aligned framework and letting your certifiable systems draw from it is faster, cheaper and more coherent than inventing a separate risk assessment for each standard’s audit — and it means your risk work is consistent across the whole organisation rather than fragmented clause by clause.

We already hold ISO 27001 (or ISO 9001). Do we still need ISO 31000?

You are not required to — ISO 31000 is never mandatory. But most organisations that hold a certifiable system built their risk assessment narrowly, just to clear the audit. Adopting ISO 31000 as the enterprise framework deepens and unifies that work, so risk management covers the whole business rather than only the scope of one certificate. It is the move from “we did a risk assessment for the auditor” to “we manage risk as an organisation.”

Is ISO 31000 mandatory for listed companies, banks or GOCCs in the Philippines?

There is no single law that mandates ISO 31000 by name. What exists is a clear regulatory expectation that certain organisations maintain enterprise risk management and board-level risk oversight — publicly-listed companies under the SEC’s governance code, banks and financial institutions under the BSP, and GOCCs under the Governance Commission for GOCCs. Confirm the current requirements directly with the relevant authority. ISO 31000 is widely used as the reference framework that meets those expectations, which is why boards adopt it even though no rule cites it.

ISO 31000 is being revised. Should we wait for the new edition?

No. ISO 31000:2018 is the current, valid edition and remains so. A revision is in progress — a committee draft was in circulation through early 2026, with its comment period closing on 1 March 2026 — but there is no confirmed publication date, and crucially it will remain a guidance standard, not a certifiable one. The principles-framework-process architecture is stable. Build now; our Revise service keeps your framework aligned when the new edition eventually lands, with no wasted work.

How is ISO 31000 different from COSO ERM?

Both are respected enterprise risk management frameworks. ISO 31000 is leaner and principles-based, written to apply to any organisation of any size; COSO ERM is more prescriptive and widely used in a US financial-reporting context. They are compatible rather than competing. Sterling can build to ISO 31000, to COSO, or to a framework that satisfies both — which matters when an overseas parent mandates one and a local stakeholder expects the other.

What is the difference between ISO 31000 and ISO 31010?

ISO 31000 gives you the overall principles, framework and process. IEC 31010, developed jointly with ISO and often cited as ISO 31010, is its companion, cataloguing the specific risk-assessment techniques — from simple qualitative methods to quantitative analysis — that you apply within the “risk analysis” step. You do not certify to either. Part of a practitioner’s value is choosing the techniques that fit your context instead of over-engineering the analysis.

How do you stop the risk framework from becoming shelfware after go-live?

By treating monitoring, review and reporting as the core of the engagement, not an afterthought — this is exactly what our Sustain discipline is built for. We set a review cadence the board actually sees, refresh assessments on a schedule, and where it helps we digitise the register through our Automate layer so reviews and reporting run on their own rhythm rather than depending on someone remembering. A framework that is reviewed is a framework that stays true; one that is filed and forgotten is worse than none.

Can Sterling help us get a certificate for our risk work if we need one?

Yes — and this is the practical bridge for many clients. While ISO 31000 itself carries no organisational certificate, the risk discipline you build with us feeds directly into certifiable standards: ISO 27001 for information security, ISO 22301 for business continuity, ISO 9001 for quality. We build the framework, then take the certifiable system through to a certificate via an accredited certification body — and we do not put you in front of that body until your system has passed our own internal audit. One risk engine, and the certificate a buyer will actually accept sitting on top of it.

Is training included with Sterling’s ISO 31000 consulting?

Every Sterling engagement includes live risk management training for your team and preferential access to Sterling Academy, with complimentary risk management training for your people as part of the engagement. Special pricing applies to the wider catalogue — Nonconformity Management and Documented Information Management — through your Sterling consultant. Learners who complete a course and its final exam receive a numbered Certificate of Completion, verifiable online, and the completion records serve as evidence for clause 7.2 of your management system standard.

Last updated: July 2026 · Reviewed by Zia Bautista, Lead Auditor & Lead Implementer (Cebu), Sterling International Consulting.