ISO 31010: Risk Assessment Techniques

Purpose

ISO 31010 provides guidance for choosing and applying techniques that support risk identification, analysis and evaluation. A technique should fit the decision question and the available information; no single method is suitable for every situation.

Practical use

First define scope, participants, uncertainty and the decision to inform. Then select a proportionate technique—qualitative, semi-quantitative or quantitative as appropriate—document assumptions and validate that the results help the people managing the risk.

Relationship and boundaries

It complements the risk management process described by ISO 31000; it is not by itself a management system or a mandatory control catalog.

Selecting and using techniques

Record the question to answer, time horizon, participants and available evidence. Compare candidate methods by the uncertainty they illuminate, data required, effort and type of output. If techniques are combined, explain the contribution of each and how divergent results will be handled. Preserve assumptions and limitations so another reader can interpret the analysis.

Illustrative example

To assess process disruption, a team might begin with structured interviews and scenario analysis; where suitable data exists, it could add a quantitative method. The choice should follow the decision and evidence, not a desire to appear sophisticated.

Designing a defensible assessment

Before selecting a technique, define the system or activity, the decision informed by the analysis and the time horizon. Set scales, assumptions and acceptance criteria before interpreting results. Check data quality and representativeness; when expert judgment is used, record participants, disagreements and potential bias. Test whether modest changes in assumptions alter the conclusion and make remaining uncertainty explicit.