Skip to main content
Aegentra
Display and payment currency for course bundles. Billing country determines applicable tax.
AU

/ ISO 31000 · Risk management guidelines

ISO 31000 risk management review, from governance to evidence.

We assess how your organisation governs risk, sets criteria, identifies and analyses uncertainty, selects treatments, monitors change and reports decisions against ISO 31000 principles and guidance.

ISO 31000 provides guidance rather than certifiable management-system requirements. This engagement is a risk management review, not a certification audit or certificate.

Scope a risk management review

Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.

Two risk leaders reviewing organisational risk evidence beside a connected risk map

Engagement scope

What we examine and deliver.

Leadership, accountability and integration with decision-making

Risk framework design, roles, appetite, criteria and escalation

Risk identification, analysis, evaluation and treatment practice

Consultation, communication, monitoring, review and continual improvement

A traceable findings report with priorities and recommended actions

Scope, fee and responsibilities

Quote only. A fixed project fee is agreed after reviewing the management-system boundary, sites, processes, available evidence and required specialist competence. The proposal records the criteria, sample, timetable, inclusions, exclusions, client responsibilities and any travel before work begins.

Your team provides authorised evidence access, available process owners and management decisions. Remediation, corrective-action verification and aftercare are included only to the extent stated in the written scope; the engagement does not promise unlimited follow-up or a certification outcome.

Qualified delivery matched to your scope

Our team combines implementation, audit, security-governance and technical expertise. Across their professional careers, team members have delivered 2,000+ hours of ISO, ISM and GRC audit work across 70+ organisations.

Team qualifications and credentials

Qualifications, professional credentials and formal training held across Aegentra’s delivery team.

Management systems and audit

  • ISO/IEC 27001 Lead Implementer
  • ISO/IEC 27701 Lead Implementer
  • PECB ISO/IEC 27001 Lead Auditor
  • ISO/IEC 42001 Lead Auditor
  • CISA — Certified Information Systems Auditor
  • ISM Auditor

Cybersecurity and cloud

  • CISSP — Certified Information Systems Security Professional
  • CISM — Certified Information Security Manager
  • Certificate of Cloud Security Knowledge (CCSK)
  • OSCP+ — OffSec Certified Professional Plus

Service delivery and specialist training

  • ITIL Expert
  • PRINCE2
  • Mastering Generative AI for Cybersecurity Certificate
  • Essential Eight Assessment Course certificate — TAFEcyber

Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications.

Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins.

View our delivery-team capability

Frequently asked questions

Important boundaries.

What evidence should we prepare for an ISO 31000 risk management review?

Prepare the agreed framework, risk criteria, appetite or tolerance decisions, current registers, treatment plans and relevant governance records. Include examples showing how an actual decision was made and escalated, not only the latest template. Interviews and sampled decisions help connect documented arrangements to practice. Agree sensitive-information handling and the organisational or business-unit boundary before sharing records.

Is a completed risk register or a five-by-five matrix enough?

No. A register records risks and a matrix can help categorise them, but neither demonstrates that risk management informs decisions. Examine whether criteria are appropriate, owners can act, treatments are followed up and changing conditions trigger review. Avoid treating a colour or score as the whole judgement. The review considers the framework and its use, not whether a particular spreadsheet looks complete.

What do we receive after the risk management review?

You receive the traceable findings and recommended actions agreed in scope, identifying evidence, strengths, gaps and priorities. Use them to assign decisions and improvement work to accountable owners. Implementing every recommendation or running the risk function afterwards is not automatically included. ISO 31000 is guidance: the output is a review, not organisational certification or proof of regulatory compliance.

What determines the cost of an ISO 31000 review?

The fee is quoted for the agreed organisational boundary, business units, framework complexity, interviews, evidence and reporting needs. Reviewing a single function differs from an enterprise-wide review with multiple decision-making bodies. Confirm whether workshops, action planning or follow-up are included. There is no universal fee or completion date before the review scope and dependencies are understood.

Can an organisation be certified to ISO 31000?

No. ISO 31000 is a guidance standard, not a certifiable management-system standard. Aegentra reviews your framework and practice against its principles and guidance but does not issue an ISO certificate.

Is this the same as a risk assessment?

No. A risk assessment examines defined risks. This review examines the organisation-wide governance, framework and process used to manage risk, including how assessments inform decisions and treatments.

Scope a risk management reviewView all Govern services