Free Practice Questions for ISO 31000 RM

The PECB ISO 31000 Risk Manager exam has 60 multiple-choice questions, each with three options, and a 2-hour time limit. A 70% score is required to pass. It is open book: candidates may use a hard copy of ISO 31000, the training course materials and their own course notes. It is taken online through the PECB Exams app or on paper through a PECB partner, and covers three competency domains: principles and concepts, the risk management framework, and the risk management process.

No. ISO 31000:2018 is a guidance standard, not a management system standard. Organizations cannot obtain ISO 31000 certification themselves. However, individuals can validate their risk management knowledge and skills against ISO 31000 through PECB credentials such as Foundation, Risk Manager, and Lead Risk Manager. ISO 31000 informs other certifiable standards (e.g., ISO 27001, ISO 22301) by providing the underlying risk methodology.

The 2018 second edition reduced the principles from 11 to 8 (Integrated, Structured and comprehensive, Customized, Inclusive, Dynamic, Best available information, Human and cultural factors, Continual improvement) and replaced the PDCA-style framework with a 6-component framework centered on Leadership and commitment (Integration, Design, Implementation, Evaluation, Improvement). The process is simplified and emphasizes value creation, with risk now defined as 'the effect of uncertainty on objectives' (both positive and negative effects).

ISO 31000:2018 lists seven possible treatment options: (1) avoiding the risk by deciding not to start or continue the activity; (2) taking or increasing the risk to pursue an opportunity; (3) removing the risk source; (4) changing the likelihood; (5) changing the consequences; (6) sharing the risk (insurance, contracts, partnerships); and (7) retaining the risk by informed decision. These are often summarized as the five core options of avoid, modify likelihood, modify consequences, share, and retain — plus take/increase to pursue opportunity and remove the source.

ISO 31000:2018 is a principles-based, generic guidance standard (about 16 pages) applicable to any organization. COSO ERM 2017 (Enterprise Risk Management — Integrating with Strategy and Performance) is a US-developed framework with 5 components and 20 principles, focused on integrating risk with strategy-setting and performance. ISO 31000 emphasizes integration into all activities; COSO ERM emphasizes alignment with strategy. Many organizations use both — ISO 31000 for risk methodology and COSO for governance reporting.

Yes — with regulators worldwide (EU NIS2, SEC cyber disclosures, climate risk via TCFD/IFRS S2) demanding documented risk programs, ISO 31000 expertise is in growing demand across all sectors. The credential is vendor-neutral, internationally recognized, and applicable to enterprise risk, operational risk, project risk, and compliance risk roles. It pairs well with ISO 27005 (infosec risk), ISO 22301 (business continuity), or COSO ERM training.