Established model
ISO 31000 risk management
International Organization for Standardization · 2009
A common set of principles and a process for identifying, assessing, treating and monitoring risk.
Its place in the frameworkBusiness Core›Compliance
What it does
It gives a vocabulary and a cycle rather than a checklist, and deliberately is not certifiable. Its most useful contribution to ordinary practice is the insistence that risk is defined against objectives — which means you cannot assess risk at all until someone has said what the organisation is trying to do.
- Reach for it when
- When building a risk process from nothing, or when everyone in the room means something different by the word risk.
- Where it stops
- It is a framework for process, not a source of judgement. It will not tell you what your risks are or how much of them to accept.
ISO 31000, Risk management — Guidelines, International Organization for Standardization, 2009; revised 2018.
Why it sits at Compliance
The obligations the organisation has no choice about — legal, regulatory, financial, environmental, and the ethical standards it has committed to publicly.
A model is only useful when you reach for it at the right moment. This one answers a question that arises here — so it is filed here, and nowhere else. These are the working areas it serves:
- Regulatory mappingCompliance management practice on obligation registers, which underpin everything downstream.
- ControlsInternal control frameworks such as COSO, and the preventive-detective-corrective distinction.
- MonitoringInternal audit practice on control testing, and the three-lines model separating operation, oversight and assurance.
- Incident responseIncident response practice, including statutory notification windows such as the seventy-two hours required under GDPR.
What it touches elsewhere
Nothing in a business is decided on its own. A conclusion reached with this model at Compliance lands in these other cores, whether or not anyone follows it there.
- Business CoreControls live inside operational systems; obligations often flow through partners and the supply chain.
- Data CoreData governance is where much of modern compliance actually sits.
- Brand CoreA compliance failure is a brand event before it is a legal one.
- Vision CoreStated values become obligations enforced by employees and customers rather than regulators.
Filed at the same place
These answer questions that arise at Compliance too. Where they disagree with this one, the disagreement is the useful part.
- The three lines modelWho owns a risk, who oversees it, and who independently checks both — kept as three distinct roles.
Elsewhere in Business Core
- Tuckman’s stages of group development
- Belbin Team Roles
- Herzberg’s two-factor theory
- Jobs to be done
- The Kano model
- The value proposition canvas
- The business model canvas
- The Van Westendorp price sensitivity meter
- Value-based pricing
- Core competence
- VRIO
- The resource-based view
- The theory of constraints
- Lean thinking
- Co-opetition and the value net
- Transaction cost economics
- Stakeholder theory
- The power–interest grid
- DuPont analysis
- Break-even and cost–volume–profit analysis
- Unit economics
- The Kraljic Matrix
- The bullwhip effect
- The SCOR Model
- On-time in-full
- Overall equipment effectiveness
- Value stream mapping
- Maslow’s hierarchy of needs
- Kotter’s eight-step change model
- Situational leadership
- The Lean Startup
- Design thinking
- Porter’s value chain
- The McKinsey 7S framework
- The growth–share matrix
- Six Sigma and DMAIC
These are other people’s models, named here so you can go to the source and use them properly. The Omnigoal is not affiliated with their authors and is not endorsed by them; nothing of theirs is reproduced here — no canvas, no diagram, no wording. Each is described in our own words, with the originator credited, because the framework is a place to put thinking, not a replacement for the people who did it. Model names and trademarks belong to their respective owners and are used here only to refer to the work itself.
All 125 models