If you have spent any time researching how to formalise risk management in your organisation, you have almost certainly come across a list of frameworks and wondered which one actually applies to you.
ISO 31000. COSO. FAIR. They are all described as leading standards. They all claim to help organisations manage risk more effectively. But they are built on different assumptions, designed for different audiences, and structured in very different ways.
This article cuts through the noise. It explains what each risk management framework is, what it is best suited for, and how to decide which one belongs in your organisation.
What Is a Risk Management Framework?
A risk management framework is a structured set of principles, processes and guidelines that help an organisation identify, assess, respond to and monitor risk in a consistent and repeatable way.
Frameworks are not prescriptive rulebooks. They are reference structures. You use them to design a risk management programme that fits your organisation, rather than copying someone else’s approach wholesale. The right framework gives your programme credibility, consistency and a shared language that everyone can work from.
ISO 31000: The Global Standard for All Organisations
ISO 31000 is published by the International Organization for Standardization and is the most widely adopted risk management framework in the world. It has been taken up as the official national risk management standard in over 50 countries and was most recently updated in 2018.
Its defining characteristic is flexibility. ISO 31000 is designed to apply to any organisation, regardless of size, sector or industry. It does not prescribe specific tools or processes. Instead, it sets out principles and a high-level process that organisations adapt to their own context.
The framework is structured around three elements: principles, a framework for embedding risk management across the organisation, and a risk management process covering identification, assessment, treatment, monitoring and communication.
ISO 31000 is particularly strong on integrating risk management into strategic planning and decision-making. It treats risk not just as a source of loss, but as uncertainty in both directions, meaning threats and opportunities are considered equally.
Who it suits best: Any organisation looking for a universal, adaptable foundation. It is especially useful if you work across multiple countries, operate in a sector without a mandated framework, or are building a risk programme from scratch and need a globally recognised starting point.
Tip: ISO 31000 does not offer a compliance certification, and that is by design. Its purpose is guidance, not audit. If you are looking for a framework that can be independently certified, you may need to layer in additional standards such as ISO 27001 for information security.
COSO ERM: Governance-Focused and Strategy-Integrated
COSO stands for the Committee of Sponsoring Organizations of the Treadway Commission, a body originally established to address fraudulent financial reporting. The COSO Enterprise Risk Management framework was first published in 2004 and substantially updated in 2017, when it shifted its emphasis firmly towards strategy and performance.
Where ISO 31000 is principle-based and broadly applicable, COSO ERM is more detailed and more governance-focused. It is particularly well suited to organisations with complex corporate structures, regulatory obligations, or financial reporting requirements. It has deep roots in accounting and audit, and its language and structure reflect that heritage.
The 2017 COSO framework is built around five components: governance and culture, strategy and objective setting, performance, review and revision, and information, communication and reporting. Together these components describe how risk management should connect not just to daily operations, but to the organisation’s long-term strategic direction.
COSO places stronger emphasis on risk appetite than ISO 31000 does. It provides detailed guidance on defining how much uncertainty your organisation is willing to accept, and on communicating that appetite consistently across every business unit.
Who it suits best: Larger organisations, publicly listed companies, financial institutions, and any organisation operating in a heavily regulated environment where board-level risk governance must be demonstrably rigorous. It is also the preferred framework for organisations where the internal audit function plays a significant role in overseeing risk.
Strategy: If you are preparing for regulatory scrutiny, investor due diligence, or an IPO, COSO’s structured approach to governance documentation gives you a format that auditors and regulators recognise immediately. That recognition has practical value when you need to demonstrate programme maturity quickly.
FAIR: When You Need to Put Numbers on Risk?
FAIR stands for Factor Analysis of Information Risk. It is fundamentally different from both ISO 31000 and COSO in one important way: it is a quantitative model, not a qualitative framework.
Where ISO 31000 and COSO help you structure how you think about and govern risk, FAIR helps you calculate the financial impact of specific risks in monetary terms. It asks: what is the probable frequency of a loss event, and what is the probable magnitude of that loss? The answers are expressed in financial figures, not colour-coded risk ratings.
FAIR was developed primarily for information security and cyber risk, where organisations often struggle to communicate risk to non-technical stakeholders. By translating risk exposure into financial language, FAIR makes it possible to compare risk reduction options directly against their costs and to justify security investment in terms the board and finance function understand.
FAIR is not designed to replace ISO 31000 or COSO. Most organisations that use FAIR run it alongside a broader governance framework, using it to add quantitative rigour to specific high-priority risks rather than to structure the entire programme.
Who it suits best: Technology-led organisations, cybersecurity teams, and any risk function that needs to move beyond traffic-light scoring and make financially defensible risk decisions. It is increasingly relevant as boards expect cyber risk to be reported in the same financial terms as any other material exposure.
Fix: If your current risk reporting relies entirely on qualitative high, medium, low ratings and your board is asking for more precision, FAIR is not a replacement for your framework. It is a tool you layer on top of it to give specific risk categories the quantitative analysis they need.
How to Choose the Right Framework?
The honest answer is that many organisations do not choose just one.
ISO 31000 works well as the foundation for most organisations because of its flexibility and global recognition. COSO adds structured governance rigour for organisations that need it. FAIR adds financial precision for specific risk categories, particularly in technology and information security.
Start by asking three questions. What does your organisation most need from a risk framework right now: a consistent process, stronger governance, or more precise measurement? Who are your primary stakeholders, and what language do they speak, whether that is audit, strategy, or finance? And how mature is your risk programme today?
The answers will point you toward the right starting point. From there, you build.
Final Thoughts
No single risk management framework is right for every organisation. ISO 31000 offers flexibility and global applicability. COSO provides governance depth and strategic integration. FAIR delivers financial precision for quantifiable risk categories.
Understanding what each framework is designed to do is the most important step. Once you know that, selecting, combining, and applying them becomes far more straightforward.
Explore the full Zorgle risk management series to go deeper on building your risk programme, applying frameworks in practice, and developing a risk-aware culture across your organisation.
