Three frameworks dominate enterprise risk assessment, and they are not interchangeable. ISO 31000 is a set of principles and guidelines any organization can adopt. COSO ERM is a management model that ties risk to strategy and performance. The NIST frameworks are control-oriented systems built for federal agencies and adopted far beyond them. Choosing among them is not a matter of which is “best” — it is a matter of what your organization needs the framework to do: govern, integrate, or control. This guide lays out what each one actually contains, where each is strong, and how practitioners combine them in the field.
ISO 31000: the principles layer
ISO 31000:2018 is guidance, not a requirements standard. Published by the International Organization for Standardization, it sets out principles (risk management should be integrated, structured, customized, inclusive, dynamic, and based on the best available information), a framework for embedding those principles into governance, and a process — communication and consultation, scope and context, risk assessment (identification, analysis, evaluation), treatment, monitoring, and recording. Because it is a guideline, no organization can be “certified to ISO 31000,” and any consultant offering that certification is selling something the standard itself does not provide. Its strength is universality: it speaks no industry dialect, imposes no control catalog, and scales from a school district to a bank. Its weakness is the same quality — it tells you what good risk management looks like, not what to do on Monday.
COSO ERM: the strategy layer
COSO’s Enterprise Risk Management — Integrating with Strategy and Performance (2017) was written for the boardroom. Where ISO 31000 describes a process, COSO describes a management discipline: five components — Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication, and Reporting — carrying twenty principles among them. Its signature move is refusing to treat risk as a compliance annex: risk appetite is set inside strategy, and performance is reported with risk attached. Auditors and public-company boards gravitate to COSO because it shares DNA with the COSO internal-control framework their audit committees already use. Its weakness is abstraction at the operating level — COSO will help a leadership team decide what matters; it will not tell a plant manager which valve to inspect.
NIST: the control layer
NIST publishes frameworks that end in controls. The Risk Management Framework (SP 800-37) is the authorization process U.S. federal systems run on — categorize, select, implement, assess, authorize, monitor — drawing its controls from the SP 800-53 catalog. The Cybersecurity Framework (CSF 2.0, released 2024) is the voluntary sibling: six functions — Govern, Identify, Protect, Detect, Respond, Recover — that organizations of any size use to organize cyber risk work; the 2.0 revision added the Govern function and explicitly widened the audience beyond critical infrastructure. NIST’s strength is specificity: when a NIST framework says “assess,” there is a publication describing the assessment. Its weakness for general enterprise use is gravity — the apparatus assumes systems, authorizing officials, and control baselines, which fits an IT estate better than a whole enterprise.
Side by side
| ISO 31000 | COSO ERM | NIST (RMF / CSF) | |
|---|---|---|---|
| Nature | Guideline — principles and process | Management model — components and principles | Process + control catalogs |
| Certifiable? | No | No (auditable maturity, not a certificate) | RMF ends in an authorization decision; CSF is self-attested |
| Center of gravity | Any risk, any organization | Strategy, performance, governance | Information systems and cybersecurity |
| Audience | Risk function and leadership | Board, executives, audit | CIO/CISO organizations, federal agencies and contractors |
| Prescription level | Low — principles | Medium — principles with practices | High — named controls and steps |
How organizations actually choose
Regulation chooses first. Federal agencies and their contractors live in NIST’s world whether they like it or not. Public companies with audit-committee oversight usually land on COSO because their auditors already speak it. Organizations outside those gravitational fields most often adopt ISO 31000 as the umbrella — because it asks nothing they cannot adapt — and then borrow depth where they need it. The mature pattern is layered, not loyal: ISO 31000 or COSO as the enterprise umbrella, NIST CSF organizing the cyber program underneath it, and sector rules (for finance, healthcare, energy) supplying the hard requirements. Frameworks stacked this way do not conflict; they answer different questions — why and what at the top, how at the bottom.
What an assessment looks like under any of them
The frameworks differ; the working assessment converges. Establish context — what the organization is trying to achieve and what it cannot afford to lose. Identify risks in the language of events and consequences, not departments. Analyze likelihood and impact with evidence where it exists and stated judgment where it does not. Evaluate against the appetite leadership actually set, not the one in the binder. Treat — avoid, reduce, share, or retain, with named owners and dates. Then monitor, because the assessment begins aging the day it is signed. On this hub, that working method is carried in depth by the guide to risk assessment and threat analysis, and structured day-to-day in the risk assessment professional guide. The framework is the constitution; the assessment is the government.
Frequently asked questions
Can an organization be certified to ISO 31000?
No. ISO 31000 is a guidelines standard — it contains recommendations, not requirements, so there is nothing to certify against. Organizations can align to it, be assessed against it, or adopt it; a certificate claiming ISO 31000 certification misrepresents the standard.
What is the difference between COSO ERM and ISO 31000?
Emphasis. ISO 31000 describes a universal risk management process and principles. COSO ERM describes a management and governance model that binds risk to strategy and performance, aimed at boards and executives. Many organizations run COSO at the governance layer and ISO-style process underneath.
Is NIST only for government?
The RMF is mandatory in federal contexts, but the Cybersecurity Framework is voluntary and widely adopted in the private sector, and CSF 2.0 was written explicitly for organizations of all sizes and sectors. NIST publications are free, which has made them the default control vocabulary far beyond government.
Which framework should a mid-sized company start with?
Whichever matches the pressure you actually face: a regulator or customer demanding NIST language, a board asking COSO questions, or neither — in which case ISO 31000’s principles make the lightest umbrella. Start with one umbrella and borrow control depth (usually NIST CSF for cyber) beneath it, rather than adopting three frameworks at once.