Which of the following statements does not apply to ISO 31000?

ISO 31000 provides principles and generic guidelines for risk management; it is not a requirements standard. The foreword of the standard explicitly states, "This document is not intended for certification purposes." Unlike other management system standards such as ISO 9001 or ISO 27001, an organization cannot be certified as "ISO 31000 compliant." The standard's value lies in providing a universally applicable framework to integrate risk management into an organization's governance, strategy, and operations, rather than serving as a basis for audit and certification.

A. While other risk-related guides existed, ISO 31000 is widely recognized as the first comprehensive, generic international standard for the practice of risk management issued by ISO.

B. The introduction of the ISO 31000 standard clearly states that its principles and guidelines are applicable to any organization, regardless of its size, type, activities, or sector.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018, Risk management — Guidelines.

Foreword, Page iv: "This document is not intended for certification purposes." (Supports the correct answer C).

Introduction, Page v: "This document is applicable to all organizations, regardless of type, size, activities and location..." (Supports the reasoning for option B).

2. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x

Page 881: The article discusses the development of ISO 31000 as a new, overarching standard intended to harmonize the numerous existing risk management standards and models, reinforcing its position as a foundational, primary standard in its domain. (Supports the reasoning for option A).

3. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. https://doi.org/10.1057/rm.2012.9

Page 273: The paper notes that ISO 31000 is a "non-certifiable standard" and describes its purpose as providing "principles and generic guidelines on risk management," which can be "used by any public, private or community enterprise, association, group or individual." (Supports the correct answer C and the reasoning for option B).