A practical guide to ISO 31000, NIST SP 800-30, COSO ERM and COBIT — what each covers, how they differ, and how to choose the right one for your organisation.
Michael McCarroll— Founder · 20+ yrs GRC, ISO 27001 lead implementer Updated June 2026
Why risk management frameworks matter
A risk management framework is the shared language your organisation uses to identify, assess, treat and monitor risk. Without one, every department invents its own scoring scales, spreadsheets and terminology. That makes reporting inconsistent, decisions slower, and audits harder than they need to be.
The most popular frameworks are not competitors. They are lenses for different kinds of risk — enterprise, financial, cyber, IT governance and compliance. The right choice depends on what you need to prove, who you need to convince, and how mature your risk programme already is.
The four major frameworks at a glance
Framework
Best for
Certifiable?
Key strength
ISO 31000
Universal enterprise risk
No — guidance
Simple, adaptable process
NIST SP 800-30
Information security risk
No — guidance
Threat-based cyber risk assessment
COSO ERM
Governance, financial, regulatory
No — framework
Board-level risk and controls
COBIT
IT governance and management
No — framework
IT control objectives and processes
ISO 31000: the universal starting point
ISO 31000:2018 is the international standard for enterprise risk management. It is not certifiable, but it is widely referenced by certifiable standards such as ISO 27001, 9001, 42001 and 20000-1. It defines a principles-based framework and a repeatable process: communication, scope, risk assessment, treatment, recording and review.
Use it when you need a single risk method that works across the whole organisation.
Strengths — simple, non-prescriptive, adaptable to any sector or size.
Weaknesses — does not provide detailed security controls or IT governance processes.
For most organisations, ISO 31000 is the best foundation. You can layer NIST or COBIT on top once the core process is running.
NIST SP 800-30: the security risk specialist
NIST Special Publication 800-30, Revision 1, provides a guide for conducting risk assessments. It is part of the wider NIST Risk Management Framework (RMF) and is written in the language of threats, vulnerabilities, likelihood and impact. It is the default approach for many US federal agencies and for organisations that map to NIST CSF or SP 800-53.
Use it when your primary concern is cyber, information security or privacy risk.
Strengths — detailed threat modelling, aligns with NIST CSF and 800-53.
Weaknesses — less natural for strategic, operational or financial risk.
COSO ERM: governance and financial reporting
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Enterprise Risk Management — Integrating with Strategy and Performance is the framework most used by finance, audit and board-level risk functions. It links risk management to strategy and performance, and it underpins many Sarbanes-Oxley (SOX) and internal-controls programmes.
Use it when you need board-level risk governance, financial reporting assurance, or SOX alignment.
Strengths — strong on culture, governance, strategy and controls.
Weaknesses — can feel heavy for small teams or purely technical risk programmes.
COBIT: IT governance and control objectives
COBIT (Control Objectives for Information and Related Technologies) is an IT governance framework from ISACA. It describes how IT should be managed, monitored and controlled to deliver value while managing risk and resources. It pairs naturally with ISO 27001 and NIST frameworks, but it is broader than security alone.
Use it when you need to govern IT processes, service delivery, risk and compliance together.
Strengths — comprehensive IT process and control coverage.
Weaknesses — not a general enterprise risk method; best used alongside ISO 31000 or COSO.
How to choose the right framework
Step 1
Start with your audience
Who needs to see the risk report? A board and external auditors will prefer COSO ERM. A security team and CISO will prefer NIST SP 800-30. Operations, compliance and quality teams usually prefer ISO 31000 because it is neutral and readable.
Step 2
Match the framework to your certification
ISO 27001 → ISO 27005 or NIST SP 800-30. SOC 2 / SOX → COSO ERM. ISO 9001 / 42001 / 20000-1 → ISO 31000. IT governance assurance → COBIT.
Step 3
Assess your maturity
New programmes should start with ISO 31000 and build discipline first. Mature programmes can add NIST for cyber, COSO for governance, or COBIT for IT controls. Trying to implement all four at once usually leads to shelf-ware.
Step 4
Map, don't duplicate
Use one framework as the "master" risk process and map the others into it. ISO 31000 can own the process; NIST can own the security scoring; COSO can own the controls narrative.
Step 5
Pick tooling that supports the method
Spreadsheets break down when you blend multiple frameworks. Choose a risk platform that lets you define custom criteria, link risks to controls, and export evidence in each framework's language.
Decision matrix by organisation type
Organisation type
Primary framework
Typical secondary framework
Small business / startup
ISO 31000
NIST CSF / SP 800-30
Mid-market SaaS / tech
ISO 31000 + ISO 27001
NIST SP 800-30
Public company / regulated finance
COSO ERM
NIST SP 800-30 / COBIT
Healthcare / life sciences
ISO 31000 + NIST SP 800-30
HIPAA / HITRUST risk method
Government / defence contractor
NIST RMF / SP 800-30
ISO 31000
Compare, choose, then operationalise
Choosing the right risk management framework is the easy part. The hard part is keeping the risk register alive, linking risks to controls, and producing evidence when the auditor arrives.
ISO-STANDARD.app ships a ready-to-adopt risk management framework workspace with the risk register, controls catalogue, policies and audit-ready exports already wired together — no spreadsheet sprawl, no consultant lock-in.
Prefer a conversation? Email hello@iso-standard.app — a real human responds within one business day.
Frequently asked questions
Which risk management framework is best for beginners?
ISO 31000 is the most approachable starting point. It is principle-based, non-prescriptive, and designed to work inside any organisation regardless of sector or maturity. Once the basics are in place, you can layer on NIST SP 800-30 for cyber risk, COSO for financial governance, or COBIT for IT controls.
Is COSO ERM only for publicly traded companies?
No, but it is heavily used by organisations that report to regulators, investors, or audit committees. COSO's language and controls focus on governance, financial reporting and enterprise risk oversight. Smaller teams may find it heavier than ISO 31000 or NIST RMF.
Can I use NIST SP 800-30 for non-cyber risks?
Technically yes, but it is designed for information security risk assessment. The threat-source, vulnerability and likelihood terminology maps best to IT and security risk. For operational, strategic, or financial risk, ISO 31000 or COSO ERM usually fit better.
Do these frameworks conflict with each other?
No. They are complementary. ISO 31000 provides the universal risk management process. NIST SP 800-30 adds the security risk assessment method. COSO ERM adds governance and financial reporting control. COBIT adds IT governance and control objectives. Most mature organisations blend two or three.
Which framework do auditors and certification bodies prefer?
It depends on the audit. ISO 27001 auditors expect ISO 27005 or NIST SP 800-30 style security risk assessment. SOC 2 and financial auditors lean toward COSO. ISO 9001, 31000 and 42001 align well with ISO 31000. Pick the framework that matches the certification you are pursuing.
