RiskPedia
The encyclopedia

Every framework, indexed.

Browse the full reference of risk management frameworks — from ISO 31000 to Monte Carlo simulation. Complexity, certification path, time-to-implement, and where each one fits.

32 of 32 frameworks
Financial
High

Basel III / IV

Basel III/IV — Banking capital and liquidity standards

Global regulatory framework for bank capital adequacy, stress testing, and market liquidity risk.

BankingRegulatoryCapital
12+ monthsOpen
Technique
Low

Bow-Tie Analysis

Bow-Tie Risk Analysis

Visual technique linking threats → top event → consequences, with prevention and mitigation barriers on each side.

TechniqueVisualBarriers
Days–weeksOpen
IT Governance
High

COBIT

COBIT 2019 — Governance and Management of Enterprise IT

ISACA's framework for governing and managing enterprise IT — risk, value, and resource optimisation.

ITGovernanceISACA
6–12 monthsOpen
Enterprise
High

COSO ERM

COSO Enterprise Risk Management — Integrating with Strategy and Performance (2017)

Connects risk to strategy and performance. The de-facto framework for listed companies and audit committees in the US.

COSOERMGovernance
6–12 monthsOpen
Financial
High

DORA

Digital Operational Resilience Act (EU 2022/2554)

EU regulation harmonising ICT risk management for financial entities. Live from 17 January 2025.

EUFinanceICT
9–18 monthsOpen
Cyber
High

FAIR

Factor Analysis of Information Risk

Quantitative risk analysis model that expresses cyber and operational risk in financial terms using loss-event frequency and magnitude.

quantitative riskcyber riskrisk quantification
6–12 monthsOpen
Enterprise
Medium

FERMA

FERMA Risk Management Standard

European-flavoured risk management standard from the Federation of European Risk Management Associations.

FERMAEuropeEnterprise
3–6 monthsOpen
Technique
Low

FMEA

Failure Mode and Effects Analysis

Systematic technique to identify potential failure modes, their causes, and effects — then prioritise by RPN.

TechniqueEngineeringSafety
WeeksOpen
Technique
Medium

FTA

Fault Tree Analysis (IEC 61025)

Deductive top-down logic technique for analysing how component failures combine to cause a top-level failure.

ReliabilitySafetyEngineering
WeeksOpen
Privacy
High

GDPR

General Data Protection Regulation (EU 2016/679)

EU regulation mandating data protection, privacy-by-design, breach notification, and individual rights for personal data processing.

data privacyGDPRDPIA
12+ monthsOpen
Technique
Medium

HAZOP

Hazard and Operability Study

Structured guideword-based study of process deviations — the standard for chemical, oil & gas and pharma safety.

SafetyProcessEngineering
WeeksOpen
Automotive Manufacturers
Medium

IATF 16949

International Automotive Task Force

IATF stands for the International Automotive Task Force. It is a group of major automotive manufacturers (like BMW, Ford, General Motors, and Volkswagen) and their trade associations. They created and manage IATF 16949, the globally recognized Quality Management System (QMS) standard for the automotive industry.

IATFQualityAutomotive
12-15Open
Cybersecurity
High

ISO 27001

ISO/IEC 27001:2022 — Information Security Management

Certifiable standard for an Information Security Management System (ISMS). The go-to for vendors who need to prove security to customers.

ISOISMSCertifiable
6–12 monthsOpen
Enterprise
Medium

ISO 31000

ISO 31000:2018 — Risk Management Guidelines

The international gold-standard for risk management. Principles, framework, and process that work across any industry and any risk type.

ISOGenericPrinciples
3–6 monthsOpen
Quality
Medium

ISO 9001

ISO 9001:2015 — Quality Management Systems

Certifiable QMS standard; adopts risk-based thinking as a core principle.

ISOQualityCertifiable
6–12 monthsOpen
IT Governance
Medium

ITIL

ITIL 4 — IT Service Management

Service-management framework with explicit risk-management practice — the lingua-franca of IT operations.

ITILITSMOperations
6–12 monthsOpen
Quality
Medium

Lean Six Sigma

Lean Six Sigma

Marries Lean (waste elimination) with Six Sigma (variation reduction). Process-risk power tool.

LeanSix SigmaQuality
3–9 monthsOpen
Cyber
Medium

MITRE ATT&CK

MITRE Adversarial Tactics, Techniques, and Common Knowledge

Globally accessible knowledge base of adversary tactics and techniques derived from real-world cyber intrusions, used for threat modeling and defense.

threat intelligenceadversary emulationtactics
3–6 monthsOpen
Project
Medium

M_o_R

Management of Risk — AXELOS

Companion to PRINCE2 and ITIL focused entirely on risk across strategic, programme, project and operational levels.

AXELOSProjectOperational
3–6 monthsOpen
Technique
High

Monte Carlo Simulation

Monte Carlo Simulation for Risk Quantification

Probabilistic simulation to quantify schedule, cost, or financial risk with confidence intervals.

QuantitativeSimulationAnalytics
WeeksOpen
Cybersecurity
High

NIS2

NIS2 Directive (EU 2022/2555) — Network & Information Security

EU cybersecurity directive expanding scope to thousands more essential and important entities. Mandatory from Oct 2024.

EUCyberRegulatory
6–18 monthsOpen
AI
Medium

NIST AI RMF

NIST AI Risk Management Framework (AI RMF 1.0)

Voluntary framework to manage risks of artificial intelligence systems throughout their lifecycle, emphasizing trustworthiness, fairness, and transparency.

AI governancetrustworthy AIalgorithmic transparency
6–12 monthsOpen
Cybersecurity
High

NIST RMF

NIST Risk Management Framework (SP 800-37)

Seven-step process for managing information security and privacy risk for federal systems — and the cyber lingua-franca for everyone else.

NISTCyberFederal
6–18 monthsOpen
Cyber
Medium

OCTAVE

Operationally Critical Threat, Asset, and Vulnerability Evaluation

Self-directed risk assessment methodology enabling organizations to identify critical assets, threats, and vulnerabilities through facilitated workshops.

asset-centricthreat modelingself-assessment
3–6 monthsOpen
Project
Medium

PMBOK / PMI

PMBOK Guide — Project Management Institute

Global de-facto project management body of knowledge. Risk is one of its core knowledge areas.

ProjectPMPGlobal
Per projectOpen
Project
Medium

PRINCE2

PRINCE2 — PRojects IN Controlled Environments

UK-origin project management method with explicit risk theme and tightly defined roles and stages.

ProjectUKAXELOS
Per projectOpen
Technique
Low

RCA

Root Cause Analysis (5-Whys, Ishikawa)

Family of post-incident techniques to dig past symptoms to the underlying cause and prevent recurrence.

IncidentTechniqueQuality
DaysOpen
Project
Medium

SAFe

Scaled Agile Framework

Risk-aware scaling framework for large agile programs. Risks are surfaced in PI Planning ROAMing.

AgileScalingROAM
3–9 monthsOpen
Cybersecurity
Medium

SOC 2

SOC 2 — AICPA System and Organization Controls

Trust Services Criteria attestation report — the de-facto US SaaS vendor security benchmark.

SaaSAICPATrust Services
6–12 monthsOpen
Strategic
Low

SWOT / PESTLE

SWOT & PESTLE Strategic Risk Scans

Lightweight tools to surface strategic risks from internal capabilities and external environment.

StrategyScanLight
DaysOpen
Quality
Medium

Six Sigma

Six Sigma — DMAIC / DMADV

Statistical methodology for reducing process variation. Risk surfaces as defect rate and process capability.

QualityDMAICProcess
3–9 monthsOpen
Financial
High

Solvency II

Solvency II — EU insurance prudential regime

Risk-based capital regime for EU insurance and reinsurance undertakings.

InsuranceEURegulatory
12+ monthsOpen
Join: India Risk Alerts

Made with Emergent