ISO 31000 provides principles and generic guidelines on risk management. It is not specific to any industry or sector, and can be used by any public or private organisation, applied to any type of risk, and across a wide range of activities and operations.