A tailored course, built for your situation
Faster path from risk intent to working ISO 31000 implementation
Build complete, defensible risk frameworks in half the review cycles with repeatable artefacts tailored for engineering-led organisations
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Who this is for
Senior software engineer in a high-velocity tech environment who is increasingly called on to design or interpret risk and compliance frameworks but lacks a structured, fast method to produce authoritative outputs
Who this is not for
Entry-level developers, auditors focused on documentation alone, or consultants selling generic ISO 31000 templates without technical grounding
What you walk away with
- Produce a working ISO 31000 risk assessment framework in under 10 days
- Reduce time spent in cross-functional review cycles by 50% using pre-mapped control patterns
- Turn abstract risk mandates into deployable code-level guardrails
- Own the narrative from risk intent to technical implementation without escalation delays
- Ship internal risk tooling that aligns with ISO 31000 without waiting for external consultants
The 12 modules (with all 144 chapters)
Module 1. Foundations of ISO 31000 in engineering context
Understand how ISO 31000 principles translate into system design decisions, not just policy documents. Learn to read the standard through the lens of infrastructure, observability, and incident response.
12 chapters in this module
- What ISO 31000 really means for engineers
- Risk context vs system context
- Aligning risk appetite with SLOs
- Mapping controls to services
- When ISO 31000 intersects SOC 2
- Reading ISO 31000 like code
- Risk language in pull requests
- Pre-empting audit questions
- From risk register to service map
- Documenting decisions in code comments
- Versioning risk logic
- Linking controls to CI/CD
Module 2. Rapid risk framing for new projects
Start every new project with a one-page risk blueprint grounded in ISO 31000, reducing downstream rework and alignment delays.
12 chapters in this module
- First-day risk triage
- Identify key assets fast
- Stakeholder surfacing checklist
- Risk boundary definition
- Threat modelling integration
- Likelihood calibration
- Impact scoring system
- Inherent vs residual risk
- Risk treatment priorities
- One-page risk brief
- Integrating with RFCs
- Updating risk briefs automatically
Module 3. Automated control mapping
Use code to generate ISO 31000 control mappings dynamically, reducing manual effort and ensuring consistency.
12 chapters in this module
- Control-to-code traceability
- YAML-based control specs
- Auto-generating control tables
- Tagging controls in repos
- Querying control coverage
- Diffing control states
- Alerting on gaps
- Integrating with Jira
- Control versioning
- Audit trail generation
- Exporting for compliance
- Maintaining accuracy
Module 4. Building living risk registers
Replace static spreadsheets with dynamic, code-backed risk registers updated from telemetry, incidents, and code changes.
12 chapters in this module
- From spreadsheet to service
- Schema for living registers
- Ingesting incident data
- Linking to post-mortems
- Auto-updating risk scores
- Ownership workflows
- Notification rules
- Integrating with dashboards
- Versioned snapshots
- Audit readiness
- Access controls
- Export formats
Module 5. Risk-aware architecture reviews
Embed ISO 31000 thinking into architecture proposal reviews to catch issues early and accelerate approval.
12 chapters in this module
- Pre-submission checklist
- Risk section requirements
- Assessing design trade-offs
- Evaluating mitigations
- Scoring residual risk
- Cross-team alignment
- Feedback loop design
- Integrating with ADRs
- Tracking approval state
- Lessons from outages
- Updating templates
- Metrics that matter
Module 6. From policy to control code
Translate high-level risk policies into actual code controls, configuration, and checks.
12 chapters in this module
- Policy decomposition
- Identifying enforcers
- Writing policy as code
- Linting for compliance
- Automated enforcement
- Failing builds correctly
- Grace periods and exceptions
- Logging enforcement events
- Alerting on drift
- Remediation workflows
- Documentation sync
- Versioning policies
Module 7. Stakeholder communication patterns
Communicate risk decisions clearly to non-engineers using structured narratives and visual tools.
12 chapters in this module
- Risk storyboarding
- Executive summaries
- Visual risk maps
- Control maturity charts
- Incident impact visuals
- Risk treatment timelines
- Stakeholder-specific views
- Updating comms automatically
- Slide deck templates
- Q&A preparation
- Feedback collection
- Versioning narratives
Module 8. Continuous risk monitoring
Set up systems to monitor risk posture continuously using logs, metrics, and code changes.
12 chapters in this module
- KPIs for risk health
- Monitoring control drift
- Detecting new threats
- Auto-updating risk models
- Alerting on thresholds
- Integrating with SIEM
- Correlating incidents
- Predicting exposure
- Reporting cadence
- Dashboards for teams
- Executive views
- Incident feedback
Module 9. Incident-driven risk refinement
Use real incidents to improve risk models and prevent future failures.
12 chapters in this module
- Post-mortem input
- Identifying root causes
- Updating risk models
- Adding new controls
- Adjusting likelihoods
- Revising impact scores
- Tracking changes
- Sharing updates
- Auditing changes
- Versioning models
- Closing feedback loops
- Measuring improvement
Module 10. Vendor risk integration
Extend ISO 31000 principles to third-party vendors and partners.
12 chapters in this module
- Vendor risk scoring
- Pre-contract checks
- Due diligence automation
- Contract clause mapping
- Ongoing monitoring
- Access reviews
- Incident response coordination
- Reporting to legal
- Exit workflows
- Audit trail maintenance
- Compliance validation
- Vendor self-assessments
Module 11. Scaling risk practices across teams
Extend effective risk practices across multiple teams and services without central bottlenecks.
12 chapters in this module
- Pattern library setup
- Template sharing
- Cross-team reviews
- Central support role
- Training materials
- Metrics aggregation
- Benchmarking
- Feedback loops
- Adoption incentives
- Documentation hubs
- Tooling standardisation
- Governance light-touch
Module 12. Auditor-ready artefacts on demand
Produce complete, consistent ISO 31000 documentation packages in minutes, not weeks.
12 chapters in this module
- Auto-generating SoA
- Control implementation reports
- Evidence collection
- Narrative consistency
- Versioned bundles
- Access controls
- Review workflows
- Annotation tools
- Export formats
- Defensible logic trails
- Update tracking
- Delivery automation
How this maps to your situation
- When starting a new project
- During architecture review
- After an incident
- Before an audit
Before vs. after
Before
Risk work happens in silos, with slow iterations between engineering and governance teams, leading to delayed launches and rework.
After
You ship ISO 31000-aligned risk artefacts ahead of schedule, with consistent quality and cross-functional trust, cutting review cycles in half.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, designed to be completed in parallel with active projects.
How this compares to the alternatives
Unlike generic ISO 31000 training, this course is built for engineers who need to implement risk frameworks in code and systems, not just understand policy. It replaces consultant-led rollouts with a repeatable, technical method.
Frequently asked
Do I need prior experience with ISO 31000?
No. The course starts from engineering context and builds up to full implementation.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Will this work if my team doesn’t use ISO 31000?
Yes. The method works for any risk framework, but uses ISO 31000 as the reference standard for clarity and adoption.
$199 one-time. Approximately 3 hours per module, designed to be completed in parallel with active projects..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours