Risk assessment techniques explained: 4 families that fit IEC 31010

Risk assessment techniques are the methods teams use to study hazards before they become losses. IEC 31010 is useful when an organization needs a method, not a philosophy, because it helps leaders choose how to examine uncertainty with enough rigor for the decision they actually need to make.

Across 25+ years leading EHS at multinationals, Andreza Araújo has seen the same pattern repeat. The company says it wants better risk decisions, then picks a method for ceremony instead of the decision in front of it.

As Andreza Araújo argues in Make The Difference: Be a Leader in Health & Safety, a risk method only matters when the supervisor or manager can turn the output into a clear action on the floor.

Definition

ISO 31000 is the standard for managing risk. IEC 31010 is the companion standard that helps teams select and apply techniques for assessing risk. They are related, but they do not do the same job, which is why leaders confuse governance with method.

In more than 250 cultural-transformation projects supported by Andreza Araújo's team, the fastest improvements came when the tool matched the decision. A board review, a shift-start discussion, and a process-hazard study need different levels of detail, because the decision whose consequence is highest also deserves the clearest picture, and the method in which the answer is framed should match the people who will act on it.

Why do teams confuse ISO 31000 and IEC 31010?

They confuse them because both live in the same risk-management conversation and both sound abstract in isolation. ISO 31000 tells the organization how to think about risk at a governance level, whereas IEC 31010 helps the organization choose a method that can reveal what matters in the field.

The article on What-If Analysis shows what happens when teams use a method to surface options, while HAZOP vs Bow-Tie vs FMEA shows how method choice changes the decision. That distinction matters because a clean label on the study does not matter if the room never reaches the control that would prevent the event.

The 4 families that matter

In practice, teams usually need one of four families: screening, structured scenario review, failure logic, or quantitative comparison. These are not the only techniques in IEC 31010, but they are the fastest way to choose the right level of effort without turning the review into bureaucracy.

Screening

Use this when the team needs to spot obvious hazards quickly, usually in routine work or early scoping. A simple JSA or checklist belongs here.

Structured scenario review

Use this when the team needs to ask what could go wrong across a process or task, especially when the field condition is changing. What-If analysis and HAZOP fit this family.

Failure logic

Use this when the team needs to follow how a control, barrier, or component can fail. FMEA and Bow-Tie analysis are useful here, particularly when one weak point can change the outcome.

Quantitative comparison

Use this when the decision depends on probability or consequence and the organization has enough data to justify the extra effort.

How do you differentiate the families in practice?

Choose the lightest method that can still answer the real question. If the supervisor only needs to brief a crew before routine work, a JSA may be enough. If the team is redesigning a process, the structured method should become richer, because the decision whose consequence is highest also deserves the clearest picture.

The article on Barrier Analysis is useful when the question is whether a control still exists in the field, while FMEA Risk Assessment helps when the team must reason through failure modes before the workshop starts. Both articles sit closer to execution, while IEC 31010 helps the team choose the level of analysis first.

When should you use IEC 31010 instead of ISO 31000?

Use IEC 31010 when the team already knows it has a risk question and now needs a method to answer it. Use ISO 31000 when the organization is still deciding how risk management fits governance, planning, and accountability. The two are complementary, and the comparison only makes sense when the leader is clear about the decision level.

The clean test is simple. If the question is "how should we manage risk as an organization?" start with ISO 31000. If the question is "which technique should we use to study this hazard or scenario?" start with IEC 31010. That is the difference between a system and a method.

If you want a practical lens for turning analysis into action, Andreza Araújo's Make The Difference: Be a Leader in Health & Safety is the book to keep beside the workshop notes.