A project running in a single country carries known and relatively predictable risks. A project spanning multiple countries — like the EU-LATAM or Europe-Middle East expansions I routinely handle — multiplies risk categories: regulatory, currency, cultural, logistical. ISO 31000 isn't certification bureaucracy: it's the only framework I've seen actually hold up in multi-jurisdiction settings.
1. Why ISO 31000 and not just a risk register. ISO 31000 doesn't prescribe specific tools (unlike ISO 31010 which lists techniques), but imposes an iterative process: establish context, identify, analyze, evaluate, treat, monitor and communicate risk. The practical difference from a traditional risk register is that risk is re-assessed at every context change — a regulatory shift, a currency devaluation, a new supplier — not just at planned milestones.
2. Risk categories specific to multi-country projects. Regulatory and compliance risk — labour laws, tax rules, import regulations that differ from country to country and often change during the project itself. Currency risk — a project priced in EUR but executed in countries with volatile currencies (e.g. PEN, TRY) can lose margin purely to FX fluctuation. Cultural and stakeholder risk — decisions that need one email in one country need a personal relationship built over weeks in another. Cross-border supply chain and logistics risk — customs, transport times, dependency on a single local supplier.
3. Probability/impact matrix adapted to the international context. The classic probability × impact matrix should be extended with a third dimension: speed of detection. A regulatory risk in a country where you have no local presence can materialize weeks before your team notices. For this type of risk, even with moderate probability and impact, priority treatment is warranted simply because available reaction time is shorter.
4. The four treatment strategies (and when to use them). Avoid — change the approach to eliminate the risk (e.g. don't set up a legal entity in a country, operate through a local partner instead). Reduce — mitigate probability or impact (e.g. currency hedging, contractual price-adjustment clauses). Transfer — insurance, contracts with local suppliers absorbing part of the risk. Accept — when treatment cost exceeds expected benefit, but always with a documented contingency plan, never by default.
5. Risk governance: who decides what. In international projects, risk governance needs clear escalation thresholds: risks below a certain impact threshold are handled by the local PM, above that threshold sponsor or board involvement is required. Without this explicit threshold, important risks stay stuck at the operational level too long, while minor ones needlessly reach the board.
FAQ. Does ISO 31000 require formal certification to be applied? No, ISO 31000 is a guideline, not a certifiable standard like ISO 9001. It can be adopted as an internal framework without external audit. How does ISO 31000 integrate with PMBOK? PMBOK dedicates an entire knowledge area to risk management and is fully compatible with ISO 31000 principles — many PMOs use them together, PMBOK for project structure, ISO 31000 for depth in the risk management process.
If you're planning a multi-country expansion and want an honest assessment of the specific risks in your case, let's book a call: we'll analyze together where the real blind spots are.
