ISO 31000 in Mining: 5 Real Company Risk Frameworks

ISO 31000 is a set of guidelines for managing risk, and it cannot be certified. ISO describes it as giving principles, a framework and a process that any organisation can use, and states that it cannot be used for certification, though it can guide internal or external audit programmes (ISO, ISO 31000:2018 standard page). In mining this means a company writes its own risk policy and checks it against the standard. This page shows how five listed miners did that, using their own annual reports, and then turns the steps into a scoring tool you can try on one risk of your own.

Every company, number and date below comes from a report we opened. If you are a consultant or licence owner who needs a risk register, the five cases show what a working framework contains, and the calculator shows how a score becomes a spending decision.

ISO 31000 in mining: what it is and what it is not

The 2018 edition is the second edition of the standard (ISO, 2018). The 2018 edition is the current one, and a revision is in progress; an Italian trade publication reports that ISO’s risk committee has started it; the 2018 edition remains the one in force. It rests on three parts, which ISO names as principles, a framework and a process. The principles describe what good risk management looks like, the framework describes how an organisation sets up leadership, responsibilities and review, and the process is the repeatable cycle of scoping, assessing, treating, monitoring and reporting risk that the step list below follows.

It is not a mining standard and it is not a technical method. It does not tell you how to design a tailings dam, set a ground-control plan or price a hedge. It tells you how to decide which of those risks matter most, who owns each one and how often to look again. That is why mining companies pair it with sector tools. The International Council on Mining and Metals (ICMM) closure guidance, for example, includes a risk and opportunity assessment tool that is based on AS ISO 31000:2018 and that it says suits mine closure risks (ICMM, Integrated Mine Closure: Good Practice Guide, 2019).

A common mistake is to say a mine is “ISO 31000 certified”. The standard has no certificate. A mine can say its framework is based on, aligned with or consistent with it, which is the wording the companies below use. For certifiable management systems on the same site, look at ISO 14001 (environment) or ISO 45001 (health and safety) instead.

How we chose the five companies

We looked for mining companies whose latest published annual or integrated report states, in its own words, that its risk framework is based on or aligned with ISO 31000, and which also describe at least one concrete practice and give a safety or risk result. Five met that test and are described in full: AngloGold Ashanti, Gold Fields, Fresnillo, Antofagasta and PLS. A table later lists four more companies that make the same statement but give less detail. We did not rank the companies. A framework that is written down is not proof of a safer or more profitable mine, and the numbers below are each company’s own, measured on its own basis.

Five mining companies that base their risk framework on ISO 31000

AngloGold Ashanti: a risk committee over a group-wide register

AngloGold Ashanti states that its risk framework is based on ISO 31000, with every operation and business unit capturing operational risks in one group-wide risk system. Risks are assessed against defined materiality thresholds, and improvement actions are tracked to completion (AngloGold Ashanti, Annual Report, 2025). In 2025 it set up an Executive Risk Management Committee, approved by the Audit and Risk Committee, to drive the framework, set priorities and give each principal risk an executive owner.

Chart

Fresnillo injury rates, 2021 to 2025

TRIFR and LTIFR per million hours worked, company basis

The same report shows how a register changes in practice. The company found no new principal risks in its 2025 review, but it renamed and reframed several. It separated security and other high-potential safety threats from general operating risk, and it split its dealings with artisanal and small-scale miners from the broader social licence risk. It also reworded its resource and growth risks so that they include upside as well as threats, which follows the ISO idea that risk is the effect of uncertainty on objectives. The company reports investment in the structural integrity and operational control of tailings storage facilities, particularly in Brazil, as a reason that risk improved. It reports a record total recordable injury frequency rate (TRIFR) of 0.97 per million hours at managed operations and no fatalities in 2025 (2024: 0.98 and one fatality).

Gold Fields: appetite statements that say what to avoid, reduce or pursue

Gold Fields says its risk framework aligns with ISO 31000. For each strategic risk category it writes a risk appetite statement that names which risks it avoids, which it mitigates and which opportunities it pursues, with key risk indicators and tolerance levels. If a limit is passed, management investigates the root cause and decides whether to act (Gold Fields, Integrated Annual Report, 2025). The Risk Committee receives quarterly updates on all categories and is told of any critical risk that exceeds its threshold.

The 2025 report is open about maturity. It says the company refined categories, definitions, appetite statements, metrics and tolerances in 2025 and plans a renewed Risk Management Standard in 2026, with routines standardised across operations, functions and projects. It reports the overall group risk trend as improved, with higher risk on tenure and regulatory matters and on business partners. The lesson for a smaller operator is that a framework is revised each year, and that the trend by category is more useful than one total score.

Fresnillo: scenarios for security, supply and cost

Fresnillo, a silver and gold producer in Mexico, bases its framework on ISO 31000, ISO 22301 (business continuity) and the COSO enterprise risk framework. It runs five processes, including a monthly procedure to evaluate principal risks, dashboards for each business unit, and impact-and-probability scenarios for security, supply of critical inputs, cost increases and projects. In 2025 it also analysed all strategic decisions with risk scenarios that modelled their possible impacts (Fresnillo plc, Preliminary Results, 2025).

Fresnillo is also the clearest example of why injury rates and fatalities need separate attention. Its annual report shows the TRIFR falling to 6.26 in 2025 and the lost-time injury frequency rate (LTIFR) to 4.10, the lowest to date, and also reports two fatal accidents that year (Fresnillo plc, Annual Report and Accounts, 2025). The opening letter in the report says the company missed the one measure it considers most important. The chart below uses the five-year table from the same report.

Antofagasta: ISO 31000 plus bow-tie analysis for climate risk

Antofagasta, the Chilean copper group, bases its framework on ISO 31000 and the COSO enterprise risk framework and applies it to all operating companies, projects, exploration and support areas. A dedicated workshop updates and approves the risk appetite for each risk area, and risk owners report monthly to the Executive Committee on controls and action plans. Its climate scenario analysis was built into the risk assessment using ISO 31000 and bow-tie analysis, a method that maps the causes, consequences and controls of one event, and it estimated the effect on operating cost and capital spending (Antofagasta plc, Annual Report, 2025).

The report ties the method to specific physical risks. Extreme rainfall would mainly affect Centinela by deferring production and requiring extra tailings capacity to hold excess water, while higher wind and temperature at Los Pelambres would need more dust control on stockpiles, conveyors and the tailings wall. Neither site recorded a fatality in 2025. Los Pelambres reported a TRIFR of 1.77 (2024: 1.02) and Centinela 1.73 (2024: 2.25), so one site rose and one fell in the same year.

PLS: a 5×5 matrix and a register for emerging risks

PLS, the lithium producer that runs the Pilgangoora operation in Western Australia, aligns its framework with ISO 31000:2018 and keeps its risks in an internal platform that records controls and tracks actions. Risks are rated for likelihood and consequence on a 5×5 matrix with Low, Medium, High and Extreme bands plus a High Impact, Low Likelihood category. High and Extreme risks are reviewed monthly by risk owners and reported to the executive team and Board (PLS, Annual Report, year to 30 June 2026).

New threats enter through a “sandpit” register before they join the main register. In the year to June 2026 the company named the fast spread of generative AI as an emerging risk and responded with a governance committee, use-case risk checks, training and limits on enterprise AI models. Its group TRIFR was 2.77 against a stretch target of 2.79, down from 3.10 a year earlier. For more on how lithium projects are assessed, see our guide to lithium mining case studies.

The five frameworks side by side

What the injury numbers do and do not show

Safety rates are the most common result a mining company reports from its risk system, so they are the easiest place to look for evidence. They are also easy to misread. Each company defines its rate on its own basis, per million hours worked, with different injury types counted, so the five figures cannot be ranked against each other. The dumbbell chart below therefore shows each company’s change against its own previous year only. One site rose, and that is part of the honest picture: a framework reduces uncertainty, it does not guarantee a falling line.

Chart

TRIFR, previous year versus latest year

Each company’s own definition and period; compare the change within a company, not between companies

Why a falling injury rate can sit beside fatalities

Fresnillo’s table shows the pattern. Its TRIFR and LTIFR fell in 2024 and 2025, yet it recorded two fatal injuries in each of those years and four in 2023. Rates count frequent, smaller injuries. Fatalities come from a short list of critical risks such as ground failure, vehicles, mobile equipment and energy release, which need their own controls. AngloGold Ashanti describes a Group-wide Critical Risk Management programme for this reason, and PLS reports that it completed all 136 scheduled critical control verifications at Pilgangoora in the year to June 2026. In ISO 31000 terms, the register should list fatal-risk scenarios separately and test each control, not only track the average injury rate.

Chart

Fresnillo fatal injuries per year

Number of fatal injuries, 2021 to 2025

The ISO 31000 process applied to a mine, step by step

These six steps follow the process in the standard and use the practices seen in the five reports.

Infographic

The risk cycle in 6 steps

1. 1Scope and contextFix what the register covers and list outside and inside factors.
2. 2IdentifyWrite each risk as an event with a cause and a consequence.
3. 3Analyse and evaluateRate likelihood and consequence and compare with appetite.
4. 4TreatPick a control, an owner and a due date.
5. 5Monitor and reviewTrack indicators and review High risks often.
6. 6Communicate and recordReport to the board and keep the reasons.

1. Scope and context. Decide what the register covers: one pit, one licence, one project stage. List external factors (commodity price, regulation, climate, community) and internal ones (skills, plant age, contractors).
2. Identify. Run workshops with geologists, engineers, safety, environment and community staff. Write each risk as an event with a cause and a consequence.
3. Analyse and evaluate. Rate likelihood and consequence, for example on the 5×5 matrix PLS describes. Compare the result with the board’s stated appetite.
4. Treat. Choose a control (remove, reduce, transfer, accept), name an owner and a due date, and test that the control works.
5. Monitor and review. Track key risk indicators and trigger a review when a limit is passed, as Gold Fields does. Review High and Extreme risks monthly.
6. Communicate and record. Report to the executive team and board on a fixed schedule and keep the reasons for each decision.

Ten risk areas to put in a mine risk register

The reports above group risks differently, but the same families appear: ground and slope stability, tailings and water, fatal-risk activities, geology and resource estimate, commodity price and cost, permits and tenure, security, supply of critical inputs, community and land access, climate, and cyber or digital. Environmental effects are central to several of these; our video on the seven environmental impacts of mining gives a plain overview of what a register has to cover on the land side.

▶ A plain-language claymation on the seven environmental impacts of mining. · 2:31

Score one risk and test a control

The tool below turns one risk into an expected yearly loss and tests whether a control pays for itself. Enter your own loss, your own estimate of the yearly chance, and the control’s cost and effect. The figures are examples only, in US$, and are not benchmarks. A 1-to-5 matrix score, as PLS uses, ranks risks; the money figure here is a separate check, and the Low to Extreme bands are set by your own organisation, not by ISO 31000.

Land access and ground risk before you drill

The context step often misses the ground itself. Rock can be well mineralised yet unmineable because of who owns or lives on the land. In one Farmonaut survey, 59% of the anomalous ground sat under a town, so the grade was the same but access removed most of the value, as the video below explains. A satellite screen of a licence area adds land-use, drainage and slope context to the scope step before any rig is booked. The output is an exploration target ahead of a resource estimate, and it is not an environmental or social clearance. To see what a screen of your own licence would show, request a quote through our mining query form, read how satellite-based mineral detection works, or contact the team.

Risk also enters when a deal is made. Our checklists on checking title, geology and risk on a gold mine for sale and on picking an exploration drilling contractor turn the same steps into buyer questions, and our guide to gold mining areas in South Africa shows the geology behind Gold Fields’ South Deep mine, one of the sites in the Gold Fields portfolio above.

▶ Shows how land access can block good rock, with a survey where 59% of anomalous ground sat under a town. · 2:05

Putting numbers on a risk: ranges instead of single values

A 5×5 score ranks risks but does not say how much money is at stake. Larger projects add a simulation that varies price, grade and cost together and reports P10, P50 and P90 outcomes, meaning a 10%, 50% and 90% chance of being exceeded or not reached. Fresnillo’s use of impact-and-probability scenarios and Antofagasta’s cost estimate of climate effects are the same idea in a simpler form. The video below explains what Monte Carlo P10, P50 and P90 mean for a mining project.

▶ Explains Monte Carlo P10, P50 and P90 for mining economics and risk. · 14:59

Other miners and bodies that cite the same standard

Common mistakes when adopting the standard at a mine

• Writing a policy and stopping. The reports above describe monthly or quarterly reviews, owners and tracked actions. A document alone does not do that work.
• One average score. Gold Fields tracks the trend by category. Fresnillo’s table shows why fatal risks need their own line.
• Threats only. AngloGold Ashanti reworded its resource and growth risks to include upside, since the standard defines risk as the effect of uncertainty on objectives.
• A register that never changes. New risks appear. PLS uses a sandpit register for them, and its FY26 emerging risk was a technology change.
• Claiming certification. There is no ISO 31000 certificate, so state alignment, not certification.

Frequently asked questions

Is ISO 31000 mandatory for mining companies?

No. ISO states it is a guideline that organisations may use, and it cannot be used for certification. Regulators and stock exchanges set their own disclosure rules, and many companies choose ISO 31000 as a benchmark.

Can a mine be ISO 31000 certified?

No. ISO says the standard cannot be used for certification purposes, although it can guide internal or external audit programmes. Companies instead say their framework is based on or aligned with it.

Which mining companies use ISO 31000?

The five described above, AngloGold Ashanti, Gold Fields, Fresnillo, Antofagasta and PLS, state that they base or align their framework on it. So do South32, IGO, Maaden and Stanmore Resources in their latest reports.

What is the difference between ISO 31000 and COSO ERM?

Both are enterprise risk frameworks. Fresnillo, Antofagasta and Stanmore Resources name both in their reports. ISO 31000 is a short international guideline on principles, framework and process, while COSO ERM comes from a US committee.

What is a risk register in mining?

It is the list of risks with a rating, an owner, controls and actions. PLS, for example, records controls and tracks actions on an internal platform and rates each risk on a 5×5 matrix.

How often should a mine review its risks?

The reports show a range: monthly for High and Extreme risks at PLS, monthly reporting to the Executive Committee at Antofagasta, and quarterly Risk Committee updates at Gold Fields. Choose a rhythm that matches how fast the risk changes.

What is a bow-tie analysis?

It is a diagram with one event in the centre, causes and preventive controls on the left, and consequences and recovery controls on the right. Antofagasta says it used it for its climate scenario analysis.

How do I score a mining risk?

Rate the likelihood and the consequence from 1 to 5 and multiply them, as in a 5×5 matrix, then set your own bands for Low to Extreme. The calculator above adds a money check: loss times yearly chance gives the expected yearly loss.

Does a lower injury rate prove the framework works?

Not by itself. Fresnillo reports its lowest TRIFR and LTIFR to date alongside two fatalities in 2025, so rates and critical-risk controls both need tracking.

Where can I read these frameworks myself?

Each company publishes its annual or integrated report on its investor pages. The links in this article go to the reports we read, and ISO’s page for the standard is linked in the first paragraph.