There are many good risk management standards out there for people to use including the latest in the line: ISO 31000. This is good for organizations and the profession of risk management, but to what extent can we expect this, or any other standard, to be implemented effectively by organizations?