A risk assessment ranks what could go wrong so the budget goes where the harm would be greatest.

You list the things that could go wrong with the information you care about, estimate how likely each is and how bad it would be, and sort the list. That is a risk assessment. The important word is repeatable: two people using your method on the same facts should land near the same answer.

Under ISO 27001 the risk assessment drives almost everything else: the controls you pick, the ones you exclude in the Statement of Applicability, and the objectives you set. Clause 6.1.2 asks you to define the method, and clause 8.2 asks you to actually run it at planned intervals and when things change. An auditor will read your criteria, pick a few risks and trace them through to treatment. Without a sound assessment, every control looks arbitrary and every exclusion looks like a shortcut.

The risk methodology document

Defines your scales for likelihood and impact, and the level at which a risk must be treated.

The risk register

One row per risk: asset or process, threat, owner, scores and status.

Clauses 6.1.2 and 8.2 of ISO 27001

Planning the method, then performing it; titles only, described in our own words.

Change and project reviews

A new product, vendor or office should trigger a fresh look at the affected risks.

Gap assessment

A gap assessment compares what you do with what a standard asks. A risk assessment asks what could harm you, regardless of any standard.

Risk treatment

Assessment ranks risks; treatment decides what to do about each one. They are separate steps with separate records.

Vulnerability scan

A scan finds technical weaknesses. Its results can feed a risk assessment, but a scan alone does not judge business impact.

• Write down your scales and acceptance level before scoring anything.
• Give every risk a named owner who can actually decide on it.
• Set the triggers that force a reassessment, such as new vendors or products.
• Keep the dated results, not just the current register, so an auditor can see history.

• GuideRisk assessment and treatmentA method that is repeatable, with the records an auditor reads.
• GuideClause 6: planningRisks, objectives and planned change, as the standard sequences them.

Sources: ISO/IEC 27001:2022 clause titles 6.1.2 and 8.2 (not quoted); ISO/IEC 27005 as the guidance standard on information security risk management, at summary level.