ISO 27001 clauses
A risk method is good when two people using it land on the same answer.
ISO/IEC 27001:2022 does not prescribe a risk method. It asks for one that is defined in advance, applied the same way each time, and produces results you can compare from one year to the next. Here is a plain method that meets that test, with the records an auditor will read.
Back to ISO 27001 services01 · Criteria first
Set the criteria before you score anything
Criteria written after scoring always look like they were fitted to the answer.
- Acceptance criteria
- The score at or below which a risk owner may accept a risk without further treatment, and who may accept higher ones.
- Assessment criteria
- The likelihood and impact scales, what each level means in your business, and how they combine into a score.
- Triggers to reassess
- A planned interval, commonly yearly, plus events: a new product, a major incident, a new supplier for core data.
Put these in a short risk methodology document. It is required documented information, and it is the first thing a Stage 1 auditor compares against your register.
02 · Finding risks
Two ways to find risks: assets and scenarios
The standard allows either. Many teams combine them.
Asset-based
Walk the asset inventory and ask what could harm the confidentiality, integrity or availability of each item.
- Thorough coverage of what you own
- Ties neatly to asset owners
- Can produce long, repetitive registers
Scenario-based
Describe events that would hurt the business, then trace which assets and controls each one involves.
- Reads like real incidents
- Easier for leaders to rate
- Can miss quiet assets nobody imagined
A practical mix: scenarios for the top of the register, an asset sweep to catch what the scenarios missed. Whatever you choose, every risk needs a named owner.
03 · Scales and matrix
Likelihood, impact and a scoring matrix
Four levels each is enough for most companies. Define every level in business terms.
| Level | Likelihood (illustrative) | Impact (illustrative) |
|---|---|---|
| 1 | Not expected in the next three years | Minor inconvenience, no customer notices |
| 2 | Could happen once in three years | Some customers affected briefly, no data exposed |
| 3 | Likely within a year | Customer data exposed or service down for a working day |
| 4 | Expected within months, or already seen | Regulatory notice, contract loss or a large share of customers affected |
| Likelihood by impact | Impact 1 | Impact 2 | Impact 3 | Impact 4 |
|---|---|---|---|---|
| Likelihood 4 | 4 Medium | 8 High | 12 Critical | 16 Critical |
| Likelihood 3 | 3 Low | 6 Medium | 9 High | 12 Critical |
| Likelihood 2 | 2 Low | 4 Medium | 6 Medium | 8 High |
| Likelihood 1 | 1 Low | 2 Low | 3 Low | 4 Medium |
Illustrative bands: Low (1 to 3) may be accepted by the risk owner; Medium (4 to 6) needs an owner's recorded decision; High (8 to 9) needs treatment; Critical (12 to 16) needs treatment and leadership attention. Your own bands belong in the methodology.
04 · Treatment options
Owners and the four ways to treat a risk
An owner is someone with the authority to decide, not the person who found it.
- Modify
- Add or strengthen controls to lower likelihood, impact or both. The most common choice.
- Retain
- Accept the risk as it is, within the acceptance criteria, with the owner's decision recorded.
- Avoid
- Stop the activity that creates the risk: drop a feature, leave a market, stop storing a data field.
- Share
- Move part of the consequence to another party, through insurance or a contract. Accountability stays with you.
05 · Annex A and residual risk
The Annex A cross-check, then what is left
Annex A is a checklist to compare against, not a menu to order from.
Once you have chosen controls from your own reasoning, compare them with the 93 controls in Annex A. The aim is to spot anything necessary you overlooked. The result, every control with its applicability and reason, becomes the Statement of Applicability.
Then rescore each treated risk as it will stand with the controls in place. That residual risk is what the owner formally accepts, together with the risk treatment plan: the controls still to build, who builds them and by when.
06 · Register example
Illustrative risk register rows
One line per risk, readable by someone who was not in the room.
| Risk | Owner | Inherent | Treatment | Controls (Annex A names) | Residual | Accepted |
|---|---|---|---|---|---|---|
| Stolen admin credentials used to reach production | Head of platform | 3 x 4 = 12 | Modify | Secure authentication; privileged access rights | 1 x 4 = 4 | Owner, dated |
| Payroll data exposed through a misconfigured storage bucket | Head of platform | 2 x 4 = 8 | Modify | Configuration management; monitoring activities | 1 x 4 = 4 | Owner, dated |
| Office flood damages on-site equipment | Office manager | 1 x 2 = 2 | Retain | None added; laptops hold no unique data | 1 x 2 = 2 | Owner, dated |
| Customer data processed by an unvetted analytics tool | Product lead | 3 x 3 = 9 | Avoid | Tool removed; supplier review before any replacement | Closed | Owner, dated |
07 · Records auditors read
The records an auditor reads
Stage 1 checks they exist; Stage 2 checks they are used.
- Risk methodology. Criteria, scales, bands and reassessment triggers, approved and versioned.
- Risk assessment results. The register with dates, owners and scores, showing when it was last run.
- Risk treatment plan. Open actions with owners and due dates, and progress against them.
- Statement of Applicability. Consistent with the treatment choices in the register.
- Residual risk acceptance. Each owner's acceptance, dated, traceable to a person with authority.
- Evidence of reassessment. A rerun after a significant change, not only the annual cycle.
- Scores with no definitions. A 3 means nothing unless the methodology says what a 3 is.
- Everything modified, nothing accepted. Every risk treated with a new control suggests the criteria are not being used.
- Owners who never saw their risks. An auditor will ask an owner about a risk in their name.
Sources: ISO/IEC 27001:2022 clauses 6.1.2, 6.1.3, 8.2 and 8.3 (titles and purpose, in our own words); ISO/IEC 27002:2022 control names; the treatment option names as used in ISO/IEC 27005:2022 and ISO 31000. Scales, bands and register rows are Auditify's own and illustrative.
Risk assessment and treatment, answered
Do we have to use an asset-based risk assessment?
No. The current edition lets you choose the approach.
Since the 2013 edition the standard has not required an asset-based method. You need a defined method that identifies risks within the scope and gives each a named owner. Many companies still keep an asset inventory because Annex A control 5.9 asks for one.
Who can accept a residual risk?
The risk owner, within the limits your criteria set.
Your methodology should say who may accept which score. Low risks may sit with the risk owner; higher ones commonly need a more senior signature. The auditor checks the acceptance happened and the person had authority.
Is a spreadsheet good enough?
Yes, if it is controlled and kept current.
Auditors care about the method and the records, not the tool. A versioned spreadsheet with clear owners passes. A compliance platform helps with reminders but does not replace the judgement in the scores.
How often should the risk assessment be repeated?
At planned intervals, commonly yearly, and after significant change.
Clause 8 asks for assessments at planned intervals and when significant changes are proposed or occur. Set both in the methodology and keep evidence of each run.
Can one risk be shared with a supplier entirely?
No. You can share consequences, not accountability.
Insurance or a contract can move part of the financial impact. The risk still belongs to your ISMS, and you remain answerable to customers and regulators for the outcome.
Build a risk method your team can run again next year.
An ISO 27001 gap analysis reviews your methodology, register and treatment plan against what certification auditors read.