ISO/IEC 27001 risk assessment
How to design and run an information security risk assessment and treatment process that meets ISO/IEC 27001:2022 and holds up to audit.
What the standard requires
ISO/IEC 27001:2022 requires a defined and applied risk assessment process (clause 6.1.2) and a risk treatment process (clause 6.1.3), carried out at planned intervals and when significant changes occur (clauses 8.2 and 8.3). The method is yours to choose; auditors check that it is defined, applied consistently and produces comparable results.
Seven steps
Set the criteria
Define risk acceptance criteria and the criteria for performing assessments, including how you rate consequence and likelihood.
Identify risks
Identify risks to the confidentiality, integrity and availability of information within the ISMS scope, using assets, processes or scenarios as your starting point.
Assign risk owners
Every risk needs an owner with the authority to accept or treat it.
Analyse
Assess the potential consequences and realistic likelihood of each risk, and determine its level.
Evaluate
Compare results with your acceptance criteria and prioritise risks for treatment.
Choose treatment
Select options (modify, retain, avoid or share) and determine the controls needed, comparing them with Annex A so that no necessary control is omitted.
Plan and approve
Produce a risk treatment plan and obtain risk owners' approval of the plan and acceptance of residual risks.
The Statement of Applicability
The Statement of Applicability lists the necessary controls, justifies their inclusion, states whether they are implemented, and justifies the exclusion of any Annex A controls. In the 2022 edition, Annex A contains 93 controls in four themes: organisational, people, physical and technological. Keep the Statement of Applicability traceable to your risk treatment decisions.
Common audit findings
- Method documented but not applied the same way across teams.
- Risks identified without owners or without owner approval of residual risk.
- Statement of Applicability copied from a template, not derived from the risk treatment.
- No reassessment after significant changes, such as new cloud services or acquisitions.
- Treatment plans with no dates, resources or evidence of progress.
Put it into practice: the ISO/IEC 27001 Risk Register Template follows these seven steps, with editable criteria, automatic risk levels, a treatment plan and a 93-control Statement of Applicability.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.
Need help with your risk assessment?
We run risk workshops, build your risk register and Statement of Applicability, and prepare you for certification.