Risks and opportunities

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

When planning the ISMS the organization considers the 4.1 issues and the 4.2 requirements and identifies the risks and opportunities it needs to address so that the ISMS can achieve its outcomes, undesired effects are prevented or reduced, and continual improvement happens. It must plan actions to address them, and plan how to integrate and implement those actions in its ISMS processes and how to evaluate whether they worked.

How the 2020 guidance taught the audit

Auditors confirm that ISMS planning is done at a level that suits the ISMS's maturity; considers the context issues and interested party requirements so that both negative and positive issues are dealt with; anticipates possible scenarios and consequences so that undesired effects are prevented before they occur; serves the intended outcomes the organization has set, including preserving confidentiality, integrity and availability through the risk management process; determines how the actions it judges necessary or beneficial are built into the ISMS, through objectives, operational control or other provisions such as resources, competence, risk assessment and risk treatment; and defines how the effectiveness of planned actions will be evaluated, for example through monitoring and measurement, internal audit or management review.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause keeps the requirement to plan actions and to integrate them into the ISMS. It adds the need to evaluate the effectiveness of those actions.

Evidence an auditor asks for

• PlanningISMS planning records showing the risks and opportunities to be addressed
• PlanningRisk assessment and treatment process descriptions and their latest results
• PlanningMonitoring and measurement results, internal audit results and management review outputs used to evaluate planned actions
• PlanningRecord of the context and objectives the planning drew on

The questions an auditor will ask

Ask for the risk and opportunity plan and for the evidence that an action was evaluated for effectiveness.

Common gaps

• Planning addresses only threats and never opportunities
• Planned actions with no route into objectives, operational controls or resources
• No defined way of evaluating whether planned actions worked
• Planning detail out of step with the maturity of the ISMS

Prepare before the next audit

Link each planned action to a risk, an owner, a date and an effectiveness test.

Cross-references