Risk assessment

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization must define and use a risk assessment process that sets and keeps risk criteria, covering both acceptance criteria and criteria for carrying out assessments; gives consistent, valid and comparable results when repeated; identifies, within the ISMS scope, the risks that come from information losing its confidentiality, integrity or availability, and names an owner for each; analyses them by judging potential consequences and realistic likelihood and deciding the level of risk; and evaluates them by comparing the analysis with the criteria and ranking them for treatment. Documented information about the process must be retained.

How the 2020 guidance taught the audit

Auditors confirm that the risk assessment identifies the information security risks of the ISMS and consists of risk identification, analysis and evaluation. They verify that risk acceptance criteria and criteria for performing assessments are set, kept and reasonably justified, and that results are consistent, valid and comparable, by asking the organization why and by sampling results: similar risks in similar circumstances rated alike, differences explained, overall results unambiguous, changes from earlier assessments understandable. Risks must concern loss of confidentiality, integrity and availability within the scope; an asset, threat and vulnerability method is not required and event and consequence approaches are acceptable. Many necessary controls omitted by mistake points to weak risk identification. Each risk needs a named owner who is both answerable for it and empowered to act on it. Analysis must assess potential consequences and realistic likelihood to set risk levels, and evaluation must compare those levels with the criteria and prioritise risks for treatment, considering the wider risk context and interested party requirements, including legal and regulatory ones. The documented process is expected to hold the criteria, the basis for consistency, and descriptions of identification (including owners), analysis and evaluation.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause keeps identification, analysis and evaluation, and keeps the requirement for risk acceptance criteria and criteria for performing assessments. The auditor still tests consistency by sampling similar risks.

Evidence an auditor asks for

• Risk assessmentDocumented risk assessment process including acceptance criteria and criteria for performing assessments
• Risk assessmentSampled risk assessment results showing consequence, likelihood, level and owner per risk
• Risk assessmentPrevious and current assessment results for comparison of the same risks
• Risk assessmentRisk register entries prioritised for treatment against the criteria

The questions an auditor will ask

Sample three risks in similar circumstances and ask why their ratings differ. Ask who owns each risk and what authority the owner has.

Common gaps

• Criteria absent or not justified, so results cannot be checked for consistency
• Similar risks rated differently with no explanation
• Risks without an owner, or owners without authority
• Important information in scope missing from the assessment
• Assessment not repeated at planned intervals or after significant change (see 8.2)

Prepare before the next audit

Re-state the risk criteria and the acceptance criteria. Re-rate a sample of risks with the current criteria and explain the differences.

Cross-references