Risk treatment

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization must define and use a risk treatment process to choose suitable treatment options in light of the assessment results; determine every control needed to implement the chosen options (controls can be designed or taken from any source); compare those controls with Annex A to check nothing necessary has been left out (Annex A lists possible controls and is not exhaustive); produce a Statement of Applicability listing the necessary controls, why each is included, whether each is implemented, and why any Annex A control is excluded; draw up a risk treatment plan; and get risk owners to approve the plan and accept the residual risks. Documented information about the process must be retained. The process aligns with the principles and guidelines of ISO 31000.

How the 2020 guidance taught the audit

Auditors confirm that the organization turns its assessed risks into a treatment process that selects one or more options to modify risk, implements controls, and cycles through evaluating whether treatment worked. The documented process should describe how options are chosen, how necessary controls are determined, how ISO/IEC 27001 Annex A is used to check that no necessary control was overlooked, how the Statement of Applicability is produced, how the treatment plan is formulated and how risk owner approval is obtained, and auditors confirm that what is described matches what is done. They review the options chosen and their appropriateness, the link between the risk criteria and the treatment plan, and whether recent changes such as new IT systems or business processes are reflected. Necessary controls need not come from Annex A; they may come from sector standards (for example ISO/IEC 27011 or 27017) or be designed by the organization, and every one must appear in the Statement of Applicability, which also gives justification for inclusion, implementation status and justification for each Annex A exclusion. The treatment plan is expected to name the risks, controls, how the controls will bring risk within the acceptance criteria, owners, options, implementation status, reasons and expected benefits, actions with responsibility and timing, resources, performance measures and reporting. Risk owners approve the plan and accept residual risk; the plan's form and content are not prescribed.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause keeps the requirement to select treatment options and to produce a Statement of Applicability. The SoA now covers the 93 controls of the 2022 Annex A, with justification for inclusion, exclusion, implementation status and the reason.

Evidence an auditor asks for

• Risk treatmentDocumented risk treatment process covering option selection, control determination and the Annex A comparison
• Risk treatmentStatement of Applicability with justifications for inclusions and exclusions and implementation status
• Risk treatmentRisk treatment plan naming risks, controls, owners, actions, timescales and resources
• Risk treatmentRisk owner approvals of the plan and acceptance of residual risk

The questions an auditor will ask

Pick a risk with a treatment and trace it to the SoA, the control and the evidence that the control operates. Ask why an excluded control is excluded.

Common gaps

• Controls in the treatment plan missing from the Statement of Applicability
• Annex A exclusions with no justification
• Organization-specific controls in the SoA with no stated requirement or implementation
• Residual risk accepted by someone who is not the risk owner
• Treatment plan not updated after a new system or process was introduced

Prepare before the next audit

Refresh the SoA against the 2022 control set. Test three rows: one included and operating, one included and planned, one excluded.

Cross-references