Risk assessment in operation

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

Risk assessments must be carried out at planned intervals and whenever significant changes are proposed or happen, using the criteria set in 6.1.2 a), and documented information on their results must be retained.

How the 2020 guidance taught the audit

Auditors confirm that the risk assessment process defined under 6.1 is implemented and integrated into the organization's operations, and is performed against the 6.1.2 a) criteria at planned intervals and whenever significant changes are proposed or occur. They evaluate whether the planned intervals suit the ISMS and whether, after significant changes to the ISMS or its context or after information security incidents, the organization decides which of these need an additional assessment and how it is carried out. The audit practice guidance for A.3.1.2 applies as well.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause keeps the requirement to perform risk assessments at planned intervals or after significant change, and to retain the results.

Evidence an auditor asks for

• Risk assessmentISMS planning and the documented risk assessment process
• Risk assessmentDated risk assessment results across the planned intervals
• Risk assessmentRecords of assessments triggered by significant change or incidents
• Risk assessmentStatement of Applicability and risk treatment plan updated from the results

The questions an auditor will ask

Ask for the last assessment, the trigger for it and the results that changed a control.

Common gaps

• Planned interval set but not kept
• Major change or incident with no decision on reassessment
• Assessment run outside operations, so results never reach the treatment plan

Prepare before the next audit

Set the assessment trigger and keep the results. Show one assessment done after a significant change.

Cross-references