Risk treatment in operation

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The risk treatment plan must be put into effect, and documented information on the results of risk treatment must be retained.

How the 2020 guidance taught the audit

Auditors confirm that, after each iteration of the risk assessment, the risk treatment process defined under 6.1 has been implemented and integrated into operations, including where implementation of treatment has failed. The audit practice guidance for A.3.1.3 applies as well.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause keeps the requirement to implement the risk treatment plan and retain the results.

Evidence an auditor asks for

• Risk treatmentISMS planning and the documented risk treatment process
• Risk treatmentRisk treatment plan and its implementation records
• Risk treatmentResults of risk treatment retained as documented information
• Risk treatmentStatement of Applicability reflecting the implemented controls

The questions an auditor will ask

Ask for the treatment plan and for the evidence that a treatment was implemented and its effect checked.

Common gaps

• Treatment plan exists but actions were never carried out
• Failed or delayed treatment not recognised or escalated
• Results of treatment not retained

Prepare before the next audit

Link the treatment plan to the SoA and to the control evidence. Test one treatment.

Cross-references