ISO 27001 Risk Assessment: How to Run It, and What a Certification Auditor Checks
The risk assessment is where an ISMS either holds together or falls apart. Here is what ISO 27001 actually requires, a step-by-step method, and what an auditor looks for when they test it.
Stage 2 of an ISO 27001 audit. The auditor picks one line from the risk register: "Customer data exposed through a misconfigured cloud storage bucket." Who owns this risk? Which controls treat it? Where is the evidence they work? And when the company moved to a new cloud provider in the spring, did anyone reassess it?
Those four questions test most of what ISO 27001 asks of a risk assessment. This guide walks through the requirements and a practical method, from the point of view of the certification body that audits them.
Quick answer: An ISO 27001 risk assessment is the process, required by clause 6.1.2 of ISO/IEC 27001:2022, for identifying, analysing and evaluating risks to the confidentiality, integrity and availability of information in your ISMS scope. You set risk criteria, name a risk owner for each risk, score each one for consequence and likelihood, and decide which to treat. Clause 6.1.3 turns the results into a risk treatment plan and a Statement of Applicability, and clause 8.2 requires you to repeat the assessment at planned intervals and after significant changes.
What ISO 27001 Requires for Risk Assessment
Four clauses carry the risk requirements. Each one also requires documented information, which is what the auditor reviews.
| Clause | What it requires | Evidence to keep |
|---|---|---|
| 6.1.2 Risk assessment | Define and apply a process that sets risk acceptance criteria and criteria for performing assessments, gives consistent, valid and comparable results, identifies risks and risk owners, analyses consequence and likelihood, and evaluates and prioritises risks | The documented risk assessment process |
| 6.1.3 Risk treatment | Choose treatment options, determine the controls needed, compare them with Annex A so nothing necessary is missed, produce a Statement of Applicability and a risk treatment plan, and get risk owners to approve the plan and accept residual risk | Statement of Applicability, risk treatment plan, risk owner approvals |
| 8.2 Risk assessment in operation | Carry out risk assessments at planned intervals, and when significant changes are proposed or occur | Results of each risk assessment |
| 8.3 Risk treatment in operation | Implement the risk treatment plan | Results of risk treatment |
These clauses sit inside the wider ISMS requirements. Our guide to ISO 27001 requirements covers clauses 4 to 10 and the full Annex A list.
How to Conduct an ISO 27001 Risk Assessment in 7 Steps
1. Confirm your scope and context
Start from the ISMS scope and the context you set under clause 4: the internal and external issues and the requirements of interested parties, such as customers and regulators. Since Amendment 1:2024, that includes deciding whether climate change is a relevant issue. Risks outside the scope do not belong in the assessment, and risks inside it cannot be left out.
2. Set your risk criteria
Before you score anything, write down how you will score it. Define a scale for consequence and for likelihood, how they combine into a risk level, and the risk acceptance criteria, the level at or below which a risk can be accepted. This is what makes the results consistent, valid and comparable when different people assess, or when you repeat the assessment next year.
3. Identify risks and risk owners
List the events that could cause a loss of confidentiality, integrity or availability for information in scope. Give each risk an owner, a person with the authority to approve its treatment and accept what is left. A job title is fine, as long as someone real holds it.
4. Analyse each risk
Assess the potential consequence if the risk happens and the realistic likelihood that it will, taking into account the controls already in place. Combine the two into a risk level using your criteria.
5. Evaluate and prioritise
Compare each risk level with your acceptance criteria. Risks above the line need treatment, and the highest come first.
6. Treat the risks and build the Statement of Applicability
For each risk that needs treatment, choose an option: modify the risk with controls, avoid it by stopping the activity, share it, for example through insurance or a supplier contract, or retain it with an informed decision. Determine the controls you need, then check them against all 93 Annex A controls so nothing necessary is missed. Record the result in your Statement of Applicability, and write a risk treatment plan with actions, owners and dates. Each risk owner then approves the plan and accepts the residual risk.
7. Repeat at planned intervals and after significant changes
Decide when you will reassess, and stick to it. Also reassess when something significant changes, such as a new product, a new hosting provider, an acquisition or a major incident. Keep the results of each assessment and of the treatment actions.
Preparing for certification? See how our accredited ISO 27001 audits run, from free scope review to certificate.
See ISO 27001 certificationISO 27001 Risk Register Example
An illustrative entry on a 1 to 5 scale for consequence and likelihood, multiplied into a score out of 25, with risks scored 6 or below accepted. Your own scales and threshold can differ, as long as you define them in advance.
| Field | Example |
|---|---|
| Risk | Customer data exposed through misconfigured cloud storage |
| Affects | Confidentiality |
| Risk owner | Head of Engineering |
| Consequence × likelihood (before treatment) | 5 × 3 = 15, above acceptance level |
| Treatment | Modify: configuration baselines, automated checks for public storage, access reviews |
| Annex A controls | 5.23 Information security for use of cloud services, 8.9 Configuration management, 5.18 Access rights |
| Residual score | 5 × 1 = 5, accepted by the risk owner |
| Next review | At the annual reassessment, or on any change of cloud provider |
Asset-Based or Event-Based? Choosing a Method
ISO 27001 does not prescribe a method. ISO/IEC 27005:2022, the guidance standard on information security risk management, describes two approaches that can be used together.
| Point | Event-based | Asset-based |
|---|---|---|
| Starting point | Risk scenarios: a chain of events from a cause to an unwanted consequence | Assets, with their threats and vulnerabilities |
| View | High-level and strategic | Detailed and operational |
| Works well for | Smaller or cloud-first scopes, and leadership discussions | Larger scopes with many systems and suppliers |
| Watch out for | Scenarios too vague to link to controls | Long asset lists that hide the risks that matter |
Whichever you choose, the auditor tests the same thing: does your method meet clause 6.1.2, and does it lead clearly to the controls you selected? ISO 27005 cannot be certified, and neither can ISO 27002. Both are guides that support your ISO 27001 ISMS.
What a Certification Auditor Checks in Your Risk Assessment
At Stage 1, our auditors review the documented process and the latest results to confirm you are ready for Stage 2. At Stage 2, they test whether the process works in practice. Typical checks include:
- The criteria are defined and used. Risk scores follow the scales and acceptance level in your documented process.
- Results are consistent. Similar risks get similar scores, whoever assessed them.
- Every risk has an owner, and owners approved the treatment plan and accepted residual risk.
- Risks trace to controls. The auditor picks risks and follows them to Statement of Applicability entries and evidence that the controls operate.
- Annex A exclusions are justified by your risks and scope, not by convenience.
- The assessment is current. It was repeated when planned, and after significant changes.
- Treatment actions are done, or tracked with owners and dates.
For the full audit path, read how to get ISO 27001 certified. Risk work can often be reviewed online, see our guide to remote ISO audits.
Common Audit Findings in ISO 27001 Risk Assessments
- No defined risk acceptance criteria, or criteria that are never applied.
- Risk owners missing, or every risk owned by one person.
- A Statement of Applicability that does not match the risk treatment plan.
- Annex A controls excluded with no justification linked to the risks.
- A one-off assessment from the start of the project that was never repeated.
- No reassessment after a major change, such as moving to a new cloud platform.
- Residual risks never formally accepted.
Most of these are quick to fix before Stage 2 if you find them early. Building an AI product as well? ISO 42001 adds AI risk and impact assessments on the same high-level structure, so the method carries over.
Who Should Carry Out the Risk Assessment?
Your own team, or an independent adviser. An accredited certification body must stay impartial under ISO/IEC 17021-1, so it cannot write or run the risk assessment it will later audit. That separation is what makes the certificate worth something to your customers. Accredify Global audits your risk assessment against ISO 27001, and buyers can check every certificate on our certificate verification page.
Want to audit risk assessments yourself?
Learn to plan, lead and report ISMS audits against ISO/IEC 27001:2022.
ISO 27001 Certification with Accredify Global
Accredited
ISO/IEC 27001 is in our UAF accreditation scope, under the IAF MLA.
Senior auditor
A senior auditor leads your Stage 1 and Stage 2 audits, including the risk assessment review.
Remote or hybrid
Cloud-first startups and SaaS teams can be audited largely or fully remotely, in line with the accreditation rules.
Fixed fee
One fixed-fee proposal for your real scope, with no hidden costs or scope creep added later. See ISO 27001 certification cost.
Planning ISO 27001 certification?
Tell us your scope, people and systems. We'll explain the audit, the days it needs, and send one fixed-fee proposal.
Book your free scope review →ISO 27001 Risk Assessment FAQ
What is an ISO 27001 risk assessment?
It is the process ISO/IEC 27001 requires you to define and apply to find the risks to the confidentiality, integrity and availability of information in your ISMS scope. You set risk criteria, identify risks and their owners, analyse the likely consequence and likelihood of each, and evaluate which ones need treatment. The results drive the controls you choose and your Statement of Applicability.
Which clause of ISO 27001 covers risk assessment?
Clause 6.1.2 sets out how the risk assessment process must work, and clause 6.1.3 covers risk treatment and the Statement of Applicability. Clause 8.2 requires you to carry out risk assessments at planned intervals and when significant changes happen, and clause 8.3 requires you to implement the risk treatment plan. You keep documented information for each.
How often should an ISO 27001 risk assessment be done?
ISO 27001 does not set a fixed frequency. It requires risk assessments at planned intervals that you define, and whenever significant changes are proposed or occur, such as a new product, a new cloud provider or a merger. Many organizations reassess at least once a year, so the results are current before each surveillance audit.
Does ISO 27001 require an asset-based risk assessment?
No. Since the 2013 edition, ISO 27001 has not required you to start from an asset list. You can use an asset-based approach, an event-based or scenario-based approach, or a mix. ISO/IEC 27005:2022 describes both. What the auditor checks is that your method meets clause 6.1.2 and produces consistent, valid and comparable results.
What documents will the auditor ask for?
Expect to show your documented risk assessment process, including risk acceptance criteria, the results of your risk assessments, your risk treatment plan, your Statement of Applicability, and evidence that risk owners approved the plan and accepted the residual risks. At later audits, the auditor also asks for the results of risk treatment and of reassessments after changes.
Can I use a spreadsheet or template for an ISO 27001 risk assessment?
Yes. ISO 27001 does not require any particular tool. A well-kept spreadsheet risk register is acceptable if it applies your criteria consistently, names a risk owner for each risk, links risks to controls in your Statement of Applicability, and is kept up to date. Software can help with larger scopes, but the auditor looks at the method and the evidence, not the tool.
What are risk acceptance criteria in ISO 27001?
They are the rules you set in advance for deciding when a risk is low enough to accept without further treatment, for example any risk scored 6 or below on a 25-point scale. Clause 6.1.2 requires you to define them, alongside the criteria for performing risk assessments, so different people reach the same decision on the same risk.
Can our certification body do the ISO 27001 risk assessment for us?
No. An accredited certification body must stay impartial under ISO/IEC 17021-1, so it cannot design, write or run parts of the ISMS it later certifies. Accredify Global audits your risk assessment against ISO 27001. Your own team, or an independent adviser with no link to the certification body, carries it out.
Is ISO 27005 required for ISO 27001 certification?
No. ISO/IEC 27005:2022 is guidance on managing information security risks, and you cannot be certified to it. Many organizations use it to design their risk assessment method, but the auditor checks your process against the requirements in ISO 27001 clauses 6.1.2, 6.1.3, 8.2 and 8.3.