ISO 27001 Risk Assessment Template

14

sections the document needs

4

wordings people reliably get wrong

7

things an auditor asks to see

a week

to write it yourself

Get these as editable documents - your first document is free Card required; no charge today.

1. 1

   Purpose and scope

   What it must contain

   What the method covers, and its place among the three risk documents: this is the method, the policy is the commitment, the register is the record.

   What the auditor checks

   Whether the three documents describe the same process. A methodology that contradicts the policy it sits under is the fastest way to turn a document review into a deep audit.

2. 2

   Roles and responsibilities

   What it must contain

   Who owns the method, who owns each risk, and who approves the criteria and accepts residual risk - by role, not by person.

   What the auditor checks

   That approval sits with someone senior enough to accept the consequence, and not with the person who performed the assessment. Separation here is the point.

   Approval of this methodology and of the risk acceptance criteria rests with [approver role], who also formally accepts any residual risk that remains above appetite. Approval sits with a role senior enough to accept the consequence, and not with the person who performed the assessment.

   It names the separation explicitly rather than leaving it implied, which is what an auditor is looking for when they ask who signed off.

3. 3

   The likelihood scale

   What it must contain

   Five levels, each with a definition rather than a bare number, rated over a stated time horizon and against the controls actually in place.

   What the auditor checks

   Whether two people would rate the same risk the same way. A scale of 1 to 5 with no definitions is the most common reason two assessors disagree.

4. 4

   The consequence scale

   What it must contain

   Five levels defined in terms of real harm - cost, disruption, regulatory exposure and harm to individuals - not adjectives alone.

   What the auditor checks

   That the scale covers harm to people and not only harm to the business. An assessment that only counts cost misses the consequences a regulator cares about.

5. 5

   The risk matrix and score bands

   What it must contain

   How likelihood and consequence combine into a score, the matrix that maps every combination to a band, and the score range each band covers.

   What the auditor checks

   Internal consistency, cell by cell. Every cell's label has to agree with the bands the document itself defines, and a matrix that contradicts its own bands is a finding an auditor can see in seconds.

   Multiply likelihood by consequence, both rated 1 to 5. Read the band off the matrix below. The same matrix is used for the inherent risk, before any control, and again for the residual risk after the chosen treatment is in place.

   One sentence fixes the two things people get wrong: how the score is produced, and that the same scale is applied twice rather than once.

6. 6

   Risk acceptance criteria

   What it must contain

   What each band obliges you to do: which risks must be treated, which are monitored, which may be accepted, and who may accept them.

   What the auditor checks

   This is the clause 6.1.2 a) requirement, and it is checked directly. Criteria that exist but are not applied consistently in the register are worse than no criteria at all.

7. 7

   Risk identification

   What it must contain

   Where risks come from, and the requirement to write each one as a cause, an event and an effect rather than a one-word label.

   What the auditor checks

   Whether the risks are specific enough to treat. "Phishing" cannot be assessed or treated; a named event with a named effect on a named system can.

   Risks are written as a cause, an event and an effect, so that they can be assessed and treated rather than merely named. "Phishing" is not a risk; "an employee is deceived by a phishing email, exposing customer records held in [system], leading to a notifiable breach" is.

   It gives the reader a worked contrast rather than an instruction, which is the difference between a register of labels and a register that can be acted on.

8. 8

   Risk analysis and evaluation

   What it must contain

   Rating each risk for likelihood and consequence, recording the reasoning behind the rating, and comparing the result against the acceptance criteria.

   What the auditor checks

   That the reasoning is recorded, not just the score. A rating with no reasoning cannot be reviewed and cannot be defended once the assessor has left.

9. 9

   Risk treatment options

   What it must contain

   The four options - modify, avoid, share, retain - and the requirement to record which was chosen and why.

   What the auditor checks

   That sharing a risk is not being treated as transferring accountability. A contract or an insurance policy moves consequence, never responsibility for the information.

10. 10

    Determining controls and the Statement of Applicability

    What it must contain

    That controls are chosen because they treat an identified risk, then compared against Annex A to confirm nothing necessary was left out.

    What the auditor checks

    The direction of travel. Controls chosen from a list and reverse-justified read differently from controls chosen from risk, and clause 6.1.3 c) expects the latter.

    Controls are chosen because they treat an identified risk, not because they appear on a list. Once the necessary controls are determined, they are compared against Annex A of ISO/IEC 27001:2022 to confirm that nothing necessary has been left out.

    It states the order explicitly, which is the single sentence that separates a real methodology from a template that assumes the control set came first.

11. 11

    Residual risk and approval

    What it must contain

    Re-rating the risk after treatment using the same scales, and recording both the risk owner's approval of the plan and the acceptance of what remains.

    What the auditor checks

    Both approvals, because clause 6.1.3 f) requires both. A treatment plan approved with no residual acceptance recorded is an incomplete record.

12. 12

    The risk register

    What it must contain

    That every risk, treated or accepted, is recorded in one place with its whole lifecycle in a single row.

    What the auditor checks

    That the register and the methodology agree. A register scored on a scale the methodology does not define is the contradiction most often found in practice.

13. 13

    When the assessment is repeated

    What it must contain

    The scheduled cycle, plus the change triggers that require a risk to be reassessed before the next cycle comes around.

    What the auditor checks

    Evidence it was actually repeated. A register whose last change predates a migration, a restructure or an incident has stopped describing the organization.

14. 14

    Records and review

    What it must contain

    What the process produces, how long it is kept, and when the method itself is reviewed and re-approved.

    What the auditor checks

    That changes to the scales or the acceptance criteria were approved before they were used, not afterwards.

Get these as editable documents - your first document is free Card required; no charge today.

Nobody is asked to demonstrate that they take risk seriously. You are asked how a rating was arrived at, who accepted what, and when it last changed. These 7 requests cover most of what the risk section of an audit consists of.

? Show me your risk assessment methodology.

Satisfies One current, approved document defining scales, a matrix, acceptance criteria and the process - the same one the register was actually scored against.

Fails A spreadsheet of risks with no method behind it, or a method nobody can say is approved.

? How did you arrive at this rating?

Satisfies The likelihood and consequence definitions applied to the facts of that risk, with the reasoning recorded on the row.

Fails A number with no reasoning, or an answer that only the person who wrote it could give.

? What are your risk acceptance criteria, and who approved them?

Satisfies Bands with score ranges, what each obliges you to do, and a named approving role with a date.

Fails Criteria that exist in the methodology but are not followed in the register.

? Show me a risk you accepted, and who accepted it.

Satisfies A recorded acceptance by a role with authority to accept that consequence, with the reason and the date.

Fails An accepted risk with no named acceptor, or acceptance by the person who performed the assessment.

? How does this register relate to your Statement of Applicability?

Satisfies Treatments citing Annex A references, and the same decisions reflected in the Statement of Applicability.

Fails A control treated in the register but excluded in the Statement of Applicability, or the reverse.

? When did you last reassess, and what changed?

Satisfies A dated cycle at least annually, plus reassessments triggered by incidents, new systems or scope changes.

Fails A register unchanged since certification while the business demonstrably moved.

? Show me the treatment for this high risk being carried out.

Satisfies The evidence the control produces: a ticket, a completed review, a configuration, a record.

Fails A treatment marked complete with nothing showing that it happened.

Almost none of these are about risk. They are about three documents that were written separately and never reconciled, and a matrix nobody checked against its own bands.

• ! A matrix that contradicts its own score bands

  The most common defect in a downloaded methodology, and the easiest to spot. If your bands say 5 to 9 is Medium, then every cell scoring 9 has to read Medium. Check all twenty-five cells by hand after any change to the scales, because a single wrong cell undermines every rating derived from it.

• ! Scales that are numbers without definitions

  A 1 to 5 scale with no meaning attached produces a different answer for every assessor, which is the one thing a methodology exists to prevent. Define each level in terms someone outside security can apply, and state the time horizon likelihood is judged over.

• ! Rating the risk you wish you had

  Likelihood is judged against the controls actually in place today, not the ones in the treatment plan. Rating the intended state produces a register where nothing looks urgent and the treatment plan has no reason to exist.

• ! Choosing controls first and finding risks to justify them

  Clause 6.1.3 expects controls to be determined from risk, then compared against Annex A to check nothing was missed. A register that reads as a reverse-engineered justification of a control set you already bought is visible to an experienced auditor within a few rows.

• ! Treating "share" as making the risk someone else's problem

  Insurance and contracts move consequence. They never move accountability for your information. A shared risk still needs an owner, a residual rating and a monitoring arrangement.

• ! Never recording residual risk

  Recording the inherent rating and the treatment but not re-rating afterwards leaves no evidence the treatment worked, and no basis for the acceptance clause 6.1.3 f) requires. Rate it twice with the same scale, and the effect of the treatment becomes visible.

• ! A register that stops moving

  The risk assessment is the ISMS document most sensitive to change. Reviewed only before an audit, it stops being a management tool and becomes a snapshot of the year you were certified. Reassess on the triggers, not just on the calendar.

Same structure as the guide, with none of the decisions left to you: scales defined in your terms, a matrix whose every cell agrees with the bands beneath it, acceptance criteria set to your appetite, and a register laid out to carry each risk from inherent rating to residual. It cites the clauses it satisfies, carries your branding, and exports to Word, PDF or Excel. The cover in the hero and the body page below are exactly that output, generated for an example company.

Both routes end with the same three documents. What differs is how many of the decisions inside them you make alone, how much reconciling you do between them, and who checks the result before an auditor does.

Scroll the table sideways to compare both routes.