Unlocking the Secrets of ISO 27001 Risk Assessment

The “secret” of ISO 27001 risk assessment is that there is no secret — there is a sequence: define scope and criteria, inventory information assets, identify threats and vulnerabilities against them, score likelihood and impact, evaluate against your acceptance criteria, choose treatments, and map the resulting controls into the Statement of Applicability against the 2022 edition’s 93 controls in four themes. Everything else in the standard hangs off this sequence, and auditors read your risk assessment first because it explains — or fails to explain — every control decision you made. Here is each step done properly, and the mistakes that hollow it out.

Why the risk assessment carries the whole ISMS

ISO 27001’s architecture is deliberate: it does not hand you a fixed control checklist; it requires you to justify controls from assessed risk. That is what makes the certificate meaningful across a bank, a BPO and a software house at once — each protects what it actually holds, against what actually threatens it. It is also why a copied risk register is the most self-defeating shortcut in this standard: controls justified by someone else’s risks collapse under the first auditor question, and worse, they leave your real exposures unmanaged while the paperwork looks complete. The full certification picture around the assessment lives in our ISO 27001 certification guide.

Steps 1–2: scope, criteria, and an asset inventory that tells the truth

Before assessing anything, fix the frame: the ISMS scope (which entities, services and systems), your risk methodology, and — the piece teams skip — explicit acceptance criteria, so “how much risk is too much” is a management decision made once, not improvised per row. Then inventory information assets with owners: systems and applications, data stores, endpoints and infrastructure, people and their knowledge, suppliers and the services they carry. The discipline that pays here is honesty about shadow reality — the spreadsheet that actually runs payroll, the vendor portal with your customer data, the shared drive nobody governs. Philippine BPOs and IT providers should map client-entrusted assets explicitly; they are what vendor-risk auditors ask about first.

Steps 3–4: identify and score — with the people who run the systems

For each asset, identify what could go wrong (threats: phishing and social engineering, credential abuse, ransomware, insider error and misuse, outages, physical loss) through what weakness (vulnerabilities: unpatched systems, over-broad access, missing encryption, single points of failure, untrained users). Then score likelihood and impact on your defined scales — consistently, with rationale recorded. Run these as workshops with system owners rather than a solo analyst exercise: the risks that hurt are operational details the owners already know and nobody wrote down. Keep scales simple enough to use in a meeting; a five-by-five matrix applied honestly beats a quantitative model applied once.

Steps 5–6: treat the risks, then let the SoA tell the story

Each evaluated risk gets a decision: mitigate with controls, transfer (insurance, contracts), avoid (stop the risky activity), or accept — explicitly, with sign-off at the level your criteria demand. Mitigations map to Annex A of ISO/IEC 27001:2022: 93 controls across organizational, people, physical and technological themes, including the 2022 additions such as threat intelligence and cloud services security. The Statement of Applicability then records every control as applicable or excluded, justified either way, with implementation status — the single document that connects risk to action, doubles as your implementation checklist, and gets cross-examined first at Stage 2. A risk treatment plan with owners and dates closes the loop from analysis to work.

Keeping it alive — and extending it where your exposure grows

A risk assessment is a living instrument: re-run on schedule and on change — new clients, new systems, new suppliers, incidents that proved a score wrong. Feed monitoring and incident data back into likelihoods; let internal audit test whether treatments actually operate; put risk acceptance decisions in front of management review. And extend the same method where your exposure concentrates: privacy risks to personal data flow into ISO 27701, a natural fit with Data Privacy Act obligations; cloud-service risks into ISO 27017 controls; PII-in-the-cloud into ISO 27018. One assessment discipline, several audiences served — which is the efficient shape of a security program, and the budget logic behind it sits in our cost guide.

The five mistakes that hollow out risk assessments

Auditors and incidents find the same five. A copied register describing someone else’s company. No owners — risks assessed but nobody accountable for treatments. Frozen assessments — done for certification, untouched since, contradicted by two years of change. Scoring theater — numbers without recorded rationale, drifting with the mood of the meeting. And acceptance by silence — high risks neither treated nor explicitly accepted, just quietly carried. Each is cheaper to fix at assessment time than at audit time, and far cheaper than at incident time — which is, after all, the assessment’s real deadline.

Continue with the ISO 27001 certification guide and the complete Philippine certification guide, or read how certified companies describe the journey in their signed feedback letters — then book a free consultation and run your first risk workshop with an expert in the room.

Reviewed by Ann Reyes, Lead Auditor (Davao), Sterling International Consulting.