Risk Assessment That Never Reaches Treatment
Vantage Health runs an annual risk assessment. This year the team scored 96 assets on a 1-5 likelihood/impact matrix and produced a 40-page register. The methodology is documented. However: the register has not been reviewed since it was produced eight months ago; three assets rated "high" have no treatment decision recorded; the risk treatment plan lists controls but not which risks they address; and the risk acceptance authority is undefined - the IT director has been signing off on "high" risks without a documented threshold. A new patient-portal integration went live two months ago and is not in the register. The auditor will sample the risk process.
1. Evaluate this risk process against Clause 6.1.2 and 6.1.3. Which specific requirements are unmet?
Read the worked answer
Clause 6.1.2 requires a defined and applied risk assessment process that produces consistent, valid, comparable results, and that risks are identified, analyzed, and evaluated with owners. Clause 6.1.3 requires a risk treatment plan with risk owners, selected treatments, and the risks they address, plus a Statement of Applicability and documented risk acceptance criteria.
Unmet requirements:
- 6.1.2 (currency): the register is 8 months stale and excludes the new patient-portal integration. Risks are not being identified on an ongoing basis; results are not comparable over time.
- 6.1.3 (treatment linkage): three "high" assets have no treatment decision, and the treatment plan does not map controls to risks. The plan cannot demonstrate that treatments address the identified risks.
- 6.1.1 / 6.1.3 (acceptance criteria): risk acceptance authority and thresholds are undefined, and the IT director is accepting "high" risks without a documented basis. Acceptance must be against defined criteria by an authorized person.
The methodology being documented is necessary but not sufficient - the process must be applied, current, and traceable from risk to treatment to owner.
2. The IT director argues the register is "comprehensive enough" and that re-running it is unnecessary before the audit. How should the ISM respond, and what is the minimum defensible remediation?
Read the worked answer
Comprehensiveness is not the test. The test is whether the process is applied and current and whether risks are traceable to treatments and owners (6.1.2, 6.1.3). A 40-page stale register with unmapped treatments will fail a sample regardless of size.
The ISM should reframe the argument: this is not about redoing 96 assets, it is about closing three traceable gaps before the auditor samples them.
Minimum defensible remediation:
- Add the patient-portal integration to the register with an assessment - it is a live, in-scope change.
- Record treatment decisions for the three high assets, with named owners and a mapped control or a documented acceptance.
- Map the treatment plan to risks so each control traces to a risk it addresses.
- Define acceptance criteria and authority (thresholds, who may accept which risk level) and re-ratify the IT director's prior acceptances against them.
- Set a review cadence so currency is demonstrable.
This is achievable in days, not weeks, and converts a likely major nonconformity into a closed finding with evidence.