A risk register full of identical medium scores
Harbourline Freight operates three warehouses and 180 vehicles. Its risk assessment method is a 5x5 matrix applied by 12 'risk champions' after a two-hour workshop. The register contains 412 entries. 260 are scored likelihood 3 and impact 3 and labelled 'medium'; 180 entries have no named risk owner; 41 of 96 treatment actions are past their due date. The register was last refreshed 13 months ago, although a new warehouse opened five months ago and a telematics platform was migrated to a cloud provider three months ago. The risk treatment plan lists 'ISO 27001 certification' as the treatment for eight risks. Management review minutes record the register as 'reviewed and accepted' but contain no decisions, resources or changes to risk criteria. The CISO says the matrix is 'objective because it uses numbers'. You have 3 audit days and a team of two.
1. Evaluate the conformity and effectiveness of the risk assessment and risk treatment process against ISO/IEC 27001 clauses 6.1.2, 6.1.3, 8.2 and 8.3. State how you would grade your findings and why.
Read the worked answer
A 5x5 matrix is not inherently nonconforming, but here the process does not produce a usable risk picture. Clause 6.1.2 requires defined risk criteria and a repeatable process that yields consistent, comparable results. With 260 entries all scored 3x3 and no acceptance criteria, the scoring is not discriminating between risks; the CISO's claim of objectivity confuses numeric labels with calibrated judgement. Clause 6.1.3 requires a treatment plan with owners, timelines and expected outcomes. Missing owners for 180 risks and 41 overdue actions show the plan is not being managed. 'ISO 27001 certification' is not a control and is circular as a treatment for eight risks.
Clauses 8.2 and 8.3 require the assessment and treatment to be repeated when significant change occurs. A new warehouse and a cloud migration are significant changes; no reassessment is evidenced. Management review 'accepting' the register without decisions or resources does not demonstrate direction or commitment.
I would raise a major nonconformity against the effectiveness of the risk assessment and treatment process, supported by specific minor findings for missing owners, overdue actions and the invalid treatment entries. Major is justified because the process cannot reliably prioritise risk or drive controls; the auditor cannot conclude the ISMS is achieving its intended outcomes. I would confirm the grading against the organisation's own nonconformity definitions before issuing the report.
2. Design an audit sampling and testing approach for the 412-entry register that gives defensible coverage in three audit days.
Read the worked answer
Stratify first rather than sampling randomly. Request the register with fields for risk ID, score, owner, asset or process, treatment action, due date and last review. Select all entries scored highest and all entries linked to the new warehouse, the cloud migration and the eight 'certification as treatment' risks. Then sample about 30 remaining entries across scores, business units and owners, including at least 10 with no owner and 10 with overdue actions.
For each sampled risk, trace the chain in both directions: risk to asset or process to applicable control to evidence that the control operates; and from a sample of incidents and changes back to whether risk was reassessed. Test treatment actions by asking for the deliverable, not the status field: a completed access review, a signed contract, a migration assessment. Interview four risk champions separately to see whether they applied the same criteria and can explain their scores. Compare workshop attendance and outputs for the new warehouse.
Record the population, selection method and any exclusions in the working papers. If the register cannot be exported reliably, treat that as an additional finding about documented information and use the interviews to establish whether a risk process exists in practice.