One group, two incompatible risk methodologies
MedDevices Group has two business units. Unit A has been ISO/IEC 27001 certified since 2021 and uses a five-step risk process aligned to ISO/IEC 27005, with a risk register linked to its Statement of Applicability. Unit B, acquired 18 months ago, uses a home-grown 'cyber heat map' scored by the IT manager and has no documented risk owners; its treatment decisions are recorded in emails. Group internal audit found that the group-level risk report aggregates both sets of scores into one 'red/amber/green' dashboard, and that three risks rated 'high' in Unit B have no treatment plan. The group CISO wants a single methodology across both units before the next surveillance audit and a board report that shows risk against appetite. Unit A's manager objects that harmonisation will invalidate a register that has passed two audits; Unit B's CIO says the group process is too heavy for a 90-person unit. There are 1,700 employees, 14 sites, and a shared SAP instance.
1. Assess the conformity and governance problems in the current situation and explain what ISO/IEC 27005 and ISO/IEC 27001 require for a group-wide approach.
Read the worked answer
Conformity problems. ISO/IEC 27001 requires a documented risk-assessment process, defined risk criteria, identification, analysis, evaluation, treatment, risk owners, acceptance, and documented information, with the Statement of Applicability justified by the risk assessment. Unit B's heat map may be a useful local tool, but it lacks documented owners, treatment plans, and an auditable link to controls. Unit A may be broadly conformant, but that does not justify a group dashboard that combines incompatible scales. Aggregating ordinal scores from two methodologies into one RAG status is misleading and can conceal high risks. Emails are weak records for treatment decisions.
Governance problems. There is no group-approved risk criteria or acceptance authority; Unit B's high risks have no treatment plan; the board may be receiving false assurance; and local autonomy is being defended in ways that undermine group oversight.
What the standards require. ISO/IEC 27001 requires the organisation to define and apply a risk-assessment process and retain documented results. ISO/IEC 27005 provides guidance on how to do this consistently, including context, identification, analysis, evaluation, treatment, communication, and monitoring. It does not demand identical depth everywhere. A group-wide approach can be tiered and proportionate, but it must use common criteria, common records, clear ownership, and defensible aggregation. Unit A's register need not be discarded; it can be mapped and gap-closed.
2. Design a harmonised methodology that is credible to auditors and workable for a 90-person unit. Include essential elements and a migration path.
Read the worked answer
Essential elements. A group risk policy and risk criteria approved by top management; a common taxonomy and scenario format; common likelihood and impact scales with anchors; a register schema including owner, treatment, residual risk, acceptance authority, and review date; a treatment-plan template; and a clear link to the Statement of Applicability and ISMS processes.
Proportionality. Use a tiered approach. Full assessment applies to shared SAP, group services, regulated products, and high-value assets. A lighter method applies to local Unit B systems, but it must use the same scales, owners, and acceptance rules. High-risk scenarios are mandatory regardless of unit size. This addresses the CIO's concern without creating a two-tier governance gap.
Migration path. Perform a gap analysis of both registers; map Unit A's existing entries to the common schema and preserve prior evidence; reassess Unit B's three high risks first; pilot the common template; train risk owners; obtain group approval; and have internal audit review the transition. Keep a transition period during which local variations are documented and justified. Do not declare the old heat map equivalent until the high risks have owners, treatment plans, and acceptance decisions. This protects Unit A's audit history while giving the group a single, auditable method.
3. How should the group board report risk against appetite without creating false precision?
Read the worked answer
Report by risk band and count, not by summing scores. Show the top risks with owner, residual rating, treatment status, trend, and confidence. Separate inherent and residual risk, and distinguish risks inside appetite from those outside appetite. Present appetite thresholds by category, such as safety, regulatory, financial, and availability, rather than a single composite number. Avoid averaging ordinal scores; an average of 'high' and 'low' is not 'medium' in any meaningful sense.
Aggregate only where the scales are genuinely comparable and the methodology has been harmonised. Until then, label Unit B's data as provisional. Give the board the decisions it must make: accept a residual risk above its authority, fund a treatment, or escalate a risk outside appetite. Include overdue treatments and data-quality limitations. Use scenario ranges for financial exposure rather than a single precise figure. This gives the board a defensible view of risk against appetite without implying a precision that the underlying assessments do not have.