Risk management process and integration with ISO/IEC 27001
Domain 3 - Risk management process and integration with ISO/IEC 27001
This domain tests whether you can run risk management as a continual, integrated process rather than an annual spreadsheet exercise. The exam favours answers that connect risk outputs to ISMS planning, operation, performance evaluation and improvement.
Core rules
- The process is iterative: establish context, identify, analyse, evaluate, treat, communicate and consult, monitor and review, and record and report.
- ISO/IEC 27001:2022 requires risk assessment at planned intervals or when significant change occurs, and retention of documented information of results.
- Risk treatment produces a risk treatment plan and a Statement of Applicability; Annex A controls are selected on the basis of risk, not copied wholesale.
- Integration means risk criteria appear in planning, risk owners sit in the business, treatment progress is tracked in operations, and results feed management review and internal audit.
- Risk acceptance must be made by an authorised risk owner and recorded; treatment is not complete until residual risk is evaluated.
Worked example
A retailer introduces a new payment provider. The change triggers a risk assessment update. The team identifies a new supplier dependency, analyses outage and data-breach scenarios, evaluates them against tolerance, and adds contractual security requirements and monitoring. The risk treatment plan and SoA are updated, and the risk owner accepts the residual risk. Internal audit later checks that the change did not bypass the process. Reasoning: the trigger is significant change, and the evidence trail connects assessment to treatment to acceptance.
Traps
Treating the SoA as the risk register; treating risk assessment as a one-off project; letting IT alone accept business risk; selecting Annex A controls without risk justification; failing to reassess after changes, incidents or new threats.