Risk communication, consultation, monitoring, review and recording
Domain 7 - Risk communication, consultation, monitoring, review and recording
This domain tests the connective tissue of the process: who is told what, when, and how evidence is kept. Examiners look for continual communication, active monitoring and auditable records.
Core rules
- Communication and consultation are integral at every step, not a final announcement. Plans identify stakeholders, purpose, timing, content and feedback channels.
- Consultation seeks input from risk owners, control owners, legal, business and external parties; it informs decisions rather than merely broadcasting them.
- Monitoring tracks risks, controls, treatment progress, changes in context and indicators; review validates whether assessment and treatment remain effective.
- Recording and reporting retain risk assessment results, criteria, assumptions, treatment plans, acceptances and decisions. ISO/IEC 27001 requires documented information as evidence.
- Reporting to top management should be decision-oriented: top risks, treatment status, residual risk, incidents and trends, not raw scores alone.
Worked example
A quarterly risk review examines a key risk register. A KRI shows failed-login attempts rising. The risk owner reviews the analysis, confirms the control is still effective, and updates the likelihood rating. The change, rationale and owner are recorded, and a summary goes to management review. Internal audit can trace the decision. Reasoning: monitoring detected a signal, review reassessed it, recording preserved the audit trail, and reporting supported governance.
Traps
Communicating only after incidents; recording scores without rationale or assumptions; letting the risk register go stale; using metrics unrelated to risk; treating communication as one-way; failing to retain evidence of acceptance and review.