Introduction: Why Risk Assessment Is the Heart of ISO 27001

“Show me your risk assessment.”

It’s the first question every ISO 27001 auditor asks. And how you answer determines the entire trajectory of your audit.

Risk assessment isn’t just a checkbox. It’s the engine that drives your entire Information Security Management System (ISMS).
Every control you select, every policy you write, every investment you make all of it flows from how you identify, analyze, and evaluate risk.

Yet it’s also the most misunderstood and poorly executed part of ISO 27001. Common mistakes include:

• Treating risk assessment as a one-time exercise instead of an ongoing process
• Using inconsistent scoring criteria
• Failing to link risks to actual controls
• Losing the risk register in a spreadsheet that nobody updates

What This Guide Covers

Understanding ISO 27001 Risk Assessment (Clause 6.1)

Before diving into the template, clarify what ISO 27001 actually requires.
Clause 6.1 (Actions to Address Risks and Opportunities) mandates that your organization must:

The 5-Step Risk Assessment Process

Step 1: Define Your Methodology

Before identifying a single risk, document the rules of the game:

• Risk acceptance criteria: Who can accept what level of risk?
• Impact scale: What does “high impact” mean (financial, reputational, operational, legal)?
• Likelihood scale: What does “likely” mean in your context (probability over 12 months)?

Pro tip: Keep it simple. A 4×4 matrix (Very Low → Very High) works well for most SMEs.

Step 2: Identify Assets and Threat Scenarios

Create a manageable inventory of:

• Assets: data, systems, people, processes
• Threat scenarios: what could happen to those assets
• Existing controls: what you already do today

Don’t list every server or laptop. Group assets by type (customer data, identity infrastructure, public applications) to keep it practical.

Step 3: Score Inherent Risk

For each scenario, score:

• Likelihood (using your defined scale)
• Impact (using your defined scale)
• Inherent risk (Likelihood × Impact)

The template calculates inherent scores automatically so your scoring stays consistent and auditable.

Step 4: Evaluate Controls and Score Residual Risk

This step is where many organizations lose the plot. Auditors want to see that you understand: what’s already in place and what risk remains.

• Document existing controls
• Rate effectiveness (High / Medium / Low / Not Effective)
• Calculate residual risk based on your criteria

A high inherent risk with strong controls may be acceptable. A medium inherent risk with weak controls often needs immediate action.

Step 5: Determine Treatment and Build a Plan

For risks above your appetite:

• Select treatment option (Modify, Retain, Avoid, Share)
• Choose Annex A controls that address the risk
• Assign an owner and due date
• Track progress and verify closure

Using Our Free Risk Assessment Template

The template is designed to keep your methodology consistent, your fields complete, and your evidence defensible.
Here’s what’s inside and how to use it without overcomplicating the process.

What’s Included

How to Use It Step by Step

1. Open the template and read the Instructions tab first.
2. Customize your scoring in the Methodology tab. Define what “High impact” means in dollars, downtime, or reputational impact.
3. Populate Asset Inventory with asset groups (e.g., Customer Data, Identity & Access, Cloud Infrastructure, Endpoints).
4. In the Risk Register, brainstorm realistic threat scenarios per asset group (misconfiguration, phishing, insider misuse, vendor failure).
5. Score likelihood and impact using dropdowns. The template calculates inherent risk automatically.
6. Document existing controls and rate effectiveness to calculate residual risk.
7. Move unacceptable risks into Treatment Plan and assign owners, due dates, and actions.
8. Use SoA Mapping to connect treatments to Annex A controls (this is what auditors want to see).
9. Review the Dashboard to understand posture, progress, and where leadership attention is needed.

Common Pitfalls to Avoid

Beyond the Template: Building a Living Risk Management Program

A spreadsheet no matter how good is still a snapshot. Mature organizations move toward continuous risk management.

Our free template gets you to Level 2. When you’re ready for Level 3, consider:

• Moving your risk register to SharePoint with automated workflows
• Building Power BI dashboards for leadership visibility
• Automating quarterly review assignments and reminders
• Integrating vulnerability scanning inputs into risk review

How to Get the Most Out of Your Risk Assessment

About the Author

Canadian Cyber helps Canadian organizations achieve ISO 27001 certification efficiently through practical tooling, clear guidance, and sustainable compliance programs.
Let’s build something secure together.