The ISO 27001 Clause 8.2 audit checklist is designed to help an ISO 27001 Lead Auditor conduct internal audits and external audits of ISO 27001 Clause 8.2 Information Security Risk Assessment.
The 10 point ISO 27001 audit plan sets out what to audit, the challenges faced and the audit techniques to adopt.
With over 30 years industry experience I will show you the audit checklist used by professional ISO 27001 Lead Auditors for ISO 27001 certification.
I am Stuart Barker, author of the Ultimate ISO 27001 Toolkit and this is the ISO 27001 Risk Assessment audit checklist.
Risk Identification
Verify that a systematic process is used to identify information security risks relevant to the organisation’s information assets.
Challenges
Incomplete identification of assets or threats. Failure to consider all relevant sources of risk.
Audit Techniques
Review risk registers, asset inventories, threat intelligence reports, and legal/regulatory requirements. Interview staff across different departments to identify potential risks.
Risk Analysis
Confirm that identified risks are analysed to determine their potential impact and likelihood.
Challenges
Subjectivity in risk assessments. Difficulty in quantifying impact and likelihood.
Audit Techniques
Review risk assessment methodology documentation. Examine risk analysis worksheets and reports. Interview risk assessors to understand their rationale.
Risk Evaluation
Ensure that risks are evaluated to determine their level of risk and prioritise them for treatment.
Challenges
Inconsistent application of risk criteria. Lack of clear decision making criteria for risk acceptance.
Audit Techniques
Review risk evaluation criteria and risk acceptance levels. Examine risk reports showing risk prioritisation. Interview management to understand how risk evaluation informs decision making.
Risk Acceptance
Verify that a documented process exists for accepting residual risks that are within the organisation’s risk appetite.
Challenges
Implicit risk acceptance without formal documentation. Risk acceptance decisions not aligned with business objectives.
Audit Techniques
Review risk acceptance documentation, including justifications for accepted risks. Interview management to understand their risk appetite.
Risk Treatment
Confirm that appropriate risk treatment options are selected and implemented for each identified risk.
Challenges
Selection of ineffective or inappropriate risk treatments. Lack of resources to implement risk treatments.
Audit Techniques
Review risk treatment plans, including details of chosen controls. Examine evidence of control implementation (e.g., policies, procedures, technical configurations).
Risk Register Maintenance
Ensure the risk register is kept up to date, reflecting changes in the organisation’s risk environment.
Challenges
Risk register not updated regularly. Changes in risk not captured in the register.
Audit Techniques
Examine the risk register for completeness. Review records of risk assessments and updates. Interview risk owners to understand how they monitor risks.
Methodology Review
Verify that the risk assessment methodology is reviewed and updated periodically to ensure its continued suitability.
Challenges
Risk assessment methodology not reviewed. Methodology not aligned with best practices.
Audit Techniques
Review documentation of the risk assessment methodology. Examine records of methodology reviews. Interview risk management personnel.
Competence of Risk Assessors
Ensure that individuals involved in risk assessments have the necessary skills and expertise.
Challenges
Lack of trained risk assessors. Reliance on individuals with insufficient knowledge of information security.
Audit Techniques
Review training records and qualifications of risk assessors. Interview risk assessors to assess their understanding of risk assessment techniques.
Consideration of External Factors
Verify that external factors, such as changes in the threat landscape, legal/regulatory requirements, and business environment, are considered in the risk assessment process.
Challenges
Failure to consider emerging threats. Lack of awareness of changes in the external environment.
Audit Techniques
Review threat intelligence reports, legal/regulatory updates, and industry best practices. Interview risk management personnel about how they monitor the external environment.
Communication of Risk Assessment Results
Ensure that the results of the risk assessment are communicated to relevant stakeholders, including management, risk owners, and other interested parties.
Challenges
Risk assessment results not communicated effectively. Lack of understanding of risk by stakeholders.
Audit Techniques
Review communication plans and records of risk assessment results. Interview stakeholders to assess their understanding of the risks.
Further Reading
ISO 27001 Clause 8.2 Information Security Risk Assessment
