The risk assessment is the engine of ISO 27001: it decides which controls you implement and why. It's also, in the traditional approach, a workshop that produces a 200-row spreadsheet nobody opens again until audit week. Both facts can't stay true if you want a real ISMS.
What the standard actually requires
Less than the folklore suggests. You need a defined method (consistent, repeatable), identified risks to information confidentiality, integrity, and availability, an evaluation against criteria you set, and a treatment decision per risk, mitigate, transfer, avoid, or accept, with owners. The standard doesn't mandate a 5×5 matrix, asset-by-asset enumeration, or any particular tooling.
Principles that keep it honest
- Start from your real stack. Risks live in your actual vendors, repositories, and cloud accounts, not in a generic threat catalogue. "Laptop theft" matters less to a remote SaaS than an over-privileged service account.
- Simple scales, used consistently. A 3×3 likelihood-impact scale applied honestly beats a 5×5 applied theatrically. Auditors test consistency, not sophistication.
- Every risk gets an owner. Unowned risks are the finding auditors love most, because they predict everything else.
- Acceptance is a decision, not a default. Accepting a risk is legitimate, silently ignoring it is not. Documented acceptance with a review date is a passing answer.
A ten-risk register with owners and treatments beats a two-hundred-row spreadsheet with neither.
The living register
The audit question that kills static assessments is "when did you last update this, and why?" A register connected to reality has good answers: a new vendor appeared in the registry, a vulnerability finding raised a risk's likelihood, a fixed misconfiguration lowered one. That link between exposure data and the register is what turns the assessment from ceremony into engine.
How Certixa runs it
The AI proposes your initial register from your connected stack and vendors, realistic risks, pre-scored, with suggested treatments mapped to Annex A controls. You adjust owners and appetite in an afternoon. From then on, findings from your integrations update the register automatically, and the Statement of Applicability stays traceable to it. That's the whole loop the auditor wants to see.