Assess risk using explicit criteria

Concepts and distinctions

A risk scenario connects a source of harm, a vulnerable condition, an affected service and a consequence. “Phishing” is a threat label; “a stolen support credential enables unauthorized learner-record export” is closer to a decision-ready scenario. Distinguish inherent assumptions from the effect of existing controls and explain how the organization estimates likelihood and consequence.

Qualitative scales can support prioritization when their definitions are consistent. Multiplying arbitrary ordinal labels does not create a measured financial probability. Quantitative estimates also need defensible inputs, time horizons and uncertainty. Comparing two ratings is useful only when the assumptions and criteria are understood. Business owners help interpret consequences that a technical scanner cannot determine.

Apply the process and collect evidence

Define assessment criteria, ownership and review triggers before populating a register. Record evidence supporting the scenario and the safeguards already operating. Reassess when data sensitivity, exposure, business dependency or control effectiveness changes. A register should lead to treatment and ownership decisions, not simply become a catalogue of technical weaknesses.

Risk-method selection and an audit work programme

ISO/IEC 27005 is risk-management guidance, not a substitute for the ISMS requirements standard or a mandatory scoring formula. Establish consequence and likelihood criteria, acceptable uncertainty and risk-acceptance authority. Qualitative severity categories need consistent definitions; numerical loss estimates need justified assumptions. A legal-services firm may prioritize confidentiality of client files while also assessing availability of court-deadline records. Assess the actual service consequences rather than assuming every asset has the same criticality.

Convert risk priorities into an audit programme covering important processes over time. A particular audit plan then specifies objectives, criteria, scope, schedule, locations, interviewees, team assignments and sampling. Consider past findings, material changes and supplier dependencies when allocating time. Risk-based selection increases attention to significant uncertainty; it does not authorize silently excluding applicable requirements. Confirm auditor competence in the technologies and organizational processes being examined.