risk assessment Archives - Audit and Risk

ISO 27001 Risk Assessment: How to Map Business Risks to Annex A Controls

By admin|2025-06-29T16:53:26+01:00June 30th, 2025|ISO27001 Certification, ISO27001 Implementation, Risk Assessment|

ISO 27001 Risk Assessment: How to Map Business Risks to Annex A Controls In a previous blog post, I explored whether organisations should choose scenario-based or asset-based risk management techniques when implementing ISO 27001. Today, I want to build on that discussion by examining a critical aspect that many organisations overlook: ensuring your risk register properly addresses the broader organisational risks that underpin the controls in Annex A. This isn't just about compliance box-ticking. When done correctly, your risk mapping demonstrates that you've genuinely considered the [...]

0

The Role of Continuous Improvement in ISO27001 Compliance

By admin|2024-09-01T16:21:41+01:00September 2nd, 2024|Information Security, ISO27001 Implementation|

The Role of Continuous Improvement in ISO27001 Compliance Overview Compliance with ISO27001 is not a one-time achievement but a continuous journey. The standard itself emphasises the importance of continuous improvement, advocating for ongoing enhancements to an organisation's Information Security Management System (ISMS). This blog post delves into the role of continuous improvement in maintaining ISO27001 compliance, exploring how you can use Plan-Do-Check-Act (PDCA) cycle, tools and techniques for continuous improvement. How to use the Plan-Do-Check-Act (PDCA) Cycle for ISO27001 The PDCA cycle, also known as the [...]

0

Scenario vs. Asset-Based Risk Assessments: Understanding the Key Differences

By admin|2024-08-26T09:14:20+01:00August 12th, 2024|Risk Assessment|

Scenario vs. Asset-Based Risk Assessments: Understanding the Key Differences Risk assessment is a crucial process for organisations to identify, analyse, and mitigate potential threats. Two common approaches to risk assessment are scenario-based and asset-based methods. Each has its strengths and is suited to different contexts. Scenario-Based Risk Assessment Scenario-based risk assessment focuses on identifying potential events or situations that could negatively impact an organisation. It is the one I would recommend for those organisations just starting out looking at the risks faced by their organisation as [...]

0

Risk Assessment – What scale should I use?

By admin|2024-08-26T09:11:17+01:00August 5th, 2024|Information Security, Risk Assessment|

Risk Assessment - What Scale should I use? When undertaking a risk assessment process, one of the key things you need to decide upon is the scale you are going to use. I have seen some very complicated risk assessment scales, ones with multiplication of values, a scale of 1 to 10, different areas for reporting risk. It doesn't have to be complicated. Actually the simpler the scale, the easier it is to evaluate risk. Keep it simple Unless your business is complex, multi-million pound and [...]

0

ISO 27001 – Risk Assessment Requirements

By admin|2023-11-23T12:18:47+00:00November 23rd, 2023|Risk Assessment|

ISO27001 - Risk Assessment Requirements Managing Risk: A Core Element of ISO 27001 Certification For organisations seeking ISO 27001 certification, implementing a comprehensive risk management program is essential for obtaining the certification. ISO 27001 requires a formal risk assessment policy and procedure to be in place. This can be a bit intimidating when you haven't done any formal risk management practices before. But remember that you are managing risk as a business owner or department head all the time. You may not see it that way [...]

0