Auditing ISO 27001 Clause 6: Risk Assessment, Risk Treatment and Objectives
Clause 6 is audited by tracing individual risks end to end rather than by reading the risk register. Take one real high-rated risk and follow it through identification, ownership, analysis, treatment, the Statement of Applicability, the treatment plan and residual acceptance. The step that breaks tells you which sub-clause letter to cite.
Clause 6 is audited by tracing individual risks end to end rather than by reading the risk register. Take one real high-rated risk and follow it through identification, ownership, analysis, treatment, the Statement of Applicability, the treatment plan and residual acceptance. The step that breaks tells you which sub-clause letter to cite.
This is the most heavily audited clause in the standard, and a great deal of what an audit finds elsewhere traces back to it. The clause reference sets out what each sub-clause requires; this page is about how you get the evidence.
The worked findings on this page are invented, and so are the organisations in them. They are written to show how a finding is built and graded, not to catalogue the findings you should expect.
Start before the risk register: ISO 27001 Clause 6.1.1
Almost every auditor goes straight to the risk assessment, and 6.1.1 is a separate requirement they walk past.
It asks the organisation, considering the issues from 4.1 and the requirements from 4.2, to determine the risks and opportunities that need addressing so the ISMS can achieve its intended outcomes, prevent undesired effects and achieve continual improvement — and then to plan actions to address them and how to evaluate whether those actions worked.
It is auditable in its own right. Ask what the ISMS’s intended outcomes are, what could stop it achieving them, and what was planned about that. An organisation that answers only with its information security risk register has treated 6.1.1 and 6.1.2 as the same requirement.
The seven-step trail for auditing ISO 27001 Clause 6
The productive technique on this clause is vertical, not horizontal. Do not read the register across; take one risk and go all the way down.
Is there a defined risk assessment process? One that establishes and maintains risk criteria, including acceptance criteria, and produces consistent, valid and comparable results. Documented information on the process is required, so this one you can ask for.
Take a real risk. Ideally a high-rated one, chosen by you rather than offered. Is it identified as a risk to the confidentiality, integrity or availability of information within the scope?
Is a risk owner identified? A person or an entity with the accountability and the authority to manage it.
Were consequence and likelihood assessed, and the level determined, against the defined criteria? Not whether you agree with the rating — whether the criteria were applied.
Which treatment option was chosen, and which controls were determined? And were those controls compared against Annex A to verify none necessary was omitted?
Does it reconcile to the Statement of Applicability? Applicable, justified, with an implementation status matching what you traced.
Did the risk owner approve the treatment plan and accept the residual risk, with records?
Then do it twice more with different risks. Three traces tell you whether what you found is the process or an exception, which is the whole of the major-versus-minor question on this clause.
Which ISO 27001 sub-clause letter the break belongs to
This is the single most useful table a Clause 6 auditor can carry, and it is what turns a vague finding into a citeable one.
| What broke | Cite |
|---|---|
| No defined risk assessment process at all | 6.1.2, the opening requirement |
| Risk criteria not established, including acceptance criteria | 6.1.2 a) |
| Criteria exist but are not applied, so results are not comparable | 6.1.2 b) |
| A risk with no identified owner | 6.1.2 c) |
| Consequence and likelihood not assessed, or levels of risk not determined | 6.1.2 d) |
| Risks not compared against the risk criteria, or not prioritised for treatment | 6.1.2 e) |
| No treatment option selected for a risk, or none recorded | 6.1.3 a) |
| Controls not determined for the option chosen — including where controls were picked from Annex A instead of being determined from the treatment | 6.1.3 b), and c) where the comparison was never made |
| Controls determined with no comparison against Annex A | 6.1.3 c) |
| An Annex A exclusion with no justification, or a Statement of Applicability that does not reconcile | 6.1.3 d) |
| No risk treatment plan formulated | 6.1.3 e) |
| Risk owners’ approval of the treatment plan, or their acceptance of residual risk, not obtained or not recorded | 6.1.3 f) |
| The process defined but not repeated at planned intervals or on significant change | 8.2, not 6.1.2 |
| The treatment plan never implemented | 8.3, not 6.1.3 |
The last two rows are where candidates lose marks. Clause 6 is the design; Clause 8 is whether it runs. An organisation with an excellent method that assessed its risks once at certification and never again has a Clause 8.2 problem, not a Clause 6.1.2 one. The plan-do-check-act page sets out why the standard splits them.
Want structured preparation?One year of LMS access and HD recordings come with the course.
Sampling on ISO 27001 Clause 6
Three rules make the difference between an audit and a document review.
Choose the sample yourself. An organisation that offers you three risks has chosen three risks it can defend. Take the register, look at what is rated highest, and pick from there. Then pick one rated low that you would have expected to be higher, and ask how the criteria produced that.
Sample across the process, not across the register. Twenty risks read at the identification step tell you less than three risks followed to the end.
Pick risks that touch other things you will audit. A risk whose treatment controls are ones you can go and watch operate — cryptography and key handling, physical entry, log retention, secure disposal — gives you the Clause 8 test and the Annex A test for free, because the same visit serves both.
Reading the Statement of Applicability inside the ISO 27001 trail
Step 6 is where most Clause 6 findings actually surface. Four questions per sampled line: applicable or excluded; what is the justification and does it survive contact with the business; is it marked implemented and can that be shown; does it reconcile with the risk assessment and the treatment plan.
The Statement of Applicability has a page of its own, including the patterns that reliably produce findings. The one worth repeating here is that an exclusion is not a nonconformity — an exclusion whose justification does not hold is. Auditors who write up exclusions as findings without testing the justification lose the finding at the closing meeting.
Auditing ISO 27001 Clause 6.2, which most audits skim
Objectives get ten minutes and deserve more, because the requirement is longer than people remember. Objectives must be consistent with the policy, measurable if practicable, take account of applicable requirements and of risk assessment and treatment results, be monitored, communicated and updated as appropriate, and be available as documented information.
And the clause requires planning: what will be done, what resources, who is responsible, when it will be completed, and how the results will be evaluated.
Two tests find most of what is there. Ask who owns objective three and when it is due — the planning requirement fails more often than the objectives themselves. And ask how the objectives relate to the risk assessment, because objectives that bear no relationship to the organisation’s highest risks are a sign the two processes run in different rooms.
Not sure about the course yet?One year of free retraining on the same exam version is included.
A worked ISO 27001 finding on Clause 6.1.2 b): criteria that are not applied
Weybridge Foods has a documented risk assessment method with a five-by-five scale and written definitions for each level. Three business units maintain their own registers on it.
| Statement | The information security risk assessment process does not produce consistent, valid and comparable results. |
|---|---|
| Objective evidence | The documented risk assessment method (RSK-01 version 3) defines consequence levels by reference to stated financial and operational thresholds. Nine risks were sampled across the three unit registers (refs WF-04, WF-09, WF-11, WF-17, WF-22, WF-26, WF-31, WF-33 and WF-40). In four of the nine, the recorded consequence level did not correspond to the threshold definition for the impact described. In two of those four, the same described impact was rated at different levels in two different registers. The risk manager confirmed that unit owners score their own risks within their own registers. Risk acceptance criteria are defined and were applied consistently wherever a level had been set. |
| Requirement | ISO/IEC 27001 Clause 6.1.2 b) requires the organisation to define and apply an information security risk assessment process that ensures repeated risk assessments produce consistent, valid and comparable results. The three unit registers are applications of that one process, and their results are not comparable to each other. The organisation’s own risk assessment method RSK-01 defines the consequence thresholds that were not applied. |
| Grade | Major — the inconsistency is present across units and in a substantial proportion of the sample, so the process rather than an individual entry is not operating as required; risk levels that are not comparable cannot support prioritisation or acceptance decisions. |
Note that the requirement names the organisation’s own method as well as the clause. An organisation’s documented information is part of the audit criteria, and a finding resting on both is harder to argue with than one resting on either — the auditee here cannot dispute the thresholds, because it wrote them.
Note also the last sentence of the evidence. Recording what did conform narrows the finding to what the evidence supports and stops the auditee widening the argument.
One discipline in writing any of these. Record what you were told as fact where it establishes how far the failure reaches; do not write your own diagnosis of why it happened. “The manager confirmed no records exist for contract staff” is evidence of extent. “This happened because onboarding is not joined up” is a cause, it is the organisation’s to establish under Clause 10.2, and supplying it hands the auditee something to argue about. The evidence above records that unit owners score their own registers, because that establishes how far the inconsistency reaches. It does not say the arrangement caused the divergence.
A worked ISO 27001 finding on Clause 6.2 graded minor
Pelham Institute sets eight information security objectives each period. They are consistent with the policy, measurable, and derived from the risk assessment.
| Statement | The organisation has not planned how it will achieve two of its information security objectives. |
|---|---|
| Objective evidence | Eight information security objectives are recorded in the objectives register (OBJ-02) for the current period. For objectives 5 and 7, the register records the objective and its measure only: no record was produced of what would be done, what resources would be required, who would be responsible, when completion is expected, or how the results would be evaluated. The remaining six each record the actions to be taken, a resource note, a named owner, a target date and the method by which results will be evaluated. |
| Requirement | ISO/IEC 27001 Clause 6.2 requires the organisation, when planning how to achieve its information security objectives, to determine what will be done, what resources will be required, who will be responsible, when it will be completed and how the results will be evaluated. |
| Grade | Minor — the planning requirement is met for six of the eight objectives, so the process is defined and operating; the failure is confined to two traceable entries and does not prevent the ISMS achieving its intended results. |
A finding that cannot supply all three — the statement, the objective evidence and the requirement — is not defensible, and the auditee can reasonably challenge it. Examination items often show a badly written nonconformity and ask what is missing; the answer is almost always the evidence or the criterion. The order they are written in varies — some material teaches requirement first, some statement first — and what is marked is that all three are present, specific and traceable.
The two findings are worth comparing, because the proportions alone do not settle the grade. Weybridge fails in fewer than half its sample and is a major; Pelham fails in a quarter of its population and is a minor. The distinguisher is not the count. Weybridge’s inconsistency spans every business unit and destroys the comparability the process exists to produce, so the process is not doing its job anywhere. Pelham’s process is demonstrably working, and two entries are missing planning that the other six have. Grade from what the failure does to the requirement, then use the numbers to show its reach.
Looking for an approved provider?3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP 6039853.
Major or minor on ISO 27001 Clause 6
Grade from the evidence and its reach, never from how serious it feels. A major is a significant or systemic failure — a requirement absent, a process that is not operating, a breakdown that raises doubt the ISMS can achieve its intended results. A minor is an isolated or occasional lapse that does not by itself break the system. Several related minors can together show a systemic problem and become a major.
On this clause the question is nearly always whether the process step is absent or the instance is.
Major territory: no defined risk assessment process; criteria that exist but are not applied, so results are not comparable; a process step that never operates for anyone; a Statement of Applicability that does not reconcile to the risk assessment at all; risks with no owners as a matter of course.
Minor territory: one risk missing an owner in a register where the rest have them; one exclusion with a thin justification; one implementation status out of date; planning missing for some objectives but not others.
And keep the opportunity for improvement in its place. It is advice the organisation may take or leave, and it must never be used to avoid raising a genuine nonconformity. And record what conforms: an audit report that lists only problems misrepresents an ISMS that is largely working.
Two interview techniques that work on ISO 27001 Clause 6
Ask the risk owner, not the security team. Clause 6 evidence is usually held by the people who run the ISMS, and that is exactly why going elsewhere is productive. Ask a named risk owner what risk they own, how big it is, and what they agreed to. An owner who does not know they are one is evidence about 6.1.2 c) that no document will give you.
Ask what changed. A risk process that is alive has added and closed risks. Ask which risks were added in the last cycle and why, and which were closed and on what basis. An organisation that cannot answer has a register rather than a process — and the finding, note, is at 8.2 rather than 6.1.2, because the design may be perfectly good.
What conformity to ISO 27001 Clause 6 looks like
Worth knowing, because an auditor who only recognises failure will over-report. A Clause 6 that works has a small number of visible properties.
The criteria are written down and someone can explain them without reconstructing the logic on the spot.
Risk owners are people with authority, and they know it. Asked about their risk, they describe a decision they made rather than a spreadsheet someone sent them.
The Statement of Applicability’s justifications mention the business. They say what the organisation does, not what the standard says.
The treatment plan has moved. Items have been completed, dates have slipped and been re-agreed, and someone can say why.
The register has changed shape since the last cycle, because the business did.
Where ISO 27001 Clause 6 connects
| Connection | What it gives you |
|---|---|
| Clause 4.3 | A risk that belongs to something outside the scope, which is a Clause 4 finding you reach through Clause 6 |
| Clause 8.2 and 8.3 | Whether the design is running — the most commonly miscited pair in the standard |
| Clause 9.1 | Whether the objectives set at 6.2 are actually monitored |
| Annex A, all four themes | The controls the treatment selected, which you go and watch operate |
| Clause 6.3 | Whether changes to the ISMS itself are planned, which is a separate requirement people miss |
ISO 27001 Clause 6: which sub-clause do you cite?
Pick what broke and see which sub-clause to cite.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the table in this article. The letter matters: it tells the auditee which part of the requirement was not met.
Frequently asked questions about auditing ISO 27001 Clause 6
How do you audit an ISO 27001 risk assessment?
Vertically. Take one high-rated risk you chose and follow it through ownership, analysis, treatment, the Statement of Applicability, the treatment plan and residual acceptance. Then repeat with two more.
Which ISO 27001 sub-clause covers risk owners?
Identification of risk owners is 6.1.2 c). Their acceptance of residual risk is 6.1.3 f). Two different requirements and two different findings.
Is a high residual risk a nonconformity in ISO 27001?
No. Carrying a high residual risk is a legitimate decision. What is auditable is whether the risk owner accepted it against defined criteria, with a record.
What is the difference between an ISO 27001 6.1.2 finding and an 8.2 finding?
6.1.2 is the process design. 8.2 is performing the assessment at planned intervals or when significant changes are proposed or occur. A good method never repeated is an 8.2 finding.
Can an auditor disagree with an ISO 27001 risk rating?
Not as a finding. You audit whether the organisation applied its own defined criteria consistently. A rating you would have set differently, arrived at by applying the criteria, conforms.
Where to go next: more ISO 27001 Lead Auditor exam preparation
Auditing Clause 5: leadership, policy and roles
Auditing Clause 7: competence, awareness and documented information
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply