An ISO 27001 risk assessment template only earns its keep if it forces the same rigour onto every asset — not just the ones that happen to come to mind first. Clause 6.1.2 of the ISO/IEC 27001:2022 standard requires a defined, repeatable methodology, and an unstructured spreadsheet built from memory rarely survives an auditor asking “show me how you scored this.”
Here’s what a properly built template actually needs, and how the findings flow into the rest of your ISMS.
WHAT AN ISO 27001 RISK ASSESSMENT TEMPLATE NEEDS TO INCLUDE
At minimum, a compliant template needs six columns that connect to each other: the asset, the threat and vulnerability pair, current controls, a likelihood score, an impact score, and the resulting risk level with a named owner. Missing any one of these tends to surface as a finding — usually “risk owner not identified” or “no link shown between the risk and the control selected to treat it.”
STEP 1 — BUILD THE ASSET INVENTORY FIRST
Nothing else in the process works without a defined scope of assets — information, systems, people, and physical locations that hold or process information within your ISMS boundary. If your asset inventory is incomplete, every downstream score is measuring the wrong thing. Pull this from your existing IT asset register where one exists, then add information assets that a technical register typically misses, like contracts, HR records, and supplier data.
STEP 2 — PAIR EACH ASSET WITH A REALISTIC THREAT AND VULNERABILITY
For each asset, identify what could go wrong (the threat) and what weakness would let it happen (the vulnerability). “Ransomware” is a threat; “unpatched server exposed to the internet” is the vulnerability that lets it succeed. Listing threats without their paired vulnerability is one of the most common gaps auditors flag, because it produces a risk score with no clear basis for the control chosen to treat it.
STEP 3 — SCORE LIKELIHOOD AND IMPACT ON A DEFINED SCALE
Use a consistent numeric scale — typically 1 to 5 for both likelihood and impact — with written criteria for each level, not just gut-feel numbers. A score of 4 for impact should mean the same thing whether it’s applied by your IT manager or your compliance officer. Multiply likelihood by impact to get the raw risk score, then map that score to a risk level (low, medium, high, critical) using a threshold table agreed and documented in advance.
STEP 4 — SELECT CONTROLS AND BUILD THE RISK TREATMENT PLAN
For every risk above your acceptance threshold, select the applicable controls — most organisations draw these from Annex A of ISO 27001, though ISO/IEC 27005 risk management guidance covers the broader methodology those controls sit within. Document whether you’re treating, transferring, avoiding, or accepting each risk, and assign an owner and a target date for any control not yet in place.
STEP 5 — LINK EVERY DECISION TO YOUR STATEMENT OF APPLICABILITY
Every control you select or exclude needs to be reflected in your Statement of Applicability, with a stated justification either way. Our Statement of Applicability guide covers how to build that document directly from your risk assessment output, so the two stay consistent instead of drifting apart after the first audit cycle.
STEP 6 — REVIEW ON A DEFINED CYCLE, NOT JUST BEFORE THE AUDIT
A risk assessment done once at certification and never revisited is a common nonconformity. Set a review cycle — typically annual, plus triggered reviews after significant changes like a new system, a new supplier, or a security incident — and keep a version history showing what changed and why.
HOW THIS FITS YOUR WIDER ISMS
If you’re newly building toward certification, our ISO 27001:2022 certification guide [LINK #1] covers the full implementation path this risk assessment feeds into. And if you’re also certified to ISO 9001, supplier-related risks identified here often overlap directly with supplier evaluation criteria — see our ISO 9001 supplier quality checklist for where information security requirements fit alongside quality criteria in supplier onboarding. Organisations running multiple management systems together may also find our combined ISO audit template useful for auditing shared clauses once rather than separately per standard.
GET THE FREE TEMPLATE
We’ve built a ready-to-use ISO 27001 risk assessment template with working likelihood-times-impact formulas and a pre-built risk level lookup, so you can drop in your own assets and start scoring immediately.
👉 [Download the free risk assessment template]
If you’d rather have an experienced team build this out with you — asset inventory, scoring criteria, and Statement of Applicability all aligned from the start — visit our shop for consulting support.