Set criteria people can apply consistently
ISO/IEC 27001:2022 clause 6.1.2 requires an information security risk assessment process with risk acceptance criteria and criteria for performing assessments. Define likelihood and consequence scales using recognisable business effects, such as service interruption, disclosure of client information or loss of reliable transaction records.
Test the method on several realistic scenarios before wider use. Different assessors should reach reasonably consistent, valid and comparable results. Document how existing controls influence assessment and how uncertainty is recorded. Avoid numerical precision that the available evidence cannot support.
Describe scenarios within the real scope
Start with important activities, information flows and dependencies. Describe an event, its cause and its consequences: for example, a compromised administrator account allowing changes to customer records. Assign a risk owner with sufficient authority to assess business consequences and coordinate a response.
Include SaaS, outsourced support and interfaces with excluded business areas. A supplier may secure the underlying platform while your organisation controls permissions, authentication and data handling. Record these boundaries explicitly so a provider's certification is not mistaken for proof that your configuration is effective.
Connect treatment decisions to necessary controls
Evaluate risks against the agreed criteria, prioritise them and choose appropriate treatment options. Determine the controls needed, then compare them with Annex A to check that necessary controls have not been overlooked. Annex A is a reference set, not a substitute for analysing your circumstances.
Prepare a treatment plan with owners, resources, deadlines and success measures. Clause 6.1.3 requires risk owners' approval of that plan and acceptance of residual information security risks. Keep the reasoning visible, including contractual obligations and dependencies that constrain the available options.
Review outcomes, not just scores
Reassess at planned intervals and when significant changes are proposed or occur. Examine whether treatment actually reduced exposure: an access-control project needs evidence of enforcement and account review, not only a completed implementation ticket. Revisit assumptions after incidents, supplier changes and new information flows.
Connect the register to your Statement of Applicability and existing ISO 27001 consultancy. Horizon organises risks, controls, owners, evidence and reviews; it does not decide whether a risk is acceptable or certify the ISMS.