The risk assessment scores each risk before treatment; the treatment plan then estimates what is left once the chosen controls are in place. If the residual level is still above what the organization has decided it can accept, more treatment is needed or the acceptance has to be justified and recorded.
Auditors look for evidence that residual risks were approved by the risk owners, not just calculated. See risk acceptance.
Read more
Related terms
- Risk acceptance
- Risk acceptance is the documented decision by a risk owner to live with a risk, or with the residual risk after treatment, rather than reduce it further.
- Risk owner
- A risk owner is the person with the accountability and authority to manage a particular risk, including approving its treatment and accepting what remains.
- Risk treatment plan
- A risk treatment plan is the ISO 27001 document recording how each information security risk will be treated, by whom, by when and with which controls.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.