Why do I need a risk register for ISO 27001?

A risk register gives an organisation one controlled record of the information security risks that could affect its services, information, people, suppliers and technology. It shows what might happen, why it matters, how serious the exposure appears, who owns the decision and what action the organisation will take.

For ISO 27001, this record helps turn risk management from a general intention into a repeatable business process. Leaders can compare risks, approve treatment, assign resources and monitor whether controls reduce exposure. Risk owners can see what they need to review, while auditors can follow the reasoning from the identified risk to the selected control and supporting evidence.

ISO/IEC 27001:2022 does not prescribe a particular document called a risk register. It does require the organisation to establish a consistent information security risk assessment process, retain documented results and define how it will treat risk. A risk register offers a practical and widely understood way to hold those results. ISO also describes the ISMS as a risk management tool that organisations can adapt to their own needs.

UK Cyber Compliance supports this work through an automated and AI-driven platform. UK Cyber Compliance (a part of UK Cyber Security Group) provides these services and has a platform to make certification much easier and cheaper. The platform brings risk information, controls, policies, actions, evidence and audit preparation into one place.

The register turns uncertainty into decisions

Every organisation faces uncertainty. A supplier may fail, an employee may disclose information by mistake, a criminal may steal credentials, a cloud service may become unavailable or a device may go missing.

Without a structured register, teams often respond to whichever problem feels most urgent at the time. That approach can leave serious risks hidden while the business spends effort on lower-priority concerns.

The risk register creates a common method. It allows the organisation to describe each risk clearly, assess likelihood and impact, record existing controls and decide whether further treatment is necessary.

This record also supports accountability. A risk owner can approve treatment, challenge assumptions and decide whether the remaining exposure sits within the organisation’s acceptance criteria. Senior leaders can review major risks without needing to search through technical reports or separate departmental files.

What ISO 27001 actually expects

ISO 27001 requires a repeatable process for identifying, analysing and evaluating information security risk. The organisation must define criteria that produce consistent, valid and comparable results. It must also identify risk owners and retain documented information about the assessment results.

The treatment process then requires the organisation to choose suitable action, determine necessary controls, compare those controls with Annex A and produce a Statement of Applicability. The business also needs approval from risk owners for the treatment plan and acceptance of the remaining risk.

A register helps organise all of this information. It can hold the risk scenario, affected asset or process, rating, owner, controls, treatment decision, actions, review date and residual position.

A named form is not the goal

The standard cares about the process and evidence rather than the label on a spreadsheet or platform screen.

One organisation may call the record a risk register. Another may use an information security risk log, governance platform or integrated risk database. Each approach can work when it covers the ISMS scope, follows the approved method and stays current.

The important question is not whether the document uses a particular title. The important question is whether the organisation can show how it identifies, evaluates, treats and reviews risk.

What is ISO 27001 Certification?

ISO 27001 certification provides independent confirmation that an organisation operates an Information Security Management System that meets ISO/IEC 27001 requirements.

An ISMS brings together business context, scope, leadership, risk management, objectives, controls, evidence, internal audit, management review and continual improvement. ISO describes ISO/IEC 27001 as the world’s best-known ISMS standard and explains that it supports risk management, cyber resilience and operational excellence.

Certification does not promise that the organisation will avoid every incident. It shows that the business has established a managed approach, assigned responsibility and created a process for reviewing and improving information security.

The risk register supports that assurance. It shows what the organisation knows about its exposure, how it prioritises action and how management accepts or reduces the remaining risk.

what is iso 27001

ISO 27001 is the commonly used name for ISO/IEC 27001:2022, the international requirements standard for information security management systems.

The standard promotes a joined approach across people, policies and technology. It asks the organisation to protect confidentiality, integrity and availability through a risk management process that reflects its objectives, processes and structure.

Confidentiality means that only authorised people and systems can access information. Integrity means that information remains accurate and reliable. Availability means that authorised users can reach information and services when they need them.

A useful risk register considers all three concerns. A data disclosure may affect confidentiality, an unauthorised change may affect integrity and a system failure may affect availability. Many scenarios affect more than one concern.

One source of truth for the ISMS

ISO 27001 creates several connected records. These may include the ISMS scope, asset information, risk assessment results, treatment plan, Statement of Applicability, control evidence, internal audit findings and management review decisions.

The risk register connects much of this work. It should show which part of the scope the risk affects, which controls already operate, which actions remain open and who owns the decision.

A central record reduces contradiction. The organisation should not describe a risk as critical in one document and low in another without a clear explanation. Control status should also agree across the register, treatment plan and Statement of Applicability.

This consistency helps managers make better decisions. It also helps an auditor follow a clear path from the business context to the final evidence.

Scope comes before scoring

A risk register only provides useful assurance when it covers the full ISMS scope.

The scope may include a customer service, cloud platform, department, location or the whole organisation. Whatever boundary the business chooses, the risk assessment should include the people, processes, information, systems and suppliers that support it.

A company should not focus only on servers and laptops. Customer records, paper documents, home working, key employees, supplier relationships, contracts and physical locations can all create information security risk.

Clear scope prevents hidden dependencies. A customer portal may rely on a cloud provider, identity service, support team, payment processor and communications platform. The register should consider each dependency when failure or compromise could affect the certified service.

Risk statements make the register useful

A risk title such as “phishing” provides too little information. It names a threat but does not explain what may happen or why the business should care.

A stronger statement might say:

“A member of staff may respond to a convincing phishing message, allowing an unauthorised person to access company email and disclose customer correspondence.”

This wording identifies the event, likely route and business consequence.

Another example might say:

“A prolonged outage at the primary cloud provider may make the customer portal unavailable, causing missed service commitments and customer disruption.”

Clear scenarios help managers rate the risk and select relevant controls. They also prevent vague entries that nobody knows how to treat.

A practical writing pattern

Use a simple cause, event and consequence structure:

Because of a threat or weakness, an event may occur, which could cause a business impact.

This pattern keeps the wording readable and prevents the register from becoming a list of isolated technical terms.

Risk owners create accountability

Every meaningful risk needs an owner with enough authority to make decisions.

The risk owner should understand the business impact, approve treatment, secure resources, review progress and accept the remaining exposure where authorised. ISO committee guidance stresses the importance of assigning owners with suitable authority and accountability.

The owner does not need to complete every technical task personally. An IT manager may implement a control while an operations director owns the wider service risk.

Use role titles where possible. This keeps the register stable when personnel change and makes governance easier to understand.

Scoring helps compare priorities

Most organisations score likelihood and impact, then use a matrix or calculation to assign a risk level.

Likelihood considers how realistically the event may occur. The assessment may use past incidents, known weaknesses, threat activity, exposure, supplier dependency and the strength of existing controls.

Impact considers what the business could lose or suffer. Relevant concerns may include customer harm, service interruption, legal duties, contractual failure, reputation, finance, staff productivity and damage to confidentiality, integrity or availability.

The organisation should define each score clearly. A number without an agreed meaning creates inconsistency.

ISO/IEC 27005 provides guidance for identifying, assessing and treating information security risks in support of ISO 27001. It promotes a structured approach rather than one mandatory scoring formula.

Inherent, current and residual risk

Some organisations record several views of the same risk.

Inherent risk estimates the exposure before considering controls.

Current risk reflects the position after considering controls that already operate.

Residual risk shows the exposure that remains after planned treatment.

These distinctions can help management understand the value of controls, but the organisation should only use them when staff understand the method. Too much complexity can make the register harder to maintain.

The business should never lower a rating simply because an action appears in a plan. Reassessment should happen after the control operates and evidence shows that it changes likelihood or impact.

Treatment turns the register into action

The register should not stop after scoring. It needs a clear treatment decision.

The organisation can reduce risk by applying controls, avoid the activity, transfer part of the exposure or accept the risk within approved criteria.

A treatment action should state what needs to happen, who will do it, when it should finish and what evidence will show completion.

“Improve account security” lacks useful detail.

“Enable multi-factor authentication for all finance users, review privileged accounts and retain the completed access report by the agreed date” gives the owner a measurable outcome.

The register should also show whether the action has started, whether it remains overdue and how it will change the risk rating.

The link with Annex A controls

Annex A provides a reference set of 93 controls. The organisation determines necessary controls through risk treatment and then compares its choices with Annex A so that it does not overlook relevant measures.

A phishing risk may link with awareness, authentication, access, malware protection, logging and incident management controls.

A supplier outage may link with supplier relationships, cloud service security, continuity and ICT readiness controls.

A lost device risk may link with endpoint protection, access restrictions, encryption, remote working and event reporting.

One risk can connect with several controls, while one control can address several risks. The register should support traceability without forcing artificial one-to-one links.

The link with the Statement of Applicability

The Statement of Applicability records the controls the organisation has determined are necessary, why it includes them, whether it has implemented them and why it excludes any Annex A controls.

The risk register supplies much of the reasoning behind those decisions.

When the register identifies a serious access risk, the SoA should show relevant access and authentication controls. When the business decides that a control does not apply, the exclusion should remain consistent with the scope and risk assessment.

The register, treatment plan and SoA should tell one coherent story. If they conflict, the organisation may struggle to explain its decisions during audit.

The register supports internal audit

Internal audit checks whether the ISMS meets the organisation’s requirements and the standard.

An auditor can sample risk entries and ask:

Does the risk fit the scope?

Did the organisation apply its scoring method consistently?

Does the owner understand the risk?

Do the listed controls operate?

Do treatment actions remain current?

Does evidence support the residual rating?

Does the SoA reflect the selected controls?

This testing helps identify weak records before the external assessment. It also gives leaders confidence that the register reflects real operations rather than old assumptions.

Management review needs clear risk information

Senior management needs a concise view of information security risk.

The register helps leaders see major exposures, overdue actions, accepted risks, control failures and changes that may need resources.

Management review can use this information to approve priorities, challenge delays, adjust acceptance criteria and confirm that the ISMS remains suitable.

A good register supports informed decisions. A large list of vague entries does not.

Dashboards and summaries can help, but leaders should still understand the reasoning behind the highest risks.

Who needs iso 27001 certification

ISO 27001 certification can support organisations that handle important information and need to demonstrate structured security management.

Technology providers, managed service providers, professional firms, manufacturers, charities, healthcare suppliers, finance-related organisations and public sector contractors may all benefit.

Customer assurance often drives the decision. Clients want evidence that suppliers understand risk, manage controls and maintain reliable governance.

ISO explains that organisations across sectors can use ISO 27001 and adapt the risk management process as their needs change.

A smaller business can maintain a proportionate register. It does not need hundreds of entries. It needs clear scenarios, consistent ratings, accountable owners and current evidence.

A small business still needs structure

Small organisations sometimes rely on informal knowledge. One person knows the key supplier, another understands the customer platform and someone else remembers which accounts need review.

That knowledge can disappear when people leave, become busy or change roles.

A risk register captures the information and turns it into shared business knowledge. It helps a small team focus on the few exposures that matter most.

The method can remain simple. A small business may use a limited likelihood and impact scale, a concise set of fields and a regular management review.

Simplicity should not mean vagueness. Each entry still needs a clear owner, treatment decision and review date.

Cyber risk makes structured assessment necessary

The UK Government’s Cyber Security Breaches Survey 2025 to 2026 found that 43 per cent of businesses identified a breach or attack during the previous 12 months. Medium businesses reported 65 per cent and large businesses reported 69 per cent. Among organisations that identified a breach or attack, 29 per cent of businesses experienced incidents at least weekly. Only 25 per cent of businesses had a formal incident response plan.

These figures show why organisations need a managed view of risk. Threats change, controls fail and dependencies create new exposure.

A current register helps management identify which scenarios could cause the greatest harm and where the business needs stronger preparation.

Common weaknesses in risk registers

One weakness involves copying generic entries from a template. The wording may sound professional while failing to reflect the organisation’s actual services and dependencies.

Another problem comes from focusing only on technical threats. The register should also consider people, suppliers, premises, contracts and operational processes.

Some organisations use inconsistent scoring. One team may rate a short outage as severe while another rates a similar event as minor.

Old entries also create false assurance. A supplier may change, a system may retire or a control may stop working while the register remains untouched.

Other common weaknesses include:

No named owner

No acceptance criteria

Treatment actions without dates

Controls listed without evidence

Residual ratings reduced before completion

No connection with the SoA

No review after incidents or business change

A useful register remains specific, honest and current.

Review triggers keep the record alive

The organisation should schedule regular reviews and update risks when significant change occurs.

Useful triggers include:

A new customer service

A major supplier change

A cloud migration

A serious vulnerability

A security incident

An audit finding

A legal or contractual change

A new location

A major workforce change

A control failure

A risk register that only changes before certification does not support real management.

ISO 27001 Certification Levels

ISO 27001 does not use achievement bands such as bronze, silver or gold.

An organisation either holds certification for its stated ISMS scope or it does not.

Businesses do move through practical stages, including scope definition, risk assessment, treatment, control implementation, internal audit, management review and external assessment.

Security maturity can improve after certification through stronger controls, clearer evidence, better monitoring and broader governance.

That progress reflects continual improvement rather than a formal certification band.

How the Certification Works

The organisation starts by understanding its context, interested parties and ISMS scope.

It then defines the risk method, completes risk assessment and decides how to treat unacceptable exposure.

Risk treatment identifies necessary controls. The organisation compares those controls with Annex A and records its control position in the Statement of Applicability.

Next, the business puts controls into operation, gathers evidence, completes internal audit and holds management review.

An external certification body normally conducts a Stage 1 assessment followed by a Stage 2 assessment. Stage 1 focuses on readiness and core ISMS arrangements. Stage 2 examines implementation and effectiveness.

After certification, ongoing assessment checks whether the organisation maintains and improves the ISMS.

Which UK-based firms offer ISO 27001 consultancy services?

UK organisations can seek support from information security consultancies, compliance advisers, managed service providers, internal audit specialists and platform-led providers.

UK Cyber Compliance supports ISO 27001 through an automated and AI-driven platform. Its website describes guided workflows, intelligent risk assessments, live dashboards and audit-ready compliance management.

A capable provider should help the organisation define scope, create a proportionate method, identify meaningful risk scenarios, set acceptance criteria and connect treatment with Annex A.

Good support should leave the business able to understand and maintain its own register. The organisation must retain ownership of risk decisions even when an adviser guides the process.

How UK Cyber Compliance strengthens risk management

Disconnected spreadsheets can become difficult to manage when an organisation needs to connect risks with controls, policies, evidence, owners and actions.

UK Cyber Compliance brings this information into one platform. Automated workflows can highlight missing information, overdue tasks and gaps that need attention.

AI-driven guidance can support users as they work through the ISMS, while dashboards give leaders a clearer view of progress and exposure.

Technology supports the process, but management still makes the key decisions. Leaders set appetite, risk owners approve treatment and control owners maintain evidence.

A practical register checklist

Before an external assessment, check whether the register answers these questions:

Does it cover the full ISMS scope?

Does every entry describe a clear scenario?

Have we defined likelihood and impact?

Do staff apply the method consistently?

Does every risk have an accountable owner?

Have we recorded existing controls accurately?

Does the rating reflect current evidence?

Have we compared the result with acceptance criteria?

Does every unacceptable risk have treatment?

Do actions have owners and target dates?

Have we assessed residual risk after implementation?

Do the control links agree with the SoA?

Have senior leaders reviewed major risks?

Do review dates and triggers remain current?

Can an auditor trace each important decision?

Clear answers show that the register supports a working ISMS.

The register makes ISO 27001 practical

You need a risk register because ISO 27001 depends on informed and repeatable risk decisions.

The register brings those decisions into one controlled record. It helps the organisation understand exposure, compare priorities, assign ownership, choose controls, monitor treatment and show why management accepted the remaining risk.

It also connects scope, Annex A, the Statement of Applicability, internal audit, management review and continual improvement.

UK Cyber Compliance provides an automated and AI-driven platform that helps businesses keep these relationships clear and audit-ready.

A strong risk register does not need unnecessary complexity. It needs honest scenarios, consistent assessment, accountable owners, useful evidence and regular review. When the organisation maintains those elements, the register becomes one of the most valuable management tools within the ISMS.

UK Cyber Compliance is here to help

For more information, please do get in touch.

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks.