Date of Risk
Control Treated
Date Risk Control areas for Treated Treated Owner's Date Risk Date Risk
Risk Affected Risk Risk Risk Risk Current Risk areas for Risk Treatment Residual
Risk Raised by Risk Statement Treatment new treatment Residual Risk Residual Acceptance Treatment Treatment
ID Asset Owner Likelihood Consequence Rating Comments existing Plan Risk
Raised Decision measures Consequence Risk /Treament due Implemented
controls Likelihood
Approval
Provide awareness
Personnel
Files are physically training for all staff
information may A.13.2.4 A.7.2.1
David Personnel HR secured but there regarding
I001 be inadvertently C (Possible) 3 (Moderate) High A.11.1.2 Mitigate A.8.2.2 E (Rare) 3 (Moderate) Low
Simpson Files Manager are poor handling information
or deliberately A.11.1.3 A.8.2.3
practices classification and
exposed
handling
Fields in the "Risk Register" worksheet should be filled in as per following definitions and guidelines
Field Name Definition / Instructions
Risk ID Running serial number. Number should be assigned sequentially every time a new risk is
identified.
Location Physical location of the risk
Date Risk Raised Date risk raised
Raised by Person raising the risk
Affected Asset Name / category of the asset related to the risk
Risk Owner The owner of the risk
Key Factors Key factor (a few words) to highlight the context
Threat Brief description of an unwanted (deliberate or accidental) event that may result in harm to an
asset.
Vulnerability Brief description of a weakness that could cause the threat
Risk Statement Statement of the potential risk
Current Risk Likelihood Probability or likelihood of existing occurring considering existing controls in place. Use drop
down boxes and refer to Risk Criteria sheet
Current Risk Consequence Consequence or impact of existing risk without new treatment measures, if the risk eventuates. Use
drop down boxes and refer to Risk Criteria sheet
Current Inherent Risk Rating or exposure of untreated risk considering existing controls in place, but without new
treatment measures, if the risk eventuates. Refer to "Risk Criteria" worksheet for possible values
and definitions.
Current Risk Comments Comments / remarks to qualify / explain existing controls in place. Also comments to explain /
qualify any recommendations for risk acceptance
Controls areas for existing controls List of control numbers from the standard ISO27001 Annex A that correspond to the existing
controls in place
Risk Treatment Recommendation Possible values are "Mitigate", "Accept"
Mitigate = recommendation is to mitigate the risk. new treatment measures being proposed /
applied
Accept = recommendation is to accept the risk without any new treatment measure
Risk Treatment Plan Comments / remarks to qualify / explain new treatment measures being proposed / applied
Control area for new treatment measures List of the relevant control area from the standard ISO27001 Annex A that correspond to the new
treatment measures proposed / applied
Treated Residual Risk Likelihood Probability or likelihood of treated risk occurring assuming the recommended treatment measures
have been applied. Possible values A to E. Refer to "Risk Category" worksheet for definition.
To be left blank if the Risk Treatment Recommendation is "Accept Risk"
Treated Residual Risk Consequence Consequence or impact of treated risk assuming the recommended treatment measures have been
applied. Possible values 1 to 5. Refer to "Risk Category" worksheet for definition.
To be left blank if the Risk Treatment Recommendation is "Accept Risk"
Treated Residual Risk Rating or exposure of treated residual risk considering the treatment measure(s) has been applied,
if the risk eventuates. Refer to "Risk Category" worksheet for possible values and definitions.
Date of Risk Owners Date when the Risk Owner accepted the risk or approved the treatment plan
Acceptance/Treatment Approval
Risk Treatment Owner Person accountable for implementing the treatment plan
Date Risk Treatment due Planned implementation date of risk treatment plan / new control, or
Leave blank or N/A if Risk Treatment Recommendation is "Accept Risk"
Date Risk Treatment implemented Actual implementation date of risk treatment plan / new control, or
Leave blank or N/A if Risk Treatment Recommendation is "Accept Risk"
Add a column with the date of the review of the risk and any changes that were made to any
Date of Review and Nature of Updates component of the risk
The table below forms the basis for risk assessment for the Amcom ISMS in conjunction with the Amcom Risk Management Policy
Current / Treated Risk Matrix
Level of Consequence
Level of Probability 1 2 3 4 5
A (Almost Certain) Medium High Very High Critical Critical
B (Probable) Medium High Very High Critical Critical
C (Possible) Low Medium High Very High Very High
D (Improbable) Low Low Medium High High
E (Rare) Low Low Low Medium Medium
1 (Insignificant) 2 (Minor) 3 (Moderate) 4 (Major) 5 (Catastrophic)
