Risk Register
Information Security Risk Assessment procedure
For ISO27001, by making use of the Risk Register feature in Compleye Online.
Version 1 – 5 October 2026
Introduction:
This feature supports the full ISO27001 requirements of chapter 6.1.2 Information security risk assessment (ISRA). The ISRA is part of the Risk & Opportunity Policy – of the Security Framework Policy, next to other risks assessments (e.g. supplier assessment and DRP).
The procedure describes the following steps:
- Define your risk
- Align risk with controls
- Assess the risk
- Treatment of risk
- Approve the risk
- Implement improvements
- Re-assess the risk
- Yearly Risk Assessment
Below a step-by-step description of the procedure.
1. Define your Risk
Use Yellow button to ADD NEW risk and populate the required info in the first tab – General.
Risk name: A short, clear title that summarizes the risk.
Description: A brief explanation of the risk, including what could happen and the potential impact.
Owner: Assign an owner of the risk (owner = person responsible for managing, monitoring, and reporting on the risk)
Origin: Select the source of the risk (e.g., IT, HR, Legal etc).
Category: Select a risk category (e.g., operational, compliance, strategic etc)
X-ray component: Select the affected X Ray Component.
2. Align risk with controls
In tab Risk and OPC’s we align now the controls in place.
a. Add Annex A controls in tab Risk
via dropdown list you can add the applicable Annex A controls for this risk.
b. Add OPC’s in tab OPC’s
via dropdown list you can select applicable OPC’s for this risk.
This information will feed you during the assessment of your risk.
3. Assess the risk
In tab Risk you can now assess the risk.
Add notes in the ‘description’-field for ‘impact’ and ‘likelihood’ to justify the scoring.
Based on the scoring of ‘Impact’ and ‘Likelihood’ the Residual Risk Score will be calculated as follows;
4. Treatment of Risk
Based on the Residual Risk Score, you will need to define what the treatment should be, you can choose from:
Choose Accept if no additional actions are needed.
Choose Mitigate if you want to improve the controls.
Choose Other if the above options do not apply; you can add a new treatment if needed.
Add a note in treatment justification If the residual risk score is high, but you will not mitigate.
If you have chosen ‘mitigate’ you will need to assign a finding; that can be e.g. a pointer to the direction how to improve this risk. When you start typing the finding, the option of Create an improvement will appear.
Once you have populated the finding; you will create an improvement via the blue marked link (create improvement). A pop-up menu will appear, that you can fill in. Once you have you can create (and save) the improvement.
This improvement is now listed of the section improvements of Compleye Online, as well as visual in this risk register in the tab improvements
You can delete this improvement until you have approved it.
After approval process you cannot delete this created improvement anymore.
NB: Ensure now to save the risk, with assessment and treatment – top right menu.
Once saved – you can make changes to the risk assessment by making use of the Reassess Risk button (top right)
5. Approve the risk
In the tab Risk – you can view the entire assessment – and approve the assessment – by making use of the Approve button on the bottom of the page.
In a pop-up screen the summary will be shown of the assessment – you can add additional comments if needed and let owner or management approve the risk assessment.
Once approved it will be part of the tab Risk as a formal approval.
In the Risk Register – overview – we can see what risks are approved.
If you scroll vertical you can find more information (e.g. approval date).
Via the filter and search functionality you can create your own customized overview of the risk register.
6. Implementation Improvements
It is time to work on the implementation of the created improvements.
During security meetings the ISMS team will keep track of the progress and once implemented and evidence is added, the improvement can be closed.
This action will trigger the Risk Register – overview – to withdraw the last approval of the risk – and that re-assessment is needed.
7. Re-assess the Risk
During security meetings we review the Risk Register and spot that we must re-assess the risk.
Select the risk from the overview and via the REASSESS RISK button you can change the content.
In the tab Risk you can adjust the impact and likelihood, based on the outcomes of the implemented improvement and (expected) effectiveness. Which will calculate a change in the residual risk score.
You can change the Treatment (from mitigate to accept) and SAVE the new assessment.
Before approving the risk (by risk owner) again.
In the Risk Register Overview, the new risk profile is approved.
8. Yearly Information Security Risk Assessment (ISRA)
The Risk register can be used during regular security meetings to re-assess the risks after an improvement has been closed as well as supporting the Threat Intelligence Policy. Throughout the year you can add new risks.
It is recommended to review the Risk Register on a yearly basis and upload the results – by making use of the ‘Export All’ button – in the ISRA section and/or on your assigned OPC. Like a yearly ‘snapshot’.
