Requirement
The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.
Points of Focus
Includes Entity, Subsidiary, Division, Operating Unit, and Functional Levels
Requirement: The entity identifies and assesses risk at the entity, subsidiary, division, operating unit, and functional levels relevant to the achievement of objectives.
Analyzes Internal and External Factors
Requirement: Risk identification considers both internal and external factors and their impact on the achievement of objectives.
Involves Appropriate Levels of Management
Requirement: The entity puts into place effective risk assessment mechanisms that involve appropriate levels of management.
Estimates Significance of Risks Identified
Requirement: Identified risks are analyzed through a process that includes estimating the potential significance of the risk.
Determines How to Respond to Risks
Requirement: Risk assessment includes considering how the risk should be managed and whether to accept, avoid, reduce, or share the risk.
Identifies Threats to Objectives
Requirement: The entity identifies threats to the achievement of its objectives from intentional (including malicious) and unintentional acts and environmental events.
Identifies Vulnerability of System Components
Requirement: The entity identifies the vulnerabilities of system components, including system processes, infrastructure, software, and other information assets.
Analyzes Threats and Vulnerabilities From Vendors, Business Partners, and Other Parties
Requirement: The entity's risk assessment process includes the analysis of potential threats and vulnerabilities arising from vendors providing goods and services, as well as threats and vulnerabilities arising from business partners, customers, and other third parties with access to the entity's information systems.
Assesses the Significance of the Risks
Requirement: The entity assesses the significance of the identified risks, including (1) determining the criticality of system components, including information assets, in achieving the objectives; (2) assessing the susceptibility of the identified vulnerabilities to the identified threats (3) assessing the likelihood of the identified risks (4) assessing the magnitude of the effect of potential risks to the achievement of the objectives; (5) considering the potential effects of unidentified threats and vulnerabilities on the assessed risks; (6) developing risk mitigation strategies to address the assessed risks; and (7) evaluating the appropriateness of residual risk (including whether to accept, reduce, or share such risks).
Explanation
The organization must systematically identify what could prevent it from meeting its objectives — considering internal and external factors, threats, system vulnerabilities, and risks from vendors and partners — then analyze each risk's significance and decide how to respond. Auditors expect a documented, management-involved risk assessment process, not an ad hoc exercise.
