---
title: "Risk assessment"
canonical: "https://auditbadger.com/features/risk-assessment/"
last-updated: "2026-11-07"
---

# Risk assessment

Risk register integrated with the SOC 2 / ISO 27001 control library. Configurable impact scoring, treatment planning, risk-to-control linking, point-in-time snapshots, and audit-ready history.

## What it does

| Capability | Detail |
|---|---|
| **Risk identification** | AI suggests risks based on your documents, control status, registers and open risks, and skips ones you already have |
| **Configurable scoring** | Risk scored across the impact types in your scoring method (the default covers financial, legal and reputational); you can add, edit or remove impact types |
| **Treatment planning** | Strategies including **Accept**, **Mitigate**, **Transfer** and **Avoid** |
| **Risk-to-control mapping** | Each risk linked to the controls that mitigate it; shows residual risk after controls |
| **Treatment verification** | Each treatment action can be verified with an effectiveness rating, or marked ineffective |
| **Point-in-time snapshots** | Historical risk register snapshots for each audit period, on a schedule you set (weekly to annually) |
| **Review dates** | Each risk carries its own review date, flagged when overdue |
| **Compliance integration** | Risks tied to SOC 2 controls (especially CC3, Risk Assessment) and ISO 27001 Clause 6 + 8.2 |
| **Score history** | Per-risk history of score changes over time |

## Treatment strategies

| Strategy | Use when |
|---|---|
| **Accept** | Risk is within tolerance; documented and monitored |
| **Mitigate** | Implement controls to reduce likelihood or impact |
| **Transfer** | Shift risk to a third party (insurance, contractual indemnity) |
| **Avoid** | Eliminate the risk by changing or stopping the activity |

## Workflow

1. **Identify**: catalog risks by hand or from AI suggestions
2. **Assess**: score impact with your scoring method; assign likelihood
3. **Treat**: choose treatment strategy, link to controls, set a review date
4. **Snapshot**: capture point-in-time state for audit evidence

## Why it matters for audits

- SOC 2 CC3 (Risk Assessment) requires a documented risk identification and analysis process; AuditBadger's snapshots provide the evidence
- ISO 27001 Clauses 6.1 and 8.2 require a documented risk assessment and risk treatment plan; both are built into the workflow
- Risk-to-control linkage shows auditors why specific controls exist

## Useful links

- Sign up: [auth.auditbadger.com/signup](https://auth.auditbadger.com/signup)
- All features: [/features](/features)
- SOC 2 deep dive: [/compliance/soc2](/compliance/soc2)
- ISO 27001 deep dive: [/compliance/iso27001](/compliance/iso27001)
- Business continuity (companion module): [/features/business-continuity](/features/business-continuity)