Risk Management

At Integral Management Consulting, we specialise in providing ad-hoc consulting to help you cut through complexity and develop a simple, effective approach to identifying, assessing, and treating information security risks—without needing prior expertise in formal risk frameworks.

Expert Advice on Information Risk Management and Process Risk Management Approaches

We help you choose and apply the right risk assessment method for your organisation:

• Asset-Based Approach
  Focuses on identifying key information assets and evaluating the threats and vulnerabilities affecting them.
  Pros: Logical, aligns well with ISO 27001's structure.
  Cons: Can become overly detailed or difficult to maintain without discipline.
• Scenario-Based Approach
  Looks at realistic events or situations that could impact your organisation.
  Pros: Easier for non-experts to understand; encourages strategic thinking.
  Cons: Risk of missing subtle or indirect risks tied to specific assets.

We guide you on selecting the right method—or a hybrid—to suit your business context and existing maturity level.

Build a Risk Assessment That Makes Sense

Our support includes:

• Developing a simple, easy-to-follow risk methodology that meets ISO 27001 requirements.
• Helping you define risk criteria, such as impact, likelihood, and risk appetite.
• Creating a risk assessment document that is both compliant and practical for day-to-day use.

No jargon. No unnecessary complexity. Just a usable framework your team can work with to support information risk management and process risk management needs.

Once risks are identified, we:

• Help define effective and proportionate treatments for each risk.
• Map those treatments to relevant Annex A controls, ensuring alignment with ISO 27001.
• Provide practical insight into control implementation—beyond theory.

You’ll walk away with clear actions and realistic recommendations—not just a list of problems.

The SoA is a critical part of ISO 27001—and often misunderstood. We assist by:

• Mapping risk treatments to Annex A controls.
• Documenting the justification for control selection or exclusion.
• Creating a clear, audit-ready Statement of Applicability that supports your ISMS and demonstrates compliance.
• 
  

Whether you’re just starting or need help refining your existing approach, our ad-hoc consulting gives you access to experienced ISO 27001 professionals without long-term commitments.

Get in touch today to simplify your ISO 27001 risk management—and build confidence in your compliance.