Terms related to trustworthiness · 3.5.11
risk
the effect that uncertainty has on objectives
What this term settles
The term looks ordinary until two teams use it differently. The entry removes that room by naming the thing, its inputs and its limits in one sentence.
Who it binds
Nothing here creates an obligation by itself, and the obligation for risk arrives when the firm writes the term into a control, a specification or a purchase order.
What to do in your practice
Use the entry as a test in the next review. Ask the owner to point at the artefact that shows risk in this sense, then record the answer with a date.
Evidence an auditor or regulator asks for
- A controlled vocabulary entry for risk with the citation 3.5.11, an owner and a review date.An auditor can check that risk is controlled rather than assumed.
- An assurance argument that links the property to the test, the review or the incident record behind it. The row names risk.Shows risk in use in the artefact the firm relies on, not only in a glossary.
- A register row with the owner, the date and the evidence reference for the claim. The record carries the risk entry and its date.The assurance case asserts the property without naming the test, review or incident record that supports it. The gap is tested against risk.
Common gaps this page catches
- risk is used in the assurance argument without a written definition, so two teams can mean different things.
- The entry for risk exists in a glossary but not in the system record, so the two disagree at the point of use.
What to prepare before the amendment lands
Take the next policy revision and replace the loose use of risk with the entry and its citation. Record the change in the vocabulary change log.
How to test it here
Take one live artefact rather than a template, find the sentence or field where risk is used, and put this page beside it. Record the answer, the artefact and the date, because that record is the evidence and a glossary entry on its own is only an intention.
What this page does not claim
The page does not reproduce the standard, certify the firm or predict the wording the amendment will use; it states risk at the claim level "definition" and stops where the public record stops.
Common questions
- What does risk mean in ISO 22989?
- the effect that uncertainty has on objectives
- What evidence should we keep for 3.5.11?
- A controlled vocabulary entry for risk with the citation 3.5.11, an owner and a review date. An assurance argument that links the property to the test, the review or the incident record behind it. The row names risk.
- Is risk a requirement?
- No: risk is a definition or clause of a terminology standard, and it becomes binding only when a firm writes it into a policy, a contract or a procedure, or when another standard incorporates it.
Related units
Source. ISO/IEC 22989:2022, Clause 3.5.11, Terms and definitions. Open the ISO public entry. Retrieved 21 October 2026.
https://www.iso.org/obp/ui/en/#iso:std:iso-iec:22989:ed-1:v1:en
ISO catalogue record 88145, the amendment status, stage and dates. Catalogue record 74296, the base standard.
Claim level: definition. The definition is in the public preview. This page states it in our own words and does not reproduce the text.
Last updated: 2026-10-21 · Markdown version · Check your vocabulary