Risk-Based Approach
What is Risk-Based Approach?
A methodology that prioritises compliance activities and control implementation based on the level of risk they address. Risk-based approaches are central to ISO 27001, NIST CSF, GDPR, and most modern compliance frameworks.
Terms that appear alongside risk-based approach
Each of these is named in at least one of the same controls as risk-based approach. The number is how many controls name both.
- audit 8 shared controls
- cybersecurity 7 shared controls
- risk assessment 7 shared controls
- governance 6 shared controls
- resilience 5 shared controls
- accountability 5 shared controls
- integrity 5 shared controls
- transparency 4 shared controls
Frameworks that govern risk-based approach
What the standards actually require on risk-based approach
Requirements naming risk-based approach across 6 standards, quoted from the control text.
Countries identify, assess and understand their money laundering and terrorist financing risks, designate an authority or mechanism to coordinate the assessment and the allocation of resources, and apply a risk-based approach so that preventive and mitigating...
fatf-40-recommendations::R.1 · R.1 Assessing risks and applying a risk-based approach →Under a risk-based approach, auditing takes account of both risks and opportunities. This thinking should shape, in a real way, how the audit programme is planned and carried out and how each audit is planned, performed and reported, so that auditing concentra...
iso-19011-2026::4.8 · Risk-based approach →Requirement 0087 (Part Four: Technology, section 13.3 Technology Lifecycle Management; applies to All entities; dated 31 October 2024;
protective-security-policy-framework-pspf-release-2026::0087 · 0087 Base authorisation decisions on the ISM risk-based approach →Section 11.10(a) requires VALIDATION of closed systems to ensure accuracy + reliability + consistent intended performance + the ability to discern invalid or altered records.
Part11.CSV · Computer system validation + risk-based approach (21 CFR §11.10(a) + 2003 FDA Scope and Application Guidance + 2023 CSA draft) →Procedures that may create aerosols, such as suctioning, sputum induction, non-invasive ventilation and nebuliser use, are performed with a risk-based approach and the precautions the infection route needs, which may include replacing nebulisers with spacers w...
aged-care-infection-prevention-and-control-guide-2024::p-agp · Take a risk-based approach to aerosol-generating procedures →Assess and manage each AI use case on its own merits, so that high-risk settings get safe and responsible handling while lower-risk settings carry minimal burden, using self-assessment models where helpful.
australia-national-framework-for-the-assurance-of-ai-in-government-2024::C.3 · C.3 Risk-based approach cornerstone: assess case by case across the lifecycle →Questions people ask about risk-based approach
What is Risk-Based Approach?
Why is Risk-Based Approach important for compliance?
Which compliance frameworks address Risk-Based Approach?
Where can I learn more about Risk-Based Approach?
See how Risk-Based Approach applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.