During the audit, an auditor might ask for the following evidence regarding ISO 27001 clause 6.1 Actions to address risks and opportunities:
1. The risk assessment methodology.
2. The report about the performed risk assessment and treatment, together with the list of all the risks.
3. If each risk has impact, likelihood, level of risk, and risk owner listed, and whether it is considered acceptable.
4. If each unacceptable risk has been treated with at least one option; if the option is decreasing the risk, then the risk needs to have appropriate controls selected.
5. If the selected controls are marked as applicable in the Statement of Applicability.
6. If you have planned the implementation of your controls through the Risk Treatment Plan.
7. If the risk owners have accepted the Risk Treatment Plan and the residual risks.