What it asks for. The organisation must plan how to address risks and opportunities, carry out information security risk assessment and treatment using a defined method, produce a Statement of Applicability, set measurable security objectives with plans to achieve them, and plan changes to the management system.
In practice. A documented risk methodology defines criteria for acceptance and for performing assessments so that results are consistent and comparable. Risks are identified, analysed and evaluated with named owners, and a treatment plan selects controls and compares them with Annex A. The Statement of Applicability justifies inclusions and exclusions and records implementation status. Risk owners approve the treatment plan and accept residual risk. Evidence includes the methodology, risk register, treatment plan, Statement of Applicability and objectives with owners and deadlines.
Common gaps. Risk assessments are often asset spreadsheets with no link to real business impact. Objectives are vague and unmeasurable, and the Statement of Applicability drifts out of date as controls change.