Risk Assessment Methodology

We are in the process of implementing ISO27001 and I am looking at the RA methodology. I have 2 questions. 1. We will likely be defining our RA methodology as the following: - List of Assets What are the vulnerabilities of each asset? What threats could exploit each vulnerability? What is the consequence? What is the likelihood? =Risk Level Does this make sense in the context of 27001? and; 2. In order to protect the C.I.A of information, should we conduct these Risk Assessments for each of confidentiality, integrity and availability? For instance: If our asset is company mobile phones, the vulnerability is asset security, the threat is theft, consequence is unauthorised access to information and likelihood is 1 for example (highly unlikely). Should we conduct separate assessments for the loss of each confidentiality, integrity and availability as theoretically it would affect all 3 in this case, or does the one with the highest risk level suffice?