Domain 1: Governance

CRISC · about 26% of the exam

How the organisation's strategy, structure, culture, policies and assets shape IT risk, and how enterprise risk management, appetite and the risk profile govern it.

Revising? All of this domain's slides in one deck. When you're done, take the domain quiz.

Exam technique

• Exam Technique: Thinking Like a Risk Practitioner How CRISC questions are built, why two answers often look right, and a method for choosing the answer a risk practitioner would give: assess before acting, compare with appetite and let the owner decide.

Organisational governance

• Aligning IT Risk Management with Business Strategy Why IT risk management starts from the organisation's strategy and objectives, and how the risk practitioner links each IT risk to the business goal it threatens.
• Organisational Structure, Roles and Decision Rights Who does what in IT risk management, from the board to control owners, and why clear decision rights stop risks from falling between teams.
• Risk Ownership and Accountability What a risk owner is, how to choose one, and how accountability is made real through named owners, records, review and consequences.
• Segregation of Duties Why separating key duties reduces the risk of error and fraud, the combinations that matter most in IT, and what to do when a small team can't separate them.
• Risk Culture and Tone at the Top What risk culture is, how leaders shape it, how to recognise a healthy one, and how a risk awareness program helps people raise risks early.
• Ethics and Professional Conduct The ISACA Code of Professional Ethics, why ethics matters in risk work, and how a risk practitioner handles pressure to soften, hide or misreport risk.

Policies and assets

• Policies, Standards, Procedures and Guidelines How the policy framework turns management intent into specific requirements and steps, and why it's one of the main ways risk appetite becomes day-to-day behaviour.
• Policy Lifecycle, Exceptions and Enforcement How policies are drafted, approved, communicated, enforced and reviewed, and how exceptions are handled so that departures from policy stay visible, owned and time-limited.
• Business Process Review: Ownership and Criticality How reviewing business processes shows where IT risk really matters: which processes are critical, who owns them and which systems, data, people and suppliers they depend on.
• Identifying and Valuing Organisational Assets Which assets matter for IT risk (information, systems, people, suppliers and intangibles), how to find them and how to value them by business impact rather than purchase price.
• Embedding Asset Management into Risk Governance How keeping the asset inventory accurate through its life cycle supports every other risk activity, and the risks that appear when assets are unknown, unowned or untracked.

Risk governance

• Enterprise Risk Management: Purpose and Principles What enterprise risk management is, the principles that make it work, and how IT risk fits into the enterprise view so the board can compare it with every other risk.
• The Risk Practitioner's Role in ERM What the CRISC-certified risk practitioner actually does inside enterprise risk management, and the line between advising on risk and owning it.
• The Three Lines Model and Risk Oversight How the Three Lines Model divides responsibility for owning risk, overseeing it and giving independent assurance, and where the risk practitioner and IT sit.
• Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT The main risk management frameworks and standards a CRISC candidate should recognise, what each is best for, and how to choose one for the organisation.
• Applying a Framework: the Risk Management Life Cycle The risk management life cycle that every framework shares, from establishing context through identification, analysis, evaluation, response and monitoring, and why the order matters on the exam.

Appetite and profile

• Risk Appetite, Tolerance and Capacity The difference between risk capacity, appetite and tolerance, who sets each, and how to turn the board's appetite into measurable tolerances and thresholds that guide everyday risk decisions.
• Establishing and Maintaining the IT Risk Profile What the IT risk profile is, how it differs from the risk register, how it's built and kept current, and why it's the main tool for showing senior management the overall state of IT risk.
• Making Risk-Based Business Decisions How the risk practitioner helps leaders weigh opportunity against risk, using appetite, options and residual risk, so that decisions are informed, made at the right level and recorded.

Legal and compliance

• Legal, Regulatory and Contractual Requirements Where IT-related obligations come from, how the risk practitioner turns them into risks and controls, and why compliance risk is assessed like any other risk.
• Connecting Governance to Risk Outcomes How to show that governance activities (strategy, structure, policy and oversight) actually change IT risk, and which measures tell the board whether risk governance is working.