Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Ethics and Professional Conduct
Why ethics matters in risk work
Risk reports guide decisions worth millions. If ratings are softened to please someone, or risks quietly dropped, the board decides on false information. The value of the risk function depends on its honesty.
ISACA Code of Ethics
CRISC holders agree to follow the code. Breaches can lead to disciplinary action, including loss of the certification.
Pressure to change a rating
- Ask for new evidence.
- Re-assess objectively.
- Document both views.
- Escalate if it isn’t resolved.
Example. A project sponsor asks the risk practitioner to rate a data migration risk as low so go-live isn’t delayed. With no new evidence, the practitioner keeps the rating, records the sponsor’s view and raises it with the steering committee.
Other ethical duties
- Protect confidential information, and don’t use it for personal gain.
- Declare conflicts of interest, and step back if needed.
- Take on only work you’re competent to do.
- Decline gifts that could affect your objectivity.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Manager asks to lower a rating | Keep it unless evidence changes; escalate |
| Practitioner has a conflict of interest | Disclose it and step back |
| Internal escalation fails on a legal issue | Seek legal advice on reporting duties |
| Purpose of the code of ethics | Objective, competent, honest professional work |
In short
- CRISC holders must follow ISACA's Code of Professional Ethics; breaches can lead to disciplinary action.
- Ethical risk work means reporting risks objectively and completely, even when the news is unwelcome.
- Pressure to downgrade a risk rating or leave a risk out of a report must be resisted and, if needed, escalated.
- Confidential information gained in risk work must be protected and not used for personal benefit.
- Practitioners take on only work they're competent to do, and declare conflicts of interest.
Exam traps
- Lowering a risk rating because a senior manager asks, without new evidence.
- Going straight to the media or regulator before using internal escalation.
- Using confidential information for personal gain.
- Accepting gifts or favours from those whose risks you assess.
Slides
Click the slide and use the arrow keys. F toggles full screen.
ISACA Code of Ethics
1 / 8