Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Connecting Governance to Risk Outcomes
From direction to outcome
Governance proves its worth when you can trace a line from a board decision to a measurable change in risk.
Outcome versus activity measures
| Shows governance works | Only shows activity |
|---|---|
| Share of top risks within appetite | Number of policies published |
| Overdue treatment plans, and their trend | Number of committee meetings |
| Time to decide on escalated risks | Training hours delivered |
| Losses from IT-related incidents | Number of risks in the register |
Where the chain breaks
- Appetite too vague to guide decisions.
- Risks without named owners.
- Policies not enforced or monitored.
- Controls designed but never tested.
Example. A board approved a strong data protection policy, but no tolerance was set and nobody owned the data risks. A breach two years later showed the policy had never been implemented in two business units.
The governance outcomes
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST evidence governance is effective | Risk kept within appetite, with timely decisions |
| Weakness of activity metrics | They don’t show changes in risk |
| Primary governance outcome | Strategic alignment |
| Many overdue treatment plans | A governance or ownership weakness to escalate |
In short
- Governance is worthwhile only if it changes outcomes: risk within appetite, fewer losses, better decisions.
- Trace each governance activity through structure, process and controls to a measurable outcome.
- Good governance measures focus on risk against appetite and the timeliness of decisions and treatment.
- Activity measures (meetings held, policies written) don't prove governance works.
- Weak links in the chain, such as missing owners or untested controls, break the connection.
Exam traps
- Reporting the number of policies or meetings as evidence of effective governance.
- Assuming governance works because no incidents were reported.
- Measuring governance only through audit results.
- Ignoring overdue treatment plans when judging governance.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From direction to outcome
The governance outcomes
1 / 8