Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
The Risk Practitioner's Role in ERM
What the practitioner does
Advise, don’t own
| Practitioner | Risk owner |
|---|---|
| Identifies and analyses the risk | Understands its impact on objectives |
| Presents response options and costs | Chooses the response |
| Checks residual risk against appetite | Accepts residual risk |
| Monitors and reports | Delivers the treatment plan |
The translator
IT talks about vulnerabilities and outages; the board talks about revenue, customers and regulators. The practitioner translates technical findings into business impact, and business priorities into risk criteria IT can work with.
Constructive challenge
- Question ratings that don’t match the evidence.
- Ask what assumptions sit behind an estimate.
- Compare with incidents, industry data and peer experience.
- Escalate material disagreements rather than silently accepting them.
Example. A business unit rates the risk of a cloud migration as low because “the provider handles security”. The practitioner points out the customer’s responsibilities under shared responsibility, and the rating is raised to medium with new controls.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| PRIMARY role of the risk practitioner | Help the business make informed risk decisions |
| Owner rates a risk too low | Challenge with evidence; escalate if material |
| Who implements the control | The control owner, not the practitioner |
| Practitioner’s line | Usually the second line |
In short
- The risk practitioner facilitates identification, analyses and evaluates risk, advises on responses, monitors and reports.
- Owners decide and accept; the practitioner makes sure decisions are informed and recorded.
- The practitioner translates between IT and the business, in both directions.
- Challenging optimistic or incomplete risk assessments is part of the job.
- The practitioner improves the risk process itself: methods, criteria, tools and awareness.
Exam traps
- The practitioner accepting or owning a business risk.
- The practitioner implementing controls instead of advising on them.
- Accepting the business's risk rating without challenge.
- Acting as an auditor rather than a second-line adviser.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What the practitioner does
1 / 8