Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Making Risk-Based Business Decisions
Risk and reward
Every opportunity carries risk. Refusing all risk means missing opportunities; taking risk blindly means unexpected losses. Risk-based decisions sit in between: deliberate risk-taking, within the appetite the board set.
The decision step by step
What the decision-maker needs
- The options, including doing nothing.
- The benefits and costs of each.
- The residual risk of each, compared with appetite.
- Who has authority to decide.
Example. A bank wants to launch an app feature in six weeks. Full penetration testing would take eight. The practitioner presents three options with the residual risk of each. The COO accepts a phased launch: limited users first, with testing completed before full release.
Right level, on the record
| Residual risk | Decided by |
|---|---|
| Low, within appetite | Process or asset owner |
| Medium, near tolerance | Business unit head |
| High or beyond appetite | Executive or board risk committee |
Record every significant decision, with its conditions and review date.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Practitioner’s role in a business decision | Provide risk information and options |
| BEST basis for a risk decision | Comparison with appetite and tolerance |
| Project wants to accept a high risk | Escalate to the authority level that can accept it |
| After the decision | Record it and monitor the risk |
In short
- Risk-based decisions weigh the benefit of an opportunity against its risks, using the board's appetite.
- The practitioner provides options, residual risk and costs; the owner decides.
- Taking risk is normal; the goal is informed, deliberate risk-taking within appetite.
- Decisions should be made at the level of authority that matches the size of the risk.
- Every significant risk decision should be recorded with its conditions and review date.
Exam traps
- Assuming the safest option is always the best.
- Deciding without comparing options with appetite.
- Letting a project team accept risk beyond its authority to meet a deadline.
- Failing to record the decision and who made it.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The decision step by step
1 / 8