Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
Why use a framework
A framework gives everyone the same method, the same words and the same scales. That’s what lets risks from different parts of the organisation be compared, and lets results be repeated next year.
The main frameworks
Framework or catalogue?
- Risk frameworks tell you how to manage risk: ISO 31000, COSO ERM, NIST SP 800-30, ISO/IEC 27005.
- Control catalogues tell you which controls exist: ISO/IEC 27002, NIST SP 800-53, the CIS Controls.
- Quantification models tell you how to size risk in money: FAIR.
Choosing one
- Fit with regulation and customer expectations.
- Size and maturity of the organisation.
- Alignment with existing ERM and IT governance.
- Ability to apply it consistently.
Example. A mid-sized insurer already uses COSO ERM at board level. Its IT risk team adopts NIST SP 800-30 for assessments but maps results onto the COSO scales, so IT risks appear in the enterprise report in the same language.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| MOST important when selecting a framework | Fit with the organisation’s needs and obligations |
| Benefit of a common framework | Consistent, comparable, repeatable risk results |
| Framework for quantifying risk in money | FAIR |
| Guidance on conducting IT risk assessments | NIST SP 800-30 |
In short
- Frameworks give a consistent method, vocabulary and set of roles for managing risk.
- ISO 31000 offers principles and a generic process for any risk; COSO ERM links risk to strategy and performance.
- NIST SP 800-30 guides IT risk assessment; ISO/IEC 27005 supports information security risk under ISO 27001.
- COBIT, with ISACA's risk guidance, links IT risk to IT governance and management.
- FAIR quantifies risk in money; it complements rather than replaces a framework.
- Choose a framework that fits the organisation's size, sector and obligations, then apply it consistently.
Exam traps
- Thinking any one framework is mandatory for every organisation.
- Mixing frameworks so that scales and terms are inconsistent.
- Adopting a framework's full detail when the organisation is small.
- Confusing a risk framework with a control catalogue.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The main frameworks
1 / 8