Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Applying a Framework: the Risk Management Life Cycle
The shared cycle
Every framework, whether ISO 31000, NIST or COSO, follows the same basic cycle. Communication and consultation with stakeholders run through every stage.
What each stage produces
| Stage | Output |
|---|---|
| Establish context | Objectives, scope, criteria, appetite |
| Identify | Risk scenarios: what could happen and why |
| Analyse | Likelihood and impact of each scenario |
| Evaluate | Priorities compared with appetite |
| Respond | Chosen responses and action plans |
| Monitor and review | KRIs, control results, updated profile |
Order matters
Most CRISC “FIRST” and “NEXT” questions are about this sequence. You can’t evaluate a risk you haven’t analysed, or choose a response before you know whether the risk exceeds appetite.
Example. “An assessment has identified and analysed a new risk. What should happen NEXT?” The answer is to evaluate it against risk appetite, not to implement a control.
Keeping the cycle running
- Reassess on significant change: new systems, suppliers, regulations.
- Feed incidents and audit findings back into identification.
- Monitor KRIs between formal assessments.
- Communicate results to owners and stakeholders throughout.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step in risk management | Establish context and objectives |
| After analysis | Evaluate against appetite |
| After a response is implemented | Monitor whether it’s effective |
| How often to assess | Periodically and when significant change occurs |
In short
- Every framework follows the same basic cycle: context, identify, analyse, evaluate, respond, monitor and review.
- Communication and consultation with stakeholders run through every stage.
- Establishing context comes first: objectives, scope, criteria and appetite.
- Evaluation compares analysed risk with appetite to decide which risks need a response.
- The cycle never ends; change, incidents and new threats restart it.
- Many exam questions test which stage comes FIRST or NEXT.
Exam traps
- Selecting controls before risks have been analysed and evaluated.
- Treating risk assessment as a once-a-year event.
- Skipping context, so assessments use inconsistent criteria.
- Forgetting to monitor whether responses actually worked.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The shared cycle
1 / 8