Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Organisational Structure, Roles and Decision Rights
Who does what
| Role | Main responsibility in IT risk |
|---|---|
| Board / risk committee | Sets risk appetite; oversees the risk profile |
| Senior management | Owns risk management; sets policy and provides resources |
| Risk owners | Business managers who decide and act on specific risks |
| Risk practitioner / risk function | Facilitates, analyses, challenges and reports |
| Control owners | Design and operate controls |
| Internal audit | Provides independent assurance |
Decision rights
Decision rights say who may decide what. When they’re unclear, risks fall between teams, or get decided by whoever shouts loudest. Acceptance authority should scale with the size of the risk.
Committees
- Risk committee: board or executive level; reviews the enterprise risk profile and appetite.
- IT steering committee: prioritises IT investments and resolves conflicts, taking risk into account.
- Security steering committee: coordinates security priorities across business units.
Structure creates or removes risk
- Unclear reporting lines: risks escalate to nobody.
- Overlapping roles: everyone assumes someone else owns the risk.
- Conflicts of interest: risk reports get filtered by the people they affect.
The fix is a RACI, named owners and an independent risk function with access to senior management.
Example. A bank’s CISO reports to the head of IT operations. Several risks created by IT cost cuts never reached the risk committee. Moving the risk and security reporting line outside IT fixed the filtering.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who should accept an IT-related business risk | The business risk owner, at the right level of authority |
| Role of the risk practitioner | Facilitate, analyse, advise and report |
| Who sets risk appetite | The board |
| Why define decision rights | So risks are owned and decided at the right level |
In short
- The board sets direction and risk appetite; senior management owns and runs risk management; the risk function facilitates and challenges.
- Decision rights define who may decide what: accept risk, choose a response, design a control or give assurance.
- Risk owners are business managers with the authority and budget to act on the risk.
- The risk practitioner advises, facilitates and reports; they don't own business risks.
- Committees such as a risk committee or IT steering committee coordinate decisions across business units.
- Organisational structure affects risk: unclear reporting lines and overlapping roles create gaps.
Exam traps
- Making the risk practitioner or the CISO the owner of business risks.
- Assuming IT owns all IT-related risk.
- Letting internal audit design or approve the controls it will later assess.
- Accepting high risks at a level without the authority to do so.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Decision rights
1 / 8