Topics in this domain
- IT Risk Events, Loss Types and Business Outcomes
- Threat Sources, Actors and Motivations
- The Changing Threat Landscape and Threat Modelling
- Vulnerabilities, Control Deficiencies and Risk Conditions
- Identifying Internal and External Risk Factors
- Building IT Risk Scenarios
- Evaluating Scenarios for Completeness and Relevance
- Common Risk Scenario Errors
- Risk Assessment Concepts and Standards
- Qualitative, Semi-Quantitative and Quantitative Analysis
- Quantitative Methods: ALE, FAIR and Monte Carlo
- Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi
- Choosing a Consistent Assessment Methodology
- Translating Technical Events into Business Impact
- Business Impact Analysis for Risk Prioritisation
- Inherent and Residual Risk
- Evaluating Risk Against Business Objectives and Appetite
- Creating and Maintaining the IT Risk Register
- Using the Risk Register to Support Decisions
Using the Risk Register to Support Decisions
From archive to tool
A register that’s only updated for audits is an archive. A register that’s used in decisions is a management tool.
Views that answer questions
| Management question | Register view |
|---|---|
| Where should we spend next year? | Top risks beyond appetite, with costed options |
| Which supplier matters most? | Risks grouped by third party |
| Are we getting better? | Trend of residual ratings over time |
| Who’s behind on actions? | Overdue treatment by owner |
Feeding other processes
- Budget planning: fund responses to the top risks.
- Audit planning: focus assurance on high risks.
- Project approval: check new risks against the profile.
- Strategy: show the risks to new objectives.
Example. Internal audit builds its annual plan from the register’s top 15 residual risks. Two audits on low-risk areas are dropped, and a review of the poorly controlled supplier onboarding process is added.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST use of the risk register | Support risk-based decisions and prioritisation |
| What the board should receive | A summarised profile, not the full register |
| Input to the audit plan | High residual risks from the register |
| Many overdue actions | Escalate to owners and senior management |
In short
- The register's value comes from using it in decisions, not from completing it.
- It supports prioritising resources, assigning ownership, tracking treatment and building the risk profile.
- Filtered views (by owner, process, supplier or trend) answer specific management questions.
- Budgets, audit plans and project approvals should draw on the register.
- Stale or untrusted registers stop being used, so data quality matters.
Exam traps
- Treating a complete register as the goal.
- Sending the full register to the board instead of a summarised profile.
- Planning budgets and audits without reference to the register.
- Ignoring overdue actions shown in the register.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From archive to tool
1 / 7