Domain 3: Risk Response and Reporting

CRISC · about 32% of the exam

Choosing and owning risk responses, managing third parties and exceptions, designing and testing controls, and monitoring and reporting risk.

Risk response

Risk Response Options: Accept, Mitigate, Transfer, Avoid The four ways to respond to IT risk, when each fits, and why the risk owner chooses the response after the risk practitioner sets out the options.
Aligning Responses with Appetite and Tolerance How to size a risk response so that residual risk lands within appetite and tolerance, avoiding both over-treatment that wastes resources and under-treatment that leaves the business exposed.
Cost-Benefit Analysis of Risk Responses How to compare response options by their full cost and the risk they remove, including doing nothing, and when non-financial factors override the numbers.
Bias in Risk Decisions and Reporting The cognitive biases that distort risk estimates, responses and reports, and the structured methods a risk practitioner uses to keep decisions objective.

Risk Owners and Control Owners The difference between owning a risk and owning a control, why they're often different people, and how the two work together to keep risk within appetite.
RACI and Escalation How a RACI chart makes responsibilities for risk activities clear, and how agreed escalation paths and thresholds move risks to the right decision-makers in time.

Third-Party Risk Governance and Due Diligence How the organisation governs the risk of suppliers and outsourcing through the third-party life cycle, tiering by risk and due diligence before contracts are signed.
Contracts, SLAs and the Right to Audit How contracts and service level agreements turn risk requirements into enforceable obligations, and which clauses matter most for managing third-party IT risk.
Monitoring Third Parties and Planning Exit How to keep watching supplier risk during the relationship, and how a planned exit strategy protects the business if a supplier fails, is breached or has to be replaced.

Managing Issues, Findings and Control Deviations How findings from audits, control tests, incidents and self-assessments are logged, rated by their effect on risk, assigned and tracked to verified closure.
Risk Acceptance, Exceptions and Exemptions How risks are formally accepted at the right level, how policy exceptions and exemptions differ, and why every one needs an owner, conditions and a review date.

Control Frameworks and Their Purpose What control frameworks and catalogues are for, the main ones a CRISC candidate should recognise, and how to use them without letting the catalogue replace risk-based thinking.
Control Types and Functions How controls are classified by function (deterrent, preventive, detective, corrective, compensating) and by type (administrative, technical, physical), and why good designs layer them.
Designing and Selecting Controls How to choose and design controls from the risk rather than the catalogue, weighing effectiveness, cost, fit and side effects, and building in ownership and evidence from the start.
Implementing Controls and Why Implementations Fail How a control moves from design to business as usual, the common reasons implementations fail, and how the risk practitioner checks that a control is genuinely operating.

Control Design versus Operating Effectiveness The two questions every control test answers (could it work, and did it work throughout the period?) and why design is tested first.
Control Testing: Objectives, Evidence and Frequency How to plan a control test from its objective, choose testing methods and evidence, size samples and set test frequency by risk, and turn results into decisions.

Building and Tracking Risk Action Plans How a chosen risk response becomes an action plan with owners, dates, resources and success measures, and how progress is tracked and escalated until residual risk reaches its target.
Collecting and Aggregating Risk Data Where risk data comes from, how to normalise and aggregate data from different sources so it means something, and how aggregation reveals concentrations of risk.
Validating Risk Data Quality Why risk decisions depend on data quality, the dimensions of good risk data, and how the risk practitioner validates data before using it to rate, report or decide.

KRIs, KPIs and KCIs The difference between key risk, performance, control and goal indicators, what makes each useful, and how to choose indicators that warn before risk materialises.
Thresholds, Escalation Triggers and Appetite How KRI thresholds are set inside risk tolerance so that warnings arrive in time to act, and how each threshold triggers a named response and escalation.
Metric Pitfalls and Misuse How risk metrics mislead (measuring activity instead of risk, gaming, vanity metrics, overload and bad data) and how the risk practitioner designs and reads metrics to avoid it.
Continuous Monitoring versus Periodic Assessment How continuous, automated monitoring of risks and controls complements periodic assessments, what each is good at, and where each fits in the risk program.

Tailoring Risk Reports to the Audience How the same risk information is reported differently to the board, executives, committees, risk owners and regulators, and what every good risk report contains.
Heat Maps, Dashboards and Scorecards The visual formats used in risk reporting, what each is best at, how they can mislead, and how to design a one-page view that leads to decisions.

Identifying and Assessing Emerging Risks What emerging risks are, where the early signals come from, and how to assess risks that are uncertain, fast-moving and hard to quantify.
Integrating Emerging Risk into Decisions How emerging risks move from a watch list into the normal risk process, with scenarios, owners, indicators and a place in reports, so leaders can make timely decisions.