Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Building and Tracking Risk Action Plans
What a plan contains
Tracking progress
- The plan is approved by the risk owner.
- The action owner updates status regularly.
- The practitioner monitors and reports progress.
- Overdue items are escalated.
- Residual risk is verified.
Success is risk reduced
A plan can complete every task and still miss its purpose. Success means the residual risk has reached the target agreed with the risk owner, confirmed by testing the new or improved controls.
Example. An action plan to reduce phishing risk delivered training to every employee on time. Simulated phishing showed click rates unchanged, so the plan was extended with MFA and reporting tools until the target was met.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| MOST important element of an action plan | Owner and due date |
| When is a plan complete | When the target residual risk is verified |
| High-risk action is overdue | Escalate through the agreed path |
| Who approves the plan | The risk owner |
In short
- A risk action plan turns a chosen response into specific, owned, dated actions.
- Each plan needs an owner, milestones, resources and a measure of success tied to residual risk.
- Track plans in the risk register or a linked tool, with regular status updates.
- Overdue actions on high risks are escalated through the agreed path.
- A plan is complete when the residual risk target is verified, not when tasks are ticked off.
Exam traps
- Plans with no owner or due date.
- Closing a risk when the plan is approved rather than delivered.
- Measuring success by tasks completed instead of risk reduced.
- Letting overdue actions on high risks drift without escalation.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What a plan contains
1 / 7