DerpGRC

    Topics in this domain

    Enterprise Architecture and IT Risk

    Architecture and operations · 1 min read

    The architecture layers

    Business, data, application and technology architecture, with security running through all four.

    Why it matters for risk

    EA benefits for risk: dependency view, standard technologies, technical debt visible, security by design, roadmap risk.

    Standard, supported technologies reduce complexity and risk; sprawl and unsupported systems increase it.

    Roadmaps and transition risk

    A technology roadmap moves the organisation from its current architecture to a target state. The destination may be lower risk, but the journey isn’t: migrations, parallel systems and skills gaps all create risk along the way.

    Example. A bank’s roadmap retired a 20-year-old core system. Architecture mapping found 40 undocumented interfaces depending on it. Each became a migration risk with an owner before cutover planning began.

    Architecture governance

    • Architecture standards are approved and maintained.
    • Projects are reviewed against standards at design.
    • Exceptions are risk-assessed and time-limited.
    • Unsupported systems are tracked in the risk register.

    How the exam asks about it

    If the question asks…The answer is usually…
    Benefit of EA to risk managementShows dependencies and supports risk-aware decisions
    Project wants a non-standard technologyA risk-assessed architecture exception
    Risk of moving to a target architectureTransition risk must be assessed
    Unsupported legacy systemRecord and manage the risk; plan replacement

    In short

    • Enterprise architecture describes the business, data, application and technology layers and how they connect.
    • It shows dependencies, technical debt and single points of failure that drive IT risk.
    • Standard, supported technologies reduce complexity and risk; sprawl and unsupported systems increase it.
    • Technology roadmaps move from current to target state; the transition itself carries risk.
    • Security and risk should be built into architecture decisions, not reviewed afterwards.

    Exam traps

    • Treating architecture as an IT-only concern with no business input.
    • Ignoring the risk of the transition between current and target states.
    • Allowing projects to bypass architecture standards without exceptions.
    • Leaving unsupported legacy systems off the risk register.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 4 · Architecture and operations

    Enterprise Architecture and IT Risk

    How enterprise architecture gives the risk practitioner a map of business processes, data, applications and technology, and how architecture choices and technology roadmaps create or reduce IT risk.

    1 / 8