Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Incident and Problem Management Oversight
Two related processes
Incidents should be prioritised by business impact and urgency, not by who reported them.
What the risk practitioner uses
| Data | Risk use |
|---|---|
| Incident trends | Likelihood estimates; KRIs |
| Root causes | Control weaknesses to address |
| Incidents with no matching scenario | Gaps in the risk register |
| Repeat incidents | A sign problem management isn’t working |
Oversight questions
- Are incidents prioritised by business impact?
- Do major incidents get a root cause analysis?
- Are known errors tracked to permanent fixes?
- Does incident data feed the risk register?
Example. The service desk logged 300 similar VPN failures in a quarter, each closed with a reboot. The practitioner flagged it as a risk; problem management found a capacity limit, and a permanent fix ended the incidents.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Recurring incidents of the same type | Problem management is needed |
| How to prioritise incidents | Business impact and urgency |
| Incident not matching any scenario | Update risk identification |
| Value of incident data to risk | Evidence for likelihood and control effectiveness |
In short
- Incident management restores service quickly; problem management finds and removes root causes.
- Incidents should be prioritised by business impact and urgency.
- Recurring incidents point to weak problem management.
- Incident and problem data are evidence for risk assessments, KRIs and control effectiveness.
- Incidents not covered by any risk scenario reveal gaps in risk identification.
Exam traps
- Closing incidents repeatedly without addressing root causes.
- Prioritising incidents by who reported them.
- Keeping incident data away from the risk function.
- Treating a low number of reported incidents as proof of low risk.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Two related processes
1 / 7