Domain 1: Governance
Arrow keys or space to move, F for full screen. Read the notes
Governance
22 topics · Exam technique · Organisational governance · Policies and assets · Risk governance · Appetite and profile · Legal and compliance
D1Exam Technique: Thinking Like a Risk Practitioner
How CRISC questions are built, why two answers often look right, and a method for choosing the answer a risk practitioner would give: assess before acting, compare with appetite and let the owner decide.
The exam in numbers
| Item | Detail |
|---|---|
| Questions | 150 multiple choice, one best answer |
| Time | 4 hours |
| Scoring | Scaled 200-800; 450 passes |
| Weights (from Nov 2025) | Governance 26%, Assessment 22%, Response and Reporting 32%, IT and Security 20% |
| Experience to certify | 3 years in IT risk and IS control, across at least 2 domains |
Two answers look right
Most CRISC questions have two or three plausible options. A security engineer, an auditor and a risk practitioner would each pick differently. The exam wants the risk practitioner's answer: understand and assess the risk, then help the owner choose a response.
Example'A new vulnerability affects a customer portal. What should the risk practitioner do FIRST?' Patching sounds right, but the practitioner first assesses the risk: exposure, likelihood, impact and existing controls. Then the owner decides on the response.
A method for every question
The practitioner's mindset
Reading the qualifiers
| Qualifier | What it's really asking |
|---|---|
| FIRST | Which step of the risk process comes before the others? |
| BEST / MOST effective | The option that best keeps risk within appetite for the business |
| PRIMARY / MAIN | The fundamental purpose, not a side benefit |
| MOST LIKELY | The probable cause or result, not the worst case |
| GREATEST concern / risk | What would hurt business objectives most |
Preparing well
- 1Learn the risk life cycle; most questions sit at one stage of it.
- 2For wrong answers, ask: which stage did that option skip?
- 3Study by weight: Domain 3 alone is 32% of the exam.
- 4Time: about 1.5 minutes per question; flag and return.
- 5Answer every question; there's no penalty for guessing.
Key takeaways
- ✓The CRISC exam has 150 multiple-choice questions in 4 hours; scores are scaled from 200 to 800 and 450 passes.
- ✓Every question is answered from the risk practitioner's viewpoint: identifying, assessing, responding to and reporting IT risk so the business can decide.
- ✓Read the qualifier: FIRST, BEST, MOST, PRIMARY and MOST LIKELY change which answer is right.
- ✓FIRST questions are about the risk process in order: context, identification, analysis, evaluation, response, monitoring.
- ✓The risk owner decides and accepts risk; the practitioner advises, facilitates and reports.
- ✓Answers that link risk to business objectives and appetite are usually right; answers that jump to a control are usually wrong.
Exam traps
- !Choosing to implement a control before the risk has been assessed.
- !Letting the risk practitioner, the CISO or IT accept a business risk.
- !Picking 'eliminate the risk'; the aim is risk within appetite.
- !Choosing the most technical answer instead of the risk-process answer.
- !Reporting technical detail to the board instead of business impact.
Aligning IT Risk Management with Business Strategy
Why IT risk management starts from the organisation's strategy and objectives, and how the risk practitioner links each IT risk to the business goal it threatens.
Why strategy comes first
IT risk is the risk that technology stops the business reaching its goals. A risk practitioner who doesn't know the goals can't tell which IT risks matter. That's why understanding strategy and objectives is the first step in every IT risk activity.
From goal to risk to control
Risk supports strategy both ways
Protects goalsIdentifies what could stop current objectives and keeps that risk within appetite.
Informs choicesShows the risk of new strategies, so leaders choose with their eyes open.
ExampleA retailer plans to move all sales online within two years. The risk practitioner shows that the plan makes website availability and payment fraud top risks. The board approves the strategy and funds resilience and fraud controls as part of it.
Speak the business's language
| Technical statement | Business statement |
|---|---|
| Unpatched web server | Possible theft of 2 million customer records and regulatory fines |
| Single database server | Online sales stop if it fails; about 40,000 an hour lost |
| Weak vendor access control | A supplier compromise could halt production |
When strategy changes
- 1Revisit the risk profile and top risks.
- 2Check whether risk appetite still fits.
- 3Reprioritise risk responses and resources.
- 4Update risk scenarios for new products, markets or technology.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step in an IT risk assessment | Understand business objectives and context |
| MOST important when prioritising IT risks | Impact on business objectives |
| BEST way to get management attention | Express risk in business terms |
| After a major strategy change | Reassess the risk profile |
Key takeaways
- ✓IT risk matters only because it can stop the business achieving its objectives; every risk should trace back to one.
- ✓Understanding business strategy and objectives is the first step in any IT risk activity.
- ✓Risk management supports strategy in both directions: it protects existing goals and informs decisions about new ones.
- ✓Risks expressed in business terms get attention and funding; risks expressed in technical terms don't.
- ✓When strategy changes, the risk profile, priorities and appetite need to be revisited.
Exam traps
- !Starting a risk assessment with a vulnerability scan instead of the business objectives.
- !Treating IT risk as an IT problem rather than a business risk.
- !Assuming a technically severe issue is automatically a high business risk.
- !Leaving the risk program unchanged after a major change in strategy.
Organisational Structure, Roles and Decision Rights
Who does what in IT risk management, from the board to control owners, and why clear decision rights stop risks from falling between teams.
Who does what
| Role | Main responsibility in IT risk |
|---|---|
| Board / risk committee | Sets appetite; oversees the risk profile |
| Senior management | Owns risk management; sets policy and resources |
| Risk owners | Decide and act on specific risks |
| Risk practitioner / risk function | Facilitates, analyses, challenges, reports |
| Control owners | Design and run controls |
| Internal audit | Independent assurance |
Decision rights
Committees
Risk committeeBoard or executive level; reviews the enterprise risk profile and appetite.
IT steering committeePrioritises IT investments and resolves conflicts, considering risk.
Security steering committeeCoordinates security priorities across business units.
Structure creates or removes risk
- 1Unclear reporting lines: risks escalate to nobody.
- 2Overlapping roles: everyone assumes someone else owns it.
- 3Conflicts of interest: risk reports filtered by those affected.
- 4Fix with a RACI, named owners and an independent risk function.
ExampleA bank's CISO reports to the head of IT operations. Several risks created by IT cost cuts never reached the risk committee. Moving the risk and security reporting line outside IT fixed the filtering.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who should accept an IT-related business risk | The business risk owner, at the right level |
| Role of the risk practitioner | Facilitate, analyse, advise and report |
| Who sets risk appetite | The board |
| Why define decision rights | So risks are owned and decided at the right level |
Key takeaways
- ✓The board sets direction and risk appetite; senior management owns and runs risk management; the risk function facilitates and challenges.
- ✓Decision rights define who may decide what: accept risk, choose a response, design a control or give assurance.
- ✓Risk owners are business managers with the authority and budget to act on the risk.
- ✓The risk practitioner advises, facilitates and reports; they don't own business risks.
- ✓Committees such as a risk committee or IT steering committee coordinate decisions across business units.
- ✓Organisational structure affects risk: unclear reporting lines and overlapping roles create gaps.
Exam traps
- !Making the risk practitioner or the CISO the owner of business risks.
- !Assuming IT owns all IT-related risk.
- !Letting internal audit design or approve the controls it will later assess.
- !Accepting high risks at a level without the authority to do so.
Risk Ownership and Accountability
What a risk owner is, how to choose one, and how accountability is made real through named owners, records, review and consequences.
What a risk owner is
The risk owner is the person accountable for managing a risk, with the authority and budget to act on it. It's usually the business manager whose process or objectives the risk threatens, not the person who runs the technology.
Choosing the owner
| Risk | Owner | Not the owner |
|---|---|---|
| Payment fraud in the finance system | CFO | Finance system administrator |
| Customer portal outage | Head of digital sales | Hosting team |
| Supplier data breach | Business owner of the service | Procurement clerk |
What owners do
- 1Understand the risk and its impact on their objectives.
- 2Choose a response from the options offered.
- 3Accept residual risk within their authority.
- 4Fund and track treatment plans.
- 5Report status and escalate when needed.
Making accountability real
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who should own an IT-related risk | The business manager accountable for the affected process |
| MOST important attribute of a risk owner | Authority and accountability to act |
| Who accepts residual risk | The risk owner, within their authority |
| Role of the risk practitioner | Help owners understand and manage their risks |
Key takeaways
- ✓A risk owner is the person with the accountability and authority to manage a risk, usually the business manager whose objectives it threatens.
- ✓Every risk in the register needs one named owner, a person rather than a team.
- ✓Owners decide the response, accept residual risk within their authority and report on progress.
- ✓Accountability needs clear expectations, named owners, traceable actions, review and fair consequences.
- ✓The risk practitioner helps owners understand their risks but never takes ownership from them.
Exam traps
- !Assigning ownership to IT because the risk involves a system.
- !Assigning a committee or department as owner instead of a person.
- !Treating the person who found the risk as its owner.
- !Allowing an owner to accept a risk above their authority.
Segregation of Duties
Why separating key duties reduces the risk of error and fraud, the combinations that matter most in IT, and what to do when a small team can't separate them.
What SoD prevents
Segregation of duties splits a task so that no single person can both carry it out and hide a mistake or fraud. It's one of the oldest and most effective controls against insider risk.
Separating duties step by step
IT conflicts that matter
When you can't separate
ExampleA five-person finance team can't fully separate payment entry and approval. The CFO reviews a weekly report of all payments and supplier bank changes, and the bank sends confirmations to the CFO directly.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST evidence of SoD | Actual system access compared with an SoD rule set |
| Small team can't separate duties | Compensating controls by someone independent |
| GREATEST SoD risk in IT | A developer or admin who can change production and hide it |
| Purpose of SoD | Prevent one person committing and concealing errors or fraud |
Key takeaways
- ✓Segregation of duties (SoD) means no single person can both carry out and conceal an error or fraud.
- ✓Classic duties to separate are authorising, recording, custody of assets and reconciling.
- ✓In IT, the worst conflicts let someone change systems or access and also hide it.
- ✓Where SoD isn't practical, compensating controls such as independent review, logging and reconciliation reduce the risk.
- ✓SoD must be checked against actual system access, not job descriptions.
Exam traps
- !Relying on job descriptions or org charts to prove segregation.
- !Choosing 'hire more staff' as the answer for a small team; compensating controls are expected.
- !Accepting compensating controls performed by the same person who holds the conflict.
- !Forgetting that privileged IT users can often bypass application-level SoD.
Risk Culture and Tone at the Top
What risk culture is, how leaders shape it, how to recognise a healthy one, and how a risk awareness program helps people raise risks early.
What risk culture is
Risk culture is how people actually treat risk when no rule tells them what to do: whether they raise problems, take shortcuts or ask before acting. It decides whether policies work in practice.
Where culture comes from
Healthy versus weak
| Healthy risk culture | Weak risk culture |
|---|---|
| Risks raised early by the business | Risks found only by audit |
| Bad news travels up quickly | Incidents hidden or downplayed |
| Leaders follow the rules | Exceptions for senior staff |
| Mistakes treated as learning | Blame and fear |
Risk awareness program
- 1Explain what IT risk means in each role.
- 2Show how to report risks and incidents, simply.
- 3Use real examples from the organisation and its sector.
- 4Repeat regularly; measure behaviour, not attendance.
ExampleAfter staff who reported phishing clicks were publicly criticised, reports fell by 70%. A new no-blame approach, with thanks for every report, restored reporting within three months.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| GREATEST influence on risk culture | Tone at the top: leaders' behaviour |
| Sign of a healthy culture | Risks raised openly by the business |
| BEST way to improve reporting | No-blame reporting, easy channels |
| Purpose of risk awareness | Everyone recognises and reports risk in their work |
Key takeaways
- ✓Risk culture is the shared values, attitudes and behaviours that decide how people treat risk when no rule tells them what to do.
- ✓Tone at the top is the strongest influence: people copy what leaders do and reward, not what policies say.
- ✓Healthy cultures raise risks early, discuss them openly and don't punish honest reporting.
- ✓Signs of a weak culture include hidden incidents, routine workarounds and risks discovered only by audit.
- ✓A risk awareness program helps everyone recognise and report risk in their own work.
Exam traps
- !Trying to fix culture with stricter policies or penalties alone.
- !Treating awareness as a once-a-year training event.
- !Assuming a culture is healthy because few incidents are reported.
- !Measuring culture by training completion rather than behaviour.
Ethics and Professional Conduct
The ISACA Code of Professional Ethics, why ethics matters in risk work, and how a risk practitioner handles pressure to soften, hide or misreport risk.
Why ethics matters in risk work
Risk reports guide decisions worth millions. If ratings are softened to please someone, or risks quietly dropped, the board decides on false information. The value of the risk function depends on its honesty.
ISACA Code of Ethics
Pressure to change a rating
- 1 Ask for new evidence
- 2 Re-assess objectively
- 3 Document both views
- 4 Escalate if unresolved
ExampleA project sponsor asks the risk practitioner to rate a data migration risk as low so go-live isn't delayed. With no new evidence, the practitioner keeps the rating, records the sponsor's view and raises it with the steering committee.
Other ethical duties
- 1Protect confidential information; don't use it for gain.
- 2Declare conflicts of interest; step back if needed.
- 3Take on only work you're competent to do.
- 4Decline gifts that could affect objectivity.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Manager asks to lower a rating | Keep it unless evidence changes; escalate |
| Practitioner has a conflict of interest | Disclose it and step back |
| Internal escalation fails on a legal issue | Seek legal advice on reporting duties |
| Purpose of the code of ethics | Objective, competent, honest professional work |
Key takeaways
- ✓CRISC holders must follow ISACA's Code of Professional Ethics; breaches can lead to disciplinary action.
- ✓Ethical risk work means reporting risks objectively and completely, even when the news is unwelcome.
- ✓Pressure to downgrade a risk rating or leave a risk out of a report must be resisted and, if needed, escalated.
- ✓Confidential information gained in risk work must be protected and not used for personal benefit.
- ✓Practitioners take on only work they're competent to do, and declare conflicts of interest.
Exam traps
- !Lowering a risk rating because a senior manager asks, without new evidence.
- !Going straight to the media or regulator before using internal escalation.
- !Using confidential information for personal gain.
- !Accepting gifts or favours from those whose risks you assess.
Policies, Standards, Procedures and Guidelines
How the policy framework turns management intent into specific requirements and steps, and why it's one of the main ways risk appetite becomes day-to-day behaviour.
The hierarchy
What goes where
| Document | Example | Mandatory? |
|---|---|---|
| Policy | Access is granted on a need-to-know basis | Yes |
| Standard | MFA for all remote access; 14-character passwords | Yes |
| Procedure | How to request and approve access in the HR system | Yes |
| Guideline | Consider a password manager | No |
Policies carry risk appetite
When the board says it has a low appetite for data loss, the policy framework is how that becomes real: a data protection policy, encryption standards and handling procedures. Without it, appetite stays a statement on paper.
What makes a good policy
- 1Approved by senior management.
- 2Short, clear and technology-neutral.
- 3A named owner and a review date.
- 4Realistic: people can actually follow it.
- 5Supported by standards, procedures and an exception process.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who approves policy | Senior management or the board |
| Where specific technical requirements belong | Standards |
| Which document is advisory | Guidelines |
| Why keep policies high level | So they stay stable as technology changes |
Key takeaways
- ✓Policies state management's intent and are approved by senior management; standards, procedures and guidelines support them.
- ✓Policies, standards and procedures are mandatory; guidelines are advice.
- ✓Policies should be high level and stable; technology-specific detail belongs in standards.
- ✓The policy framework is how risk appetite and control requirements reach everyday work.
- ✓Policies need owners, review dates and an exception process to stay useful.
Exam traps
- !Putting technical settings in the policy, so it needs constant re-approval.
- !Treating guidelines as mandatory.
- !Having policies approved by IT staff instead of senior management.
- !Writing policies that can't realistically be followed.
Policy Lifecycle, Exceptions and Enforcement
How policies are drafted, approved, communicated, enforced and reviewed, and how exceptions are handled so that departures from policy stay visible, owned and time-limited.
The life cycle
Exceptions
Sometimes a system or process can't meet a policy, for a good reason. An exception lets that happen safely: the risk is assessed, compensating controls are added, the owner accepts what's left, and it expires on a set date.
What an exception record holds
| Field | Why it matters |
|---|---|
| Requirement not met | So everyone knows the gap |
| Reason and business need | Shows it's justified |
| Risk rating and compensating controls | Keeps risk visible and reduced |
| Owner and approver | Accountability at the right level |
| Expiry date | Forces a review instead of permanence |
Enforcement
ExampleMonitoring shows 40% of staff in one region store files on personal cloud drives. Investigation finds the approved file share is too slow from that region. Fixing the network solves the problem; discipline wouldn't have.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| System can't meet policy | Formal exception with compensating controls and expiry |
| Widespread non-compliance | Find out why before enforcing |
| When to review policy | At least yearly and on significant change |
| Who approves an exception | The risk owner with suitable authority |
Key takeaways
- ✓Policies follow a life cycle: identify need, draft, consult, approve, communicate, enforce and review.
- ✓Review policies at least yearly and when the business, law or threats change.
- ✓An exception is a formally approved, risk-assessed and time-limited departure from policy.
- ✓Every exception needs an owner, compensating controls where possible, and an expiry date.
- ✓When many people break a policy, find out why: the policy may be unworkable.
Exam traps
- !Approving exceptions by email with no record or expiry.
- !Rewriting the policy to remove a requirement just because one system can't meet it.
- !Disciplining everyone when widespread non-compliance points to a bad policy.
- !Letting exceptions renew automatically without review.
Business Process Review: Ownership and Criticality
How reviewing business processes shows where IT risk really matters: which processes are critical, who owns them and which systems, data, people and suppliers they depend on.
Why processes come first
A server failing only matters because of what stops when it fails. Business process review links IT assets to the work they support, so the risk practitioner can judge impact in business terms rather than technical ones.
The review step by step
Rating criticality
Hidden dependencies
- 1End-user spreadsheets in critical calculations.
- 2A single expert who knows how a system works.
- 3Suppliers and cloud services in the chain.
- 4Shared infrastructure such as identity and DNS.
ExampleA logistics firm's dispatch process looked well protected until mapping showed it relied on a route-planning spreadsheet maintained by one analyst. It became a top risk overnight.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST basis for rating IT asset importance | Criticality of the business processes it supports |
| Who owns a business process | A named business manager |
| Purpose of mapping dependencies | Find what each process relies on, including hidden items |
| Output used for | Scenarios, BIA, continuity and the risk profile |
Key takeaways
- ✓IT risk is felt through business processes, so understanding processes comes before assessing IT risk.
- ✓Every key process needs one accountable business owner.
- ✓Criticality depends on the impact of the process failing on objectives, customers, finances and legal duties.
- ✓Mapping dependencies shows which systems, data, suppliers and people each process relies on.
- ✓Process reviews feed risk scenarios, the BIA, continuity planning and the risk profile.
Exam traps
- !Rating systems by technical importance instead of the processes they support.
- !Assuming IT owns the process because it runs the system.
- !Missing hidden dependencies such as spreadsheets, suppliers or key individuals.
- !Reviewing processes once and never updating after change.
Identifying and Valuing Organisational Assets
Which assets matter for IT risk (information, systems, people, suppliers and intangibles), how to find them and how to value them by business impact rather than purchase price.
What counts as an asset
Finding assets
- 1Automated discovery on networks and cloud accounts.
- 2Business process reviews and interviews.
- 3Procurement and contract records.
- 4Data discovery for sensitive information.
Valuing assets
ExampleA research team's results database runs on a cheap server. Its value is set by what a competitor could do with unpublished results and the years of work it holds, which makes it one of the most valuable assets in the company.
Who values them
| Role | Contribution |
|---|---|
| Asset owner (business) | Sets value and classification |
| Risk practitioner | Provides method and criteria; challenges |
| IT / custodian | Provides technical facts and dependencies |
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST basis for asset value | Business impact of losing it |
| Who sets asset value | The business owner |
| FIRST step before assessing risk to assets | Identify and inventory them |
| MOST complete inventory method | Automated discovery reconciled with business input |
Key takeaways
- ✓Assets include information, systems, infrastructure, people, suppliers and intangibles such as reputation.
- ✓Identifying assets is an early step in risk assessment; you can't assess risk to something you don't know about.
- ✓Value comes from business impact if confidentiality, integrity or availability is lost, not from purchase price.
- ✓The asset owner, a business manager, sets value and classification with the practitioner's help.
- ✓Automated discovery plus business input gives the most complete inventory.
Exam traps
- !Valuing information by the cost of the server that stores it.
- !Listing only hardware and software, missing data, people and suppliers.
- !Building the inventory from purchase records alone.
- !Letting IT set the value of business information.
Embedding Asset Management into Risk Governance
How keeping the asset inventory accurate through its life cycle supports every other risk activity, and the risks that appear when assets are unknown, unowned or untracked.
Why it matters
Tracking the life cycle
Risks from poor asset management
| Gap | Resulting risk |
|---|---|
| Unknown devices or cloud services | Unpatched, unmonitored, unprotected |
| No owner | Nobody decides on risk or retirement |
| Inventory not updated on change | Wrong impact analysis in incidents |
| Poor disposal | Data leaks from retired equipment |
Keeping it accurate
- 1Link the inventory to change management and procurement.
- 2Reconcile automated discovery regularly.
- 3Require owners to confirm their assets periodically.
- 4Track disposals with certificates of destruction.
ExampleA discovery scan finds 180 devices missing from the inventory, including an old file server holding HR data. It hadn't been patched in three years because nobody knew it existed.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| GREATEST risk of an incomplete inventory | Unknown assets aren't protected |
| BEST way to keep inventory current | Link to change management and automated discovery |
| Asset with no owner | Assign an owner before assessing or treating |
| Disposal control | Secure wiping or destruction with evidence |
Key takeaways
- ✓An accurate asset inventory feeds risk assessment, classification, vulnerability management, continuity and incident response.
- ✓Assets must be tracked through their whole life cycle, from acquisition to disposal.
- ✓Every asset needs an owner; ownerless assets are rarely patched, reviewed or retired.
- ✓Unknown assets, including shadow IT, are unmanaged risk.
- ✓Change management should update the inventory so it doesn't drift from reality.
Exam traps
- !Treating the inventory as a one-off project rather than a continuous process.
- !Forgetting disposal: data left on retired equipment.
- !Allowing cloud services bought on credit cards to stay off the inventory.
- !Accepting an inventory without owners as complete.
Enterprise Risk Management: Purpose and Principles
What enterprise risk management is, the principles that make it work, and how IT risk fits into the enterprise view so the board can compare it with every other risk.
What ERM is
Enterprise risk management looks at all the organisation's risks together, strategic, financial, operational, compliance and technology, and manages them in line with strategy and the board's appetite. Its aim is to help the organisation achieve its objectives, not just avoid losses.
Principles that make it work
Where IT risk fits
Why integration matters
- 1One risk language and common scales.
- 2IT risks compete fairly for attention and funding.
- 3Concentrations across categories become visible.
- 4Decisions weigh technology risk alongside other risks.
ExampleA manufacturer's IT team rated ransomware 'critical' on its own scale, but the board's ERM report showed only financial risks. After IT risk joined the ERM process, ransomware ranked third enterprise-wide and received funding.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST way to manage IT risk at enterprise level | Integrate it into ERM with common scales |
| PRIMARY purpose of ERM | Help achieve objectives within appetite |
| Benefit of a portfolio view | Compare and prioritise all risks together |
| IT risk is… | A category of business risk |
Key takeaways
- ✓ERM manages all of an organisation's risks together, linked to strategy and objectives.
- ✓IT risk is a category of business risk and should be managed within ERM, not separately.
- ✓A portfolio view on common scales lets the board compare and prioritise risks of all kinds.
- ✓ERM works when it's integrated into planning and decisions, with clear appetite and named owners.
- ✓Risk management aims to support value creation, not just avoid losses.
Exam traps
- !Running IT risk in a silo with its own scales and register.
- !Treating ERM as a compliance exercise disconnected from decisions.
- !Assuming ERM's goal is to minimise all risk.
- !Reporting IT risk to the board in technical terms that can't be compared with other risks.
The Risk Practitioner's Role in ERM
What the CRISC-certified risk practitioner actually does inside enterprise risk management, and the line between advising on risk and owning it.
What the practitioner does
Advise, don't own
| Practitioner | Risk owner |
|---|---|
| Identifies and analyses the risk | Understands its impact on objectives |
| Presents response options and costs | Chooses the response |
| Checks residual risk against appetite | Accepts residual risk |
| Monitors and reports | Delivers the treatment plan |
The translator
IT talks about vulnerabilities and outages; the board talks about revenue, customers and regulators. The practitioner translates technical findings into business impact, and business priorities into risk criteria IT can work with.
Constructive challenge
- 1Question ratings that don't match evidence.
- 2Ask what assumptions sit behind an estimate.
- 3Compare with incidents, industry data and peer experience.
- 4Escalate material disagreements; don't silently accept them.
ExampleA business unit rates the risk of a cloud migration as low because 'the provider handles security'. The practitioner points out the customer's responsibilities under shared responsibility, and the rating is raised to medium with new controls.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| PRIMARY role of the risk practitioner | Help the business make informed risk decisions |
| Owner rates a risk too low | Challenge with evidence; escalate if material |
| Who implements the control | The control owner, not the practitioner |
| Practitioner's line of defence | Usually the second line |
Key takeaways
- ✓The risk practitioner facilitates identification, analyses and evaluates risk, advises on responses, monitors and reports.
- ✓Owners decide and accept; the practitioner makes sure decisions are informed and recorded.
- ✓The practitioner translates between IT and the business, in both directions.
- ✓Challenging optimistic or incomplete risk assessments is part of the job.
- ✓The practitioner improves the risk process itself: methods, criteria, tools and awareness.
Exam traps
- !The practitioner accepting or owning a business risk.
- !The practitioner implementing controls instead of advising on them.
- !Accepting the business's risk rating without challenge.
- !Acting as an auditor rather than a second-line adviser.
The Three Lines Model and Risk Oversight
How the Three Lines Model divides responsibility for owning risk, overseeing it and giving independent assurance, and where the risk practitioner and IT sit.
The three lines
Where IT roles sit
| Role | Usual line |
|---|---|
| Business process owners | First |
| IT operations and development | First |
| IT risk function, risk practitioner | Second |
| Compliance, often information security | Second |
| Internal audit | Third |
Keeping the lines clean
- 1First line owns risk and runs controls.
- 2Second line sets method, monitors and challenges, but doesn't own.
- 3Third line stays independent; it doesn't design or run controls.
- 4All coordinate so effort isn't duplicated and gaps don't appear.
ExampleA second-line risk team started approving firewall changes itself to speed things up. Within a year it was effectively running a first-line control, and nobody independent was challenging network risk.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who provides independent assurance | Internal audit (third line) |
| Who owns IT operational risk | First-line management |
| Role of the risk function | Second line: frameworks, monitoring, challenge |
| Who oversees all three | The governing body |
Key takeaways
- ✓The first line owns and manages risk: business and operational management, including IT operations.
- ✓The second line provides expertise, frameworks, monitoring and challenge: risk management, compliance and often security.
- ✓The third line, internal audit, provides independent assurance to the governing body.
- ✓The governing body oversees all three and is accountable for risk governance.
- ✓Each line must keep its role: the second line advises rather than owns, and audit stays independent.
Exam traps
- !Placing internal audit in the first or second line.
- !Making the second line the owner of first-line risks.
- !Letting internal audit design controls it will later assess.
- !Assuming the lines can't cooperate; they should coordinate without merging roles.
Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
The main risk management frameworks and standards a CRISC candidate should recognise, what each is best for, and how to choose one for the organisation.
Why use a framework
A framework gives everyone the same method, the same words and the same scales. That's what lets risks from different parts of the organisation be compared, and lets results be repeated next year.
The main frameworks
Framework or catalogue?
Risk frameworksHow to manage risk: ISO 31000, COSO ERM, NIST SP 800-30, ISO 27005.
Control cataloguesWhich controls exist: ISO 27002, NIST SP 800-53, CIS Controls.
Quantification modelsHow to size risk in money: FAIR.
Choosing one
- 1Fit with regulation and customer expectations.
- 2Size and maturity of the organisation.
- 3Alignment with existing ERM and IT governance.
- 4Ability to apply it consistently.
ExampleA mid-sized insurer already uses COSO ERM at board level. Its IT risk team adopts NIST SP 800-30 for assessments but maps results onto the COSO scales, so IT risks appear in the enterprise report in the same language.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| MOST important when selecting a framework | Fit with the organisation's needs and obligations |
| Benefit of a common framework | Consistent, comparable, repeatable risk results |
| Framework for quantifying risk in money | FAIR |
| Guidance on conducting IT risk assessments | NIST SP 800-30 |
Key takeaways
- ✓Frameworks give a consistent method, vocabulary and set of roles for managing risk.
- ✓ISO 31000 offers principles and a generic process for any risk; COSO ERM links risk to strategy and performance.
- ✓NIST SP 800-30 guides IT risk assessment; ISO/IEC 27005 supports information security risk under ISO 27001.
- ✓COBIT, with ISACA's risk guidance, links IT risk to IT governance and management.
- ✓FAIR quantifies risk in money; it complements rather than replaces a framework.
- ✓Choose a framework that fits the organisation's size, sector and obligations, then apply it consistently.
Exam traps
- !Thinking any one framework is mandatory for every organisation.
- !Mixing frameworks so that scales and terms are inconsistent.
- !Adopting a framework's full detail when the organisation is small.
- !Confusing a risk framework with a control catalogue.
Applying a Framework: the Risk Management Life Cycle
The risk management life cycle that every framework shares, from establishing context through identification, analysis, evaluation, response and monitoring, and why the order matters on the exam.
The shared cycle
What each stage produces
| Stage | Output |
|---|---|
| Establish context | Objectives, scope, criteria, appetite |
| Identify | Risk scenarios: what could happen and why |
| Analyse | Likelihood and impact of each scenario |
| Evaluate | Priorities compared with appetite |
| Respond | Chosen responses and action plans |
| Monitor and review | KRIs, control results, updated profile |
Order matters
Most CRISC 'FIRST' and 'NEXT' questions are about this sequence. You can't evaluate a risk you haven't analysed, or choose a response before you know whether the risk exceeds appetite.
Example'An assessment has identified and analysed a new risk. What should happen NEXT?' The answer is to evaluate it against risk appetite, not to implement a control.
Keeping the cycle running
- 1Reassess on significant change: new systems, suppliers, regulations.
- 2Feed incidents and audit findings back into identification.
- 3Monitor KRIs between formal assessments.
- 4Communicate results to owners and stakeholders throughout.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step in risk management | Establish context and objectives |
| After analysis | Evaluate against appetite |
| After a response is implemented | Monitor whether it's effective |
| How often to assess | Periodically and when significant change occurs |
Key takeaways
- ✓Every framework follows the same basic cycle: context, identify, analyse, evaluate, respond, monitor and review.
- ✓Communication and consultation with stakeholders run through every stage.
- ✓Establishing context comes first: objectives, scope, criteria and appetite.
- ✓Evaluation compares analysed risk with appetite to decide which risks need a response.
- ✓The cycle never ends; change, incidents and new threats restart it.
- ✓Many exam questions test which stage comes FIRST or NEXT.
Exam traps
- !Selecting controls before risks have been analysed and evaluated.
- !Treating risk assessment as a once-a-year event.
- !Skipping context, so assessments use inconsistent criteria.
- !Forgetting to monitor whether responses actually worked.
Risk Appetite, Tolerance and Capacity
The difference between risk capacity, appetite and tolerance, who sets each, and how to turn the board's appetite into measurable tolerances and thresholds that guide everyday risk decisions.
Three different ideas
Who sets what
| Concept | Set by | Example |
|---|---|---|
| Capacity | Determined by finances and obligations | Losses above 50 million would threaten solvency |
| Appetite | Board | Low appetite for customer data loss |
| Tolerance | Senior management, within appetite | No more than 4 hours' outage of online banking |
From words to numbers
Example'Low appetite for service disruption' becomes a tolerance of no outage of the payments platform over 2 hours, and a KRI that alerts when backup failover tests exceed 90 minutes.
Using appetite
- 1Evaluate each risk: within, near or beyond appetite?
- 2Choose responses that bring risk within appetite.
- 3Escalate risks beyond appetite to the right level.
- 4Report the risk profile against appetite to the board.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who sets risk appetite | The board |
| Difference between appetite and tolerance | Overall willingness versus acceptable variation for a specific goal |
| Risk exceeds appetite | Respond further or escalate for formal acceptance |
| MOST useful appetite statement | Specific and measurable |
Key takeaways
- ✓Risk capacity is the most risk the organisation could absorb; appetite is how much it's willing to take; tolerance is the acceptable variation for a specific objective.
- ✓The board sets risk appetite, normally well below capacity.
- ✓Appetite must be turned into specific, measurable tolerances to be useful.
- ✓KRI thresholds should warn before a tolerance is breached.
- ✓Every risk response decision compares residual risk with appetite.
- ✓Appetite is reviewed when strategy, conditions or capacity change.
Exam traps
- !Confusing appetite (willingness) with capacity (ability).
- !Letting IT or the risk function set the organisation's appetite.
- !Writing appetite statements too vague to support decisions.
- !Treating appetite as fixed forever.
Establishing and Maintaining the IT Risk Profile
What the IT risk profile is, how it differs from the risk register, how it's built and kept current, and why it's the main tool for showing senior management the overall state of IT risk.
Register versus profile
Building the profile
- 1 Collect risks from the register
- 2 Group by category and business area
- 3 Aggregate and look for concentrations
- 4 Compare with appetite
- 5 Show trends and top risks
Keeping it current
Aggregation matters
Ten 'low' risks on the same customer platform may add up to one significant exposure. Looking at the profile by system, process or supplier shows concentrations that a list of individual risks hides.
ExampleSix separate medium risks all depended on one managed service provider. Viewed together in the profile, supplier concentration became a top-five enterprise risk.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| PRIMARY purpose of the risk profile | Show the overall risk position against appetite |
| When to update it | Continuously, and on significant change |
| BEST way to show the board IT risk | The profile in business terms, with trends |
| Several small related risks | Consider their aggregated effect |
Key takeaways
- ✓The risk profile is the aggregated picture of all risks: how much risk, where it sits and which way it's moving.
- ✓The register lists individual risks; the profile summarises them for oversight and decisions.
- ✓The profile is compared with risk appetite to show whether the organisation is within its limits.
- ✓It must be updated continuously as the business, technology and threats change.
- ✓Aggregation can reveal concentrations that individual risks hide.
Exam traps
- !Treating the risk register as if it were the risk profile.
- !Updating the profile only once a year.
- !Presenting the profile in technical terms the board can't use.
- !Missing aggregated risk because each item looks small on its own.
Making Risk-Based Business Decisions
How the risk practitioner helps leaders weigh opportunity against risk, using appetite, options and residual risk, so that decisions are informed, made at the right level and recorded.
Risk and reward
Every opportunity carries risk. Refusing all risk means missing opportunities; taking risk blindly means unexpected losses. Risk-based decisions sit in between: deliberate risk-taking, within the appetite the board set.
The decision step by step
What the decision-maker needs
- 1The options, including doing nothing.
- 2Benefits and costs of each.
- 3Residual risk of each, compared with appetite.
- 4Who has authority to decide.
ExampleA bank wants to launch an app feature in six weeks. Full penetration testing would take eight. The practitioner presents three options with residual risk for each. The COO accepts a phased launch: limited users first, testing completed before full release.
Right level, on the record
| Residual risk | Decided by |
|---|---|
| Low, within appetite | Process or asset owner |
| Medium, near tolerance | Business unit head |
| High or beyond appetite | Executive or board risk committee |
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Practitioner's role in a business decision | Provide risk information and options |
| BEST basis for a risk decision | Comparison with appetite and tolerance |
| Project wants to accept a high risk | Escalate to the authority level that can accept it |
| After the decision | Record it and monitor the risk |
Key takeaways
- ✓Risk-based decisions weigh the benefit of an opportunity against its risks, using the board's appetite.
- ✓The practitioner provides options, residual risk and costs; the owner decides.
- ✓Taking risk is normal; the goal is informed, deliberate risk-taking within appetite.
- ✓Decisions should be made at the level of authority that matches the size of the risk.
- ✓Every significant risk decision should be recorded with its conditions and review date.
Exam traps
- !Assuming the safest option is always the best.
- !Deciding without comparing options with appetite.
- !Letting a project team accept risk beyond its authority to meet a deadline.
- !Failing to record the decision and who made it.
Legal, Regulatory and Contractual Requirements
Where IT-related obligations come from, how the risk practitioner turns them into risks and controls, and why compliance risk is assessed like any other risk.
Where obligations come from
From obligation to control
Compliance risk is a risk
Non-compliance has a likelihood and an impact: fines, lost licences, lost contracts and reputational damage. It goes in the register and is assessed, prioritised and treated like any other risk, compared with the organisation's appetite.
ExampleA payments company finds it can't meet a new rule on reporting incidents within four hours. The practitioner records it as a compliance risk, rates the impact using the regulator's penalty regime, and the COO funds an incident reporting tool.
Working across borders
- 1Identify which laws apply where data and customers are.
- 2Build a common control baseline that meets shared requirements.
- 3Add local controls where laws are stricter.
- 4Get legal advice where rules conflict.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step with a new regulation | Determine with legal counsel how it applies |
| Who interprets the law | Legal counsel |
| How to manage many obligations | A register mapped to controls and owners |
| Compliance versus risk | Compliance is a minimum; risk management goes further |
Key takeaways
- ✓Obligations come from laws, sector regulation, contracts, listing rules, certifications and internal policy.
- ✓Legal counsel interprets the law; the risk practitioner turns obligations into risks, controls and owners.
- ✓Non-compliance is a risk with likelihood and impact (fines, lost licences, lost customers, reputation).
- ✓Keep a register of obligations mapped to controls and owners, and review it as rules change.
- ✓Multinationals face overlapping and sometimes conflicting rules; map them and use a common baseline with local additions.
Exam traps
- !Treating compliance as the whole of risk management.
- !Interpreting the law without legal counsel.
- !Following only the headquarters country's laws.
- !Waiting for an audit finding to discover a new requirement.
Connecting Governance to Risk Outcomes
How to show that governance activities (strategy, structure, policy and oversight) actually change IT risk, and which measures tell the board whether risk governance is working.
From direction to outcome
Outcome versus activity measures
| Shows governance works | Only shows activity |
|---|---|
| Share of top risks within appetite | Number of policies published |
| Overdue treatment plans, trend | Number of committee meetings |
| Time to decide on escalated risks | Training hours delivered |
| Losses from IT-related incidents | Number of risks in the register |
Where the chain breaks
- 1Appetite too vague to guide decisions.
- 2Risks without named owners.
- 3Policies not enforced or monitored.
- 4Controls designed but never tested.
ExampleA board approved a strong data protection policy, but no tolerance was set and nobody owned the data risks. A breach two years later showed the policy had never been implemented in two business units.
The governance outcomes
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST evidence governance is effective | Risk kept within appetite, with timely decisions |
| Weakness of activity metrics | They don't show changes in risk |
| Primary governance outcome | Strategic alignment |
| Many overdue treatment plans | Governance or ownership weakness to escalate |
Key takeaways
- ✓Governance is worthwhile only if it changes outcomes: risk within appetite, fewer losses, better decisions.
- ✓Trace each governance activity through structure, process and controls to a measurable outcome.
- ✓Good governance measures focus on risk against appetite and the timeliness of decisions and treatment.
- ✓Activity measures (meetings held, policies written) don't prove governance works.
- ✓Weak links in the chain, such as missing owners or untested controls, break the connection.
Exam traps
- !Reporting the number of policies or meetings as evidence of effective governance.
- !Assuming governance works because no incidents were reported.
- !Measuring governance only through audit results.
- !Ignoring overdue treatment plans when judging governance.
1 / 178