CRISC 2022 Domain1
CRISC 2022 Domain1
Course Topics
Domain 1: Domain 3:
Governance Risk Response
Domain 2: and Reporting Domain 4:
IT Risk Information
Assessment Technology and
Security
32 20
Domain 1 Domain 2
Domain 3 Domain 4
Governance
MODULE 1
Exam Relevance
The domain represents approximately
26% of the CRISC examination 22
(approximately 39 questions). 26
32 20
Domain 1 Domain 2
Domain 3 Domain 4
Session Topics
Key Risk Concepts
Learning Objectives
Outline how the key concepts of risk impact the enterprise.
Define roles and responsibilities within the organizational structure and explain
how they relate to risk management.
Learning Objectives
10
Quantifying Risk
Productivity
Damaged Reputation
Response Costs
Impaired Growth
Legal and Regulatory
Health, safety, environment
Competitive Advantage
11
11
Review Question
IT risk is measured by its:
C. cost of countermeasures.
12
13
13
Accountability
Responsibility
14
14
Governance of Enterprise IT
Governance is applicable to all Board of Directors
departments within an enterprise
Enterprise Strategy
Provides accurate information to
understand threats, subsequent risk Senior Management
and response tactics
Strategic Plans
System to evaluate, direct, monitor and
ultimately control the current and future Risk
Business Units
use of IT Management
Reporting Risk Guidance Reporting
Enables enterprises to create value
for stakeholders, leading to better
Business
planning and optimization
Operations and Risk Monitoring
Processes
15
15
Are we seeing
expected benefits? 4 3 Are we getting
them done well?
16
16
Enterprise Strategy
An enterprise exists for the sole purpose of achieving the defined strategic vision.
Enterprise strategy is the focus of its efforts; these are the primary drivers behind how investments
and decisions are being made and which actions are taken.
17
17
18
18
19
Review Question
Which of the following is MOST important to determine when defining
risk management strategies?
B. IT architecture complexity
20
20
21
21
Enterprise
Environment Context
22
23
23
24
24
25
25
Business
Goals
Overall Enterprise
Business Vision and
Risk Strategy
26
26
27
28
28
29
29
Risk management should be a function with enterprise scope, able to reach into all the
parts of the organization and provide leadership, advice and direction.
30
30
RACI
Responsible Accountable
Accountable for
Responsible for managing risk
the risk management effort
Consulted Informed
31
1
Risk management may be applied to an entire enterprise under a
singular, centralized formal risk management team or may be
practiced separately in each level of the enterprise
32
32
Review Question
Who is responsible for explaining the ramifications of a new zero-day
exploit to the enterprise to senior management?
33
Key Roles
Risk Manager
Control Owner
Risk Analyst
Control Stewards
Risk Owner
34
34
Human Lead
Manager Finance Operations Stewards
Resources Auditor
General HRIS
Analysts Applications Systems Analysts
Ledger Owner
Control Control
Systems
Owner Owner
Security
35 Operations
35
Review Question
The risk to an information system that supports a critical business
process is owned by:
A. the IT director.
B. senior management.
36
36
The structure and culture of the organization directly influence and inform staff
decisions relating to risk prevention, risk detection and risk response efforts.
37
37
38
38
Organizational
Culture
39
39
40
41
41
Risk-Aware Problematic
42
42
Aggressive:
Risk Taking Behavior
towards Informed
Conservative: risk taking
Risk Averse
43
43
Review Question
Which of the following is MOST important when selecting an
appropriate risk management methodology?
A. Risk culture
B. Countermeasure analysis
C. Cost-benefit analysis
44
44
45
45
46
46
Technical Controls
Y
Avoid Risk – Stop
Accept Residual N
Monitor Risk risk
Y acceptable?
Y
Re-assess
47
47
Risk Communication
Plays a key role in defining and understanding
the risk culture of an enterprise
48
48
More
Greater informed
awareness Greater awareness Transparency to
risk decisions
among stakeholders among stakeholders external stakeholders
Gain Trust
49
49
• Risk strategy, policies, • Allows for monitoring the Actual status of IT risk:
procedures, awareness state of a risk management • Enterprise risk profile
training and continuous engine in the enterprise • Key risk indicators to
reinforcement of principles • Key indicator for good risk support management
• Drives all subsequent management reporting on risk
efforts on risk management • Event/loss data
• Sets the overall • Has predictive value for • Root cause of loss events
expectations about the risk how well the enterprise is • Options to mitigate risk
management program managing risk and reducing
exposure
50
50
Organizational Assets
Facilities and
Assets Cash and Investments
Equipment
51
Technology Intellectual
People Data
Property
Enterprises are Customer lists, financial Outdated technology is Trademarks, copyrights,
vulnerable to loss of data, marketing plans, often overlooked patents, trade secrets
key employees HR data or research or research
Extended support can
Identify and support Must ensure protection lengthen availability but Represents future
through cross-training of data in all forms and increase costs earning potential of
locations at all times the enterprise
Provide sufficient Apply patches and
Identify business regular maintenance
documentation of key
value and define Protect and handle IP
processes Securely dispose of
security classifications properly and
technology containing responsibly
data
52
52
A formula, process,
Protection of research
A sound, color, logo, design, practice or
Protection of any work and ideas that led to
saying or other other form of secret
that is captured in a the development of a
distinctive symbol that business information
tangible form (e.g., new, unique and
is closely associated that provides a
written works, useful product to
with a certain product competitive
recordings, images, prevent the
or company. Some advantage to the
software, music, unauthorized
trademarks are organization that
sculpture, dance, etc.) duplication of the
eligible for registration possesses the
patented item
information
53
53
54
Asset Inventory
Record Build
Record all relevant assets owned by Common methods to build the
the enterprise: inventory include reviewing purchasing
• Financial or nonfinancial systems, contracts and current
• Required to deliver services software installations.
• Owned or controlled by the
enterprise for a future benefit Determine assets importance in
• Differs between enterprises context of enterprise activities:
55
55
Asset Valuation
Determine the importance of assets in the context of organizational activities giving priority to
protecting the most important assets first and less significant assets as time and budget allow.
An asset may be valued according to what another person would pay for it or by its measure of
value to the enterprise.
• Calculating the value an asset provides to an enterprise is not as straightforward as it may appear
• Base valuation on the total range of potential losses and other impacts
• Protects the enterprise from paying more for protection than the net worth
56
Review Question
Which of the following is MOST useful when computing annual loss
exposure?
57
57
58
58
59
59
• Risk Identification
Detailed description of steps necessary to perform specific
operations in conformance with applicable standards: • Risk Analysis
• Defined as part of processes • Risk Evaluation
• Created to define how processes should be completed
• Risk Assessment
• Implementing the intent of policy by outlining tasks
A lack of standards and procedures makes it difficult to carry out • Risk Response
activities in a systematic manner and may result in undependable,
• Control Selection
inconsistent operations and elevated risk
• Distinguish between the existence of published procedures • Control Monitoring
and their actual use
• Establish KPIs, KCIs, and KRIs
• Ensure continued use of procedures long term, especially
when precision is important • Risk Monitoring
• Risk Reporting
60
60
Review Question
Which of the following provides the GREATEST support to a risk
practitioner recommending encryption of corporate laptops and
removable media as a risk mitigation measure?
61
61
Exception Management
1 2 3 4
If exceptions are May result in an Exceptions should only Ensure that exceptions
undocumented and undesired level of risk be allowed through a are removed when no
uncontrolled, the level or overconfidence in documented, formal and longer needed
of risk is unknown effectiveness of time-bound process.
established controls
62
62
63
63
1. Document and
2. Identify 3. Schedule and 4. Feedback and
evaluate current
potential changes implement changes Evaluation
business processes
64
64
65
65
Risk
Management
Principles
66
• Preservation of critical business • Formal inspection and • Drives selection of controls and
functions verification of compliance and justifies operation.
• Ability to survive an adverse accuracy • Traceable back to a specific I&T-
event • Provides management with related risk
• Attempts to reduce all I&T- assurance of frameworks, • Prevents poor control design and
related risk to acceptable levels programs and compliance efforts implementation
67
67
Review Question
Which of the following should be of MOST concern to a risk
practitioner?
68
68
Break
69
70
70
Risk
Management
Functions
Processes Activities
Practices
71
71
1 3
2 4
72
72
73
73
Challenge Opportunity
74
74
75
75
Review Question
Which of the following choices provides the BEST view of risk
management?
76
76
77
77
78
78
79
79
Financial Controls
Security
Management Internal Risk Management
Control Internal Audit
Controls Quality
Measures
Inspection
Compliance
Risk Management
80 Assurance
80
Review Question
Which of the following is one of the MAIN purposes of the first line of
defense in the three lines of defense model?
81
81
82
82
Risk Profile
83
83
84
84
Review
Awareness
IT risk management objectives and goals
on a regular basis (annually) to ensure
continued alignment with goals and
The risk practitioner has a key role ensuring
objectives of senior management
that management is aware of the current IT
Review program in terms of increasing risk profile and that risk is being managed to
maturity (risk response/mitigation activities, meet objectives.
training, improved response time, and better
alignment and communication Work with stakeholders to monitor risk and
evaluate the control framework effectiveness
Criteria for monitoring, thresholds used for and efficiency
KPIs and KRIs, policies and strategies of
risk, reporting schedule and list of key Apply lessons learned to improve the risk
stakeholders to be notified when KPIs or management process
KRIs exceed their thresholds
85
85
86
86
87
87
Review Question
Senior management has defined the enterprise risk appetite as
moderate. A business-critical application has been determined to
pose a high risk. What is the NEXT action the risk practitioner should
take?
88
88
Show impact of
Support
different Support the
Support and understanding
resource prioritization and
provide of how each Identify specific
allocation approval
evidence of risk- component of areas where a
strategies by process of risk
based decision- the enterprise risk response
simulating response
making contributes to should be made
different risk actions through
processes the overall risk
response risk budgets
profile
options
89
89
Consistent Consistent
implementation understanding
90
90
91
91
Certain industries
incorporate ethics into
expectations, which can
Well-treated employees then result in establishing
can be an example or ally. reporting and conformance
Poorly treated employees requirements for
Enterprises with poor may seek revenge causing professionals
management processes serious consequences.
in place may not identify
errors, misuse or fraud.
92
92
GDPR PCI-DSS
93
93
Review Question
A key objective when monitoring information systems control
effectiveness against the enterprise’s external requirements is to:
94
94
Review Question
Shortly after performing the annual review and revision of corporate
policies, a risk practitioner becomes aware that a new law may affect
security requirements for the human resources system. The risk
practitioner should:
95
95
Review Question
It is MOST important that risk appetite is aligned with business
objectives to ensure that:
96
96
97
97
98
98