ISACA CRISC Course Notes

CRISC governance is about aligning IT risk with business strategy, objectives, accountability, and stakeholder expectations. Governance sets direction; management executes. Policies define intended direction, standards define required implementation. Risk owners are accountable for risk decisions, control owners manage controls, oversight monitors, and independent assurance validates. Risk registers feed the enterprise risk profile. Risk appetite expresses willingness to take risk; tolerance defines acceptable variation around that appetite. Always connect governance decisions back to business objectives, legal/regulatory requirements, resilience, and validated stakeholder reporting.

• Treating governance as day-to-day technical execution.

• Start with the business objective, not the technology.

Risk assessment identifies what could go wrong, why, how likely it is, and what business impact could result. Threats, vulnerabilities, assets, and consequences combine into meaningful risk scenarios. Use a defined methodology and standard, then assess likelihood and impact. BIA focuses on critical business processes, impact consequences, dependencies, and recovery priorities. The risk register records assessed risks and supports the enterprise risk profile. Qualitative analysis fits limited data; quantitative analysis fits stronger measurable data. Inherent risk is before controls; residual risk is what remains after controls.

• Confusing threat with vulnerability.

• Assessment asks: what can happen, how likely, and what is the impact?

This is the largest CRISC domain. Once assessed risk is compared with appetite/tolerance, select and manage an appropriate response with accountable ownership, concrete actions, monitoring, validation, and reporting. Risk owners make risk decisions; control owners design, implement, and maintain controls. Vendor and supply-chain risks require assessment, treatment, monitoring, and reporting. Issues, findings, exceptions, and exemptions follow governed processes. Control testing validates both design and operating effectiveness using evidence suited to the control. Risk action plans need an owner, action, target date, resources, and validation criteria. KRIs measure risk exposure, KCIs measure control effectiveness, and KPIs measure performance. Reports must use validated information and be tailored to stakeholder needs.

• Confusing risk owner with control owner.

• Domain 3 is often about the NEXT management action after assessment.

Technology and security questions are still risk-management questions. Align technology principles, roadmaps, architecture, operations, development, projects, resilience, emerging technology, security, awareness, privacy, and data protection with business and risk objectives. Integrate controls across the SDLC rather than bolting them on at the end. Manage risk throughout the full data lifecycle. Technology resilience is proactive continuity capability; recovery is restoration after disruption. New technology should be evaluated for threats, vulnerabilities, opportunities, dependencies, and control impact. Awareness must be role-based and measured for effectiveness. Privacy and protection should be integrated into governance and lifecycle decisions.

• Choosing technology based only on features.

• Technology is the context; risk alignment is the decision criterion.