Risk Governance – Key Concepts
A. Enterprise Risk Management and Risk Management Framework
• ERM Frameworks (COSO, ISO 31000): Provide structured approaches for identifying, assessing,
responding to, and monitoring risks. COSO emphasizes internal controls, while ISO 31000 focuses
on principles, framework, and process.
• Risk Management Strategy: Defines how the organization approaches risk—risk-averse, risk-
neutral, or risk-seeking.
• Process Integration: Risk management should be embedded into business planning, operations, and
decision-making processes.
• Framework Implementation and Maturity: Organizations mature from ad-hoc risk activities to
fully integrated, enterprise-wide risk management.
🔑 Exam Tip: Remember COSO = controls & governance focus; ISO 31000 = broader, principle-driven
approach.
B. 4.2 Three Lines of Defense
• First Line – Operational Management: Owns and manages risks within daily operations.
• Second Line – Risk Management and Compliance: Provides oversight, ensures frameworks are
followed, and supports first line.
• Third Line – Internal Audit: Independent assurance that risk management and controls are
effective.
• Coordination & Communication: Clear boundaries and collaboration between lines avoid
duplication or gaps.
🔑 Exam Tip: The “three lines of defense” model is one of the most frequently tested concepts in CRISC.
C. 4.3 Risk Profile
• Development: A consolidated view of risks, including likelihood and impact.
• Categorization & Taxonomy: Organizes risks into categories (strategic, operational, compliance,
financial, IT).
• Aggregation & Portfolio View: Combines risks across units for an enterprise-level perspective.
• Communication & Reporting: Profiles should be shared with leadership to support informed
decision-making.
🔑 Exam Tip: Risk profile = snapshot of current risks against appetite.
D. 4.4 Risk Appetite and Risk Tolerance
• Risk Appetite: The amount and type of risk the organization is willing to pursue or retain. Defined
by board/senior management.
• Risk Tolerance vs. Appetite: Appetite = overall philosophy; Tolerance = acceptable deviation
levels.
• Risk Capacity Assessment: Evaluates actual ability to take risks (financial strength, resources,
resilience).
• Communication & Monitoring: Appetite and tolerance must be regularly communicated, tracked,
and adjusted.
🔑 Exam Tip: Appetite is strategic; tolerance is operational.
E. 4.5 Legal, Regulatory and Contractual Requirements
• Regulatory Landscape: Includes laws, industry standards, and government mandates.
• Compliance Requirements: Ongoing processes to meet obligations (GDPR, SOX, HIPAA, etc.).
• Contractual Risk Obligations: Risks arising from vendor agreements, SLAs, and third-party
commitments.
• Legal Risk Assessment: Identifies and mitigates risks of penalties, lawsuits, and non-compliance.
🔑 Exam Tip: Always consider both external compliance (laws) and internal compliance
(policies/contracts).
F. 4.6 Professional Ethics of Risk Management
• Ethical Principles: Integrity, objectivity, fairness, accountability, and transparency.
• Professional Standards and Codes: ISACA’s Code of Professional Ethics guides CRISC
professionals.
• Conflicts of Interest Management: Must be disclosed and mitigated to preserve independence.
• Ethical Decision-Making Framework: Provides a consistent approach to handle dilemmas and
ensure responsible behavior.
🔑 Exam Tip: Ethics questions often test your ability to choose the “most professional” response, not just a
correct technical answer.
