CtrlK

Search...

Trending this month -AWS CCP•CISSP•AZ-900•A+•TOGAF•AI-102•Sec+•AZ-104•CSA•ITIL 4

Quick Feedback

CRISC Study Notes

Domain 1: Corporate IT Governance (26%)

IT Governance Framework

Strategic Alignment

Ensure IT risk management supports and enables enterprise strategy and objectives

Value Delivery

Optimize IT risk investments to deliver measurable business value

Risk Appetite

Define acceptable risk levels aligned with organizational tolerance and capacity

Resource Management

Allocate adequate resources for IT risk management activities

Performance Measurement

Monitor governance effectiveness through KPIs, KRIs, and KGIs

Three Lines of Defense

Line	Role	Responsibilities
First Line	Operational Management	Own and manage risks day-to-day, implement controls
Second Line	Risk & Compliance Functions	Oversee risk management, set policies, monitor compliance
Third Line	Internal Audit	Independent assurance, evaluate effectiveness of governance

Governance Roles

Role	Primary Responsibility	Accountability
Board of Directors	Risk oversight and governance direction	Ultimate accountability for risk
Risk Committee	Risk appetite and tolerance decisions	Strategic risk oversight
CRO / CISO	Risk program leadership and reporting	Program implementation
Risk Manager	Day-to-day risk operations	Tactical risk execution
Business Process Owners	Risk decisions within their domain	Process-level risk ownership

Risk Culture & Policy

Risk Culture: Shared values and behaviors that shape how risk is perceived and managed
Risk Policy: Formal statement defining the organization's approach to IT risk management
Risk Appetite Statement: Board-approved declaration of acceptable risk levels
Risk Tolerance: Acceptable variation from risk appetite thresholds
Regulatory Compliance: Alignment with industry regulations and legal requirements

Governance Maturity

Initial (Ad Hoc)

Risk management is reactive and unstructured

Repeatable

Basic risk processes exist but are not standardized

Defined

Risk management processes are documented and standardized

Managed

Risk metrics are used, processes are measured and controlled

Optimized

Continuous improvement, proactive risk management