IT Risk, Compliance and Regulatory Frameworks
Risk fundamentals
IT risk is the effect of uncertainty on IT-related objectives. Candidates should understand the risk process: identify → analyse (likelihood and impact) → evaluate against appetite/tolerance → treat → monitor and report. Treatment options are accept, mitigate, transfer and avoid. Risk appetite is the amount of risk the organisation is willing to pursue; risk tolerance is the acceptable variation around it.
Compliance and regulatory concepts
- Three lines model: first line owns and manages risk; second line provides oversight, frameworks and challenge; third line (internal audit) provides independent assurance.
- Regulatory frameworks: sector-specific rules, data protection law, outsourcing and resilience requirements. Candidates should reason about obligations, not memorise statute text.
- Control frameworks: COBIT for IT governance controls, ISO/IEC 27001 for information security management, NIST guidance for risk management.
- Risk registers, KRIs and heat maps as reporting tools.
- Third-party and supply-chain risk, including concentration and exit planning.
Traps to watch
- Confusing risk appetite (willingness to take risk) with risk tolerance (acceptable deviation).
- Treating compliance as proof of adequate risk management; compliant organisations can still carry unmanaged risk.
- Placing internal audit in the first or second line; it must be independent.
- Assuming risk transfer (insurance) removes accountability; it does not.
- Ignoring residual risk after controls are applied.
Worked example / rule of thumb
A supplier holds customer data. Likelihood of breach is assessed as medium, impact high; inherent risk exceeds appetite. Controls (encryption, access review, contractual audit rights) reduce it to residual risk within tolerance. Rule of thumb: state inherent risk, apply controls, then report residual risk against appetite - an answer that stops at inherent risk is incomplete.