Risk Management and Governance
Risk Management and Governance tests whether you can state a risk precisely, choose a treatment, and identify who owns the decision. Expect terminology arithmetic (SLE, ALE, ARO), the governance artefact hierarchy, and questions that separate risk management from compliance evidence collection.
Vocabulary that must be exact
- Asset, threat, vulnerability, likelihood, impact. A threat exploits a vulnerability to damage an asset; risk combines probability with consequence.
- Inherent risk exists before controls; residual risk remains after them.
- Risk appetite is the amount of risk the organisation wants to pursue; tolerance is acceptable variance around it; capacity is the maximum it could absorb before failure.
- Register entries carry an ID, owner, treatment decision, target date, and a key risk indicator.
Treatment and ownership
ISO 31000/27005 treatments are modify (mitigate), retain (accept), avoid, and share (transfer). Transfer moves financial consequence - insurance, contract - but never accountability. The business owner accepts risk; security advises and monitors. The board sets appetite; a steering committee prioritises and funds treatment.
Governance hierarchy
Policy states intent and is mandatory. Standards translate policy into mandatory requirements. Baselines are the minimum configuration per system class. Procedures give step-by-step execution. Guidelines are non-binding advice. Auditors test against standards and baselines, not against guidelines.
Worked example
A data centre holds customer records valued at $2,000,000. A flood would destroy 25% of them (exposure factor 0.25) and occurs roughly once in 20 years (ARO 0.05). SLE = $2,000,000 x 0.25 = $500,000. ALE = $500,000 x 0.05 = $25,000. A control costing $12,000 per year reduces exposure factor to 0.10: new SLE $200,000, new ALE $10,000, an annual saving of $15,000. That justifies the spend on pure economics, but the decision must also weigh regulatory notification costs, safety, and reputation, which ALE omits - say so in the answer.
Traps that cost marks
- Multiplying by ARO where the exposure factor belongs.
- Claiming transfer or insurance eliminates risk.
- Declaring residual risk "accepted" without documented owner sign-off.
- Logging an audit finding as a risk with no threat and impact pair.
- Confusing RTO (tolerable downtime) with RPO (tolerable data loss).