CRISC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by the board and expressed qualitatively or quantitatively.

Risk tolerance

The acceptable variation or deviation from the stated risk appetite that an organization can absorb for a specific objective before corrective action is required.

Three lines model

A governance structure in which operational management owns and manages risk, a risk and compliance function provides oversight, and internal audit gives independent assurance to the board.

IT governance

The processes and structures that direct and control IT so it aligns with enterprise strategy, delivers value, and manages technology risk within the approved appetite.

COBIT framework

ISACA's framework for governance and management of enterprise IT, providing objectives, processes, and maturity models that link IT activity to stakeholder value.

Key risk indicator

A forward-looking metric with defined thresholds that gives early warning that a risk exposure is increasing or approaching an unacceptable level.

Risk owner

The individual with accountability and authority to manage a specific risk, including selecting, funding, and monitoring the chosen risk response.

Segregation of duties

Dividing incompatible tasks among different people so that no single individual can both initiate and conceal an error or a fraudulent transaction.

Inherent risk

The level of risk before any controls or mitigation actions are applied, representing the raw exposure of a process or asset to a threat.

Residual risk

The risk remaining after existing controls have been applied and evaluated; it is compared with risk appetite to decide whether further treatment is needed.

Single loss expectancy

The monetary loss expected from a single risk event, calculated as the asset value multiplied by the exposure factor for that event.

Annualized loss expectancy

The expected yearly loss from a risk, calculated by multiplying the single loss expectancy by the annualized rate of occurrence for the event.

Business impact analysis

An analysis identifying critical business processes and the time-based impact of their disruption, producing recovery time and recovery point objectives.

Risk register

A repository recording each identified risk with its owner, likelihood, impact, score, response, status, and linked indicators or controls.

Qualitative risk analysis

Ranking risks using descriptive ordinal scales such as high, medium, and low, based on judgment and experience rather than monetary valuation.

Control testing

Evaluating whether a control is designed effectively and operating as intended, typically through inquiry, observation, inspection, and sample-based re-performance.

Risk treatment options

The responses available for a risk: mitigate, transfer, avoid, accept, and exploit, each chosen according to cost, feasibility, and alignment with risk appetite.

Risk transfer

Shifting the financial consequences of a risk to a third party, for example through insurance or outsourcing, without eliminating the underlying risk event.

Risk avoidance

Eliminating the activity or asset that gives rise to a risk, removing the exposure entirely while also forgoing the associated business benefit.

Control cost-benefit

The principle that a control is justified only when its cost is less than the expected reduction in loss that the control produces.

Preventive control

A control that stops an undesirable event from occurring, such as access restrictions, input validation, or separation of incompatible duties.

Detective control

A control that identifies an undesirable event after it has occurred, such as log review, account reconciliation, or intrusion detection monitoring.

Risk escalation

The process of raising a risk to higher management or the board when residual risk exceeds appetite or requires decisions beyond the risk owner's authority.

Issue versus risk

An issue is a present problem requiring remediation and tracked to closure, whereas a risk is a potential future event tracked to acceptance or treatment.

CIA triad

The three core security objectives: confidentiality for authorized access only, integrity for accurate complete data, and availability for timely access when needed.

Least privilege

Granting users only the access rights required to perform their assigned job duties, limiting the damage that a compromised account can cause.

Defense in depth

Layering multiple independent controls across people, process, and technology so that the failure of one control does not expose the organization.

Shared responsibility model

The division of security duties in cloud computing, where the provider secures the cloud infrastructure and the customer secures data, identity, and configuration.

Zero trust

A security model that verifies every access request explicitly and grants least privilege, assuming no implicit trust based on network location.

Recovery time objective

The maximum acceptable time to restore a process or system after a disruption, derived from the business impact analysis of dependent processes.

Digital signature

A cryptographic mechanism using asymmetric keys that provides authentication, integrity, and non-repudiation for a message or transaction, but not confidentiality.

IDS versus IPS

An intrusion detection system monitors traffic and alerts on suspicious activity, while an intrusion prevention system sits inline and can block it.