CRISC key terms

The leadership, structures, and processes that ensure IT supports enterprise strategy, objectives, and risk appetite while using resources responsibly.

An organization-wide approach to identifying, assessing, responding to, and monitoring risks that could affect strategic objectives. It aligns risk management with strategy and governance.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, often expressed as qualitative statements or quantitative limits.

The acceptable variation in outcomes around a risk appetite, often expressed as thresholds or limits for specific risk categories.

A governance model separating management (first line), risk and compliance oversight (second line), and independent internal audit (third line).

The tone and structure set by leadership that influences risk awareness, integrity, ethical values, and the effectiveness of internal controls.

Dividing tasks and approvals so no single person can initiate, authorize, record, and review a transaction without detection.

The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.

The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.

The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.

The overall process of identifying, analyzing, and evaluating risk to inform risk response decisions. It provides the basis for prioritizing risks and allocating resources.

The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.

The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.

A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.

A potential cause of an unwanted incident that could harm an asset or organization, such as an attacker, malware, or natural event.

A weakness in a process, system, or control that could be exploited by a threat to cause harm.

The probability that a threat event will occur and exploit a vulnerability, expressed qualitatively or quantitatively. It is one factor used to rate risk.

The consequence or magnitude of loss or harm to the organization if a risk event occurs. It may be financial, operational, legal, or reputational.

A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk event.

A process that identifies critical business functions and estimates the consequences of their disruption over time. It supports continuity planning and recovery priorities.

The action taken to modify risk by avoiding, reducing, sharing, or accepting it, based on cost, benefit, and appetite.

A response that eliminates the activity or condition giving rise to a risk rather than trying to control it.

A response that shifts the financial consequences of a risk to another party, such as through insurance or contractual arrangements.

A response in which management acknowledges a risk and decides not to act, provided the exposure remains within tolerance.

A response that reduces the likelihood or impact of a risk through controls, process changes, or other safeguards.

The person accountable for managing a specific risk, including selecting and monitoring the response and reporting on its status.

A metric that provides early warning that risk exposure is increasing or decreasing, often tied to a threshold that triggers action.

The communication of risk information to decision-makers and governance bodies in a timely, accurate, and actionable form. It supports oversight and response decisions.

The process of evaluating whether a control is designed and operating effectively to reduce risk. Results inform residual risk and response decisions.

The policies and mechanisms that determine who can access which systems, data, or facilities and under what conditions.

The process of verifying a user's or system's identity before granting access to resources. It is a prerequisite for authorization.

The principle of giving users and systems only the access needed to perform assigned tasks, and no more.

The transformation of data into a form unreadable without the correct key, protecting confidentiality and sometimes integrity. It is used for data at rest and in transit.

A continuous process of identifying, prioritizing, remediating, and verifying vulnerabilities in systems and software. It reduces the likelihood of exploitation.

An event that actually or potentially compromises the confidentiality, integrity, or availability of information or systems. It requires detection, response, and reporting.

Documented procedures for maintaining or restoring critical business functions during and after a disruption. It addresses people, processes, technology, and facilities.

Documented procedures for restoring IT infrastructure, data, and applications after a major disruption. It supports the business continuity plan.

The maximum acceptable time to restore a business process or system after a disruption. It drives recovery priorities and testing.

The maximum acceptable amount of data loss, measured in time, after a disruption. It determines backup frequency requirements.

A controlled process for requesting, reviewing, approving, testing, and implementing changes to IT systems and processes. It reduces operational and security risk from changes.