Risk Management and Compliance
This domain tests whether you can run risk as a continuous, owned process and map obligations into controls. Expect questions on risk terminology, ISO 31000, COSO ERM, treatment options, heat maps, and compliance testing.
Risk process and appetite
ISO 31000:2018 describes risk management as principles, a framework, and a process: establishing scope and context; risk identification, analysis, and evaluation; risk treatment; communication and consultation; and monitoring and review. Risk appetite is the amount of risk the organization is willing to pursue; risk tolerance is the acceptable variation around that appetite; risk capacity is the maximum it can bear. COSO ERM 2017 has five components - governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting - supported by 20 principles. The Three Lines Model clarifies who owns risk, who oversees it, and who audits it.
Registers and treatment
A useful risk register records cause, event, consequence, owner, inherent rating, controls, residual rating, treatment, and due date. Treatment options include avoiding the activity, removing the risk source, changing likelihood, changing consequences, sharing or transferring risk, and retaining risk. Compliance work maps obligations to controls, tests design and operating effectiveness, tracks findings, and verifies remediation.
Worked example
A payment fraud risk has single loss exposure $80k and annualized rate of occurrence 0.25, so ALE = $20k. A monitoring control costs $6k per year and reduces ARO to 0.05, making ALE $4k. The net benefit is $20k − $4k − $6k = $10k per year. If the control is also required by a regulation, the case is stronger. The risk owner - not the security team - decides whether to accept the residual risk, and the decision is recorded.
Traps that cost marks
- Building a heat map without defined likelihood and impact scales.
- Recording inherent risk as residual risk, or the reverse.
- Listing a risk owner who has no authority or budget.
- Treating compliance as a one-time attestation instead of control testing.
- Using ALE as false precision when the inputs are guesses.
- Leaving accepted risks without review dates or escalation triggers.