Data Centre Governance, Risk and Professional Competence
This domain tests the accountability layer above the equipment: who decides, who owns risk, and what standard of professional conduct the candidate is held to.
Governance
Governance is the framework of decision rights, policies, oversight and accountability that aligns the data centre with business objectives. In practice it means an owner for each service, documented policy, separation of duties between those who approve change and those who execute it, service level agreements with measurable KPIs, and clear escalation paths. Frameworks such as COBIT and ITIL describe the objectives and processes; they do not replace local policy.
Risk management (ISO 31000 shape)
Scope and context → risk identification → analysis → evaluation → treatment → monitoring and review, with communication throughout. A risk register records cause, event, consequence, existing controls, likelihood, impact, owner and residual rating. Treatments are avoid, reduce, transfer (insurance, contract) or accept - and acceptance must be made at the authority level that owns the consequence. Distinguish inherent risk (before controls) from residual risk (after controls), and note that a common-cause failure, such as one fuel supply feeding all generators, defeats apparently redundant systems. Business impact analysis sets RTO (time to restore), RPO (tolerable data loss) and MTD (maximum tolerable downtime).
Professional competence
Competence combines knowledge, skill, experience and behaviour; a certificate evidences knowledge only. Expect questions on continuing professional development, honest reporting of test results, confidentiality of client data, declaring conflicts of interest, refusing work outside your competence, and escalating safety or availability concerns rather than concealing them.
Worked example
A site has one utility feed. Historical data suggests a 12-hour outage roughly once every three years. The business impact of such an outage is estimated at €2,000,000. Annualised loss expectancy = single loss expectancy × annual rate of occurrence = €2,000,000 × 0.33 ≈ €660,000 per year. A second feed with transfer switch costs €150,000 per year to own. The reduction in expected loss (up to €660,000) clearly exceeds the annual cost, so the treatment is justified on quantitative grounds - and the residual risk is recorded, not eliminated.
Traps that cost marks
- Reporting inherent risk as residual risk.
- Treating RTO and RPO as the same measure.
- Accepting risk without a named owner and authority level.
- Assuming certification equals competence.
- Missing common-cause failures hidden inside redundant designs.