Governance, Risk, and Compliance
This domain tests whether you can separate governance from management, quantify risk in money, and select an appropriate risk treatment or control type. Questions typically present a scenario and ask who decides, which document applies, or what the loss expectancy is.
Governance structure and documents
- The board sets risk appetite - the aggregate level of risk the organization will accept to pursue objectives. Risk tolerance is the permitted variation around a specific threshold (e.g., "system downtime must stay under 4 hours per quarter").
- Three lines model: business operations own and manage risk (first line); risk, compliance and security functions monitor and advise (second line); internal audit assures independently (third line). Independence is what makes the third line credible.
- Policy hierarchy: policy states mandatory intent; standard states specific mandatory requirements; procedure gives step-by-step execution; guideline is recommended practice. A question asking "which document mandates AES-256 for data at rest?" wants a standard, not a policy.
Risk analysis
Qualitative analysis ranks likelihood × impact on a matrix; quantitative analysis converts exposure to currency:
- SLE (single loss expectancy) = asset value × exposure factor
- ALE (annualized loss expectancy) = SLE × ARO (annualized rate of occurrence)
Risk treatment options are mitigate, transfer, avoid, accept. Controls are preventive, detective, corrective or compensating. Inherent risk exists before controls; residual risk remains after; residual risk must be compared to tolerance and accepted by a risk owner with authority.
Compliance
Obligations from ISO/IEC 27001, NIST CSF, PCI DSS and privacy law overlap heavily. Mature programs build one control framework and map each obligation to it (a "common controls" approach), collecting evidence once and reusing it.
Worked example
A customer database is valued at $200,000; a breach would destroy 40% of it; such an event is expected twice every four years. SLE = $200,000 × 0.40 = $80,000. ARO = 2/4 = 0.5, so ALE = $80,000 × 0.5 = $40,000. A $15,000 control reduces incidence to once every ten years (ARO 0.1): new ALE = $8,000. Annual benefit = $40,000 − $8,000 = $32,000; net benefit = $32,000 − $15,000 = $17,000. The control is justified on economic grounds.
Traps
- Treating ALE as a worst-case figure; it is an expected annual average.
- Confusing appetite (strategic, board-level) with tolerance (operational threshold).
- Assuming internal audit may design the controls it later tests - it may not.
- Calling something "accepted" risk when no accountable owner signed off.