TR-C Domain 1: Fundamentals and Core Concepts
TR-C Domain 1, Fundamentals and Core Concepts, tests whether you can use a consistent risk-and-control vocabulary before applying it in later domains. Expect questions on assets, threats, vulnerabilities, likelihood, impact, inherent and residual risk, control types, risk appetite, ownership, and the difference between a control objective and a control activity. The exam treats governance as the decision layer: who accepts risk, who operates a control, and what evidence proves it worked.
Core rules
- Risk is the effect of uncertainty on objectives; it is not the same as a compliance gap or an incident.
- Inherent risk is assessed before controls; residual risk is assessed after controls and must be compared with tolerance.
- Preventive controls stop an event; detective controls find it; corrective controls reduce impact after detection.
- A control objective states the outcome, such as “access is authorized”; a control activity is the mechanism, such as an approval workflow or role review.
- Every risk needs an owner who can accept or reject treatment. The three lines model separates operating management, risk and compliance oversight, and independent audit.
Worked example
A payroll SaaS stores employee bank details. The asset is payroll data; the threat is credential stuffing; the vulnerability is password-only authentication. Inherent risk is high because impact includes fraud and regulatory notification. A preventive control is MFA for all administrators; a detective control is alerting on anomalous login patterns. After testing, residual risk is medium and within the stated tolerance. The payroll operations manager owns the risk; security operations runs the alert; internal audit later samples evidence.
Traps
Do not call a missing patch a “risk” when it is a vulnerability or finding. Do not claim a control is effective because it exists; effectiveness requires design and operating evidence. Do not compare residual risk with appetite before controls are tested. Do not let a control activity stand in for the objective it is meant to achieve.