III IC-86 study plan
III IC-86 · Give each week a clear focus.
8 weeks · About 6 hours per week
Risk Management
Define every core risk-management term in your own words: risk, hazard, exposure, likelihood, impact, inherent risk, residual risk, risk appetite, risk tolerance, and risk capacity.
Map the risk-management process end to end (identify, analyze, evaluate, treat, monitor, communicate) and explain what each step produces as an output.
Distinguish threat, vulnerability, and control, and give one concrete example of each from a system you actually work with.
Build a one-page glossary of 25 terms with a short definition and one example per term.
Your checkpoint
A 25-term personal glossary plus a one-page process diagram showing inputs and outputs at each risk-management step.
Risk Management
Compare qualitative, semi-quantitative, and quantitative risk-assessment methods and state when each is appropriate.
Apply a risk matrix to five realistic scenarios and rank them consistently.
Compute single loss expectancy, annualized loss expectancy, and annualized rate of occurrence for three worked examples.
Explain how likelihood and impact scales are defined and why scale definitions must be documented before scoring.
Your checkpoint
A scored risk register of 10 risks with likelihood, impact, score, ranking, and a written justification for each score.
Risk Management
Select a treatment option (mitigate, transfer, avoid, accept) for each risk in your register and justify the choice against risk appetite.
Identify the control type (preventive, detective, corrective, directive) and control category (technical, administrative, physical) for each proposed control.
Write treatment plans with owners, due dates, and success criteria.
Explain how residual risk is calculated after controls and when acceptance must be escalated.
Your checkpoint
A treatment plan covering all 10 register risks, each with owner, control type, target residual score, and due date.
Risk Management
Draft a risk-appetite and tolerance statement for a fictional organization and tie thresholds to escalation triggers.
Describe key risk indicators and define three with thresholds, data sources, and review frequency.
Explain the roles of the board, executive management, the risk owner, and internal audit in risk governance without overlapping responsibilities.
Summarize how risk reporting flows upward and what a one-page executive risk report contains.
Your checkpoint
A two-page risk governance and reporting pack: appetite statement, three KRIs with thresholds, a RACI for risk roles, and an executive summary template.
Risk Management
Analyze how risk management integrates with strategy setting, budgeting, project approval, and change management.
Explain third-party and supply-chain risk: due diligence, contractual risk transfer, concentration risk, and ongoing monitoring.
Describe business continuity and incident response from a risk perspective, including recovery objectives and post-incident review.
Identify common failure modes of risk programs (stale registers, scoring without criteria, unowned risks) and a countermeasure for each.
Your checkpoint
A one-page integration map showing where risk activities plug into strategy, projects, procurement, and incident response, with one failure mode and countermeasure per area.
Risk Management
Review all prior deliverables and correct inconsistencies in scoring, terminology, and ownership.
Practice 40 scenario-based questions under timed conditions and log every miss with the underlying concept.
Re-derive the quantitative formulas from memory and redo three calculations without notes.
Explain out loud, in under two minutes each, the ten concepts you got wrong most often.
Your checkpoint
An error log of at least 20 missed questions, each mapped to a concept and a corrective action.
Risk Management
Close every open item in the error log by restudying the concept and writing a corrected explanation.
Complete a full-length timed practice set and compare the domain-level result to week 6.
Build a one-page formula and definitions sheet from memory, then verify it against your notes.
Rehearse justifying a treatment decision in writing in three to five sentences.
Your checkpoint
A verified one-page formula and definitions sheet plus a closed error log with zero unresolved items.
Risk Management
Take two timed full-length practice sets and score at or above your target on both.
Review only high-frequency weak areas; resist rereading material you already know.
Confirm logistics: exam format, timing, allowed materials, and identity requirements.
Write a 10-line summary of the risk-management process and read it on the morning of the exam.
Your checkpoint
Two timed practice scores recorded with a final weak-area list of no more than five items, each with a one-line reminder.
Milestones
Week 2: You can score and rank 10 risks consistently and compute single loss expectancy and annualized loss expectancy without notes.
Week 4: You can state a risk appetite, assign treatment options with control types, and explain governance roles from memory.
Week 6: Timed practice score is recorded, and every miss appears in the error log with a mapped concept.
Week 8: Two timed practice sets meet your target score, and the weak-area list is five items or fewer.