IT Risk Fundamentals
Domain 1 - IT Risk Fundamentals
This domain tests whether you can define IT risk precisely and use the vocabulary consistently: risk versus issue, how likelihood and impact combine, and where inherent risk, residual risk and appetite sit in the chain.
Core definitions
Risk is the combination of the probability of an event and its consequence. IT risk is the business risk associated with the use, ownership, operation and adoption of IT. A threat exploits a vulnerability to damage an asset; likelihood without impact is not risk, and both must be rated.
Rules to apply
- Inherent risk is exposure before controls; residual risk is exposure after controls. Control value is the gap between the two, not the mere existence of a control.
- Risk appetite is the level of risk the organisation is willing to accept; tolerance is the acceptable operational deviation around it.
- Treatment options are mitigate, transfer, avoid and accept. Acceptance is a documented decision by a risk owner with authority.
- A register entry needs an owner, a rating method, a date and a linked control or treatment. An unowned risk is an unmanaged finding.
Worked example
A payroll server is unpatched. Threat: exploitation of a known flaw. Vulnerability: missing patch process. Impact: regulatory fine plus payroll outage. Likelihood is rated high, so inherent risk is high. A patching control is deployed, cutting likelihood to low and residual risk to medium. Medium sits inside appetite, so the owner accepts and records a KRI tracking patched-within-SLA percentage. The rating moved because likelihood moved - the reasoning must be shown, not asserted.
Traps that cost marks
- Naming the missing patch itself as the risk: it is a vulnerability and a control gap.
- Quoting residual risk without naming the controls that produce it.
- Treating transfer (insurance) as elimination; reputational impact usually stays.
- Swapping appetite (strategic) with tolerance (operational thresholds).