IT Risk Fundamentals study plan

Define IT risk and distinguish it from related concepts such as threat, vulnerability, likelihood, and impact, writing your own one-sentence definition of each.

Classify at least ten example risk events by whether they are strategic, operational, compliance, or technology-driven, and justify each classification in one line.

Map the risk management lifecycle from identification through monitoring, and note where each phase produces a document or decision.

Build a personal glossary of 20 core terms with a worked example for each term.

Explain the components of risk (asset, threat, vulnerability, likelihood, impact) and how they combine into an exposure statement.

Differentiate inherent risk, residual risk, and risk appetite, and describe how each appears in a risk register.

Practice writing five risk statements in a cause-event-consequence format.

Identify which controls are preventive, detective, or corrective for a given scenario.

Compare qualitative, semi-quantitative, and quantitative risk assessment approaches and state when each is appropriate.

Apply a 5x5 likelihood-impact matrix to rank ten sample risks and defend the ordering.

Compute a simple annualized loss expectancy from asset value, exposure factor, and annualized rate of occurrence.

Explain the limits of scoring models, including subjectivity and false precision.

Describe the four common risk treatment options (avoid, mitigate, transfer, accept) and match each to realistic scenarios.

Explain how risk tolerance thresholds drive escalation decisions.

Draft a risk response plan for three risks, naming an owner, action, timeline, and success measure.

Distinguish risk transfer from risk sharing and note the limits of insurance as a control.

Outline the elements of an IT risk governance structure, including roles for the board, executive leadership, risk committee, and control owners.

Explain the three lines model and how it separates oversight from execution.

Describe how risk appetite statements are translated into operational limits.

Identify key risk indicators and explain what makes one actionable rather than merely interesting.

Explain how IT risk connects to enterprise risk management and to business strategy.

Describe the purpose and structure of a risk register and the fields that make it usable.

Practice reporting risk to non-technical executives using a concise risk summary.

Connect IT risk findings to common control frameworks at a conceptual level without relying on any single framework's wording.

Describe how risks are monitored continuously, including the role of control testing and issue management.

Explain how emerging technology changes the risk profile and name three examples with their specific risk implications.

Distinguish risk from audit findings and describe how each drives remediation.

Review your earlier glossary and register for gaps, then correct at least five weak entries.

Consolidate all notes into a single condensed review sheet covering the full lifecycle.

Complete timed practice questions and analyze every error by root cause rather than by topic label.

Rehearse explaining risk appetite, treatment options, and assessment methods aloud without notes.

Identify your three weakest areas and write a targeted final-week drill for each.