Risk Management Fundamentals and Governance
Domain 1 tests how well you can explain risk language and governance before touching tools. Expect questions on risk appetite, tolerance, capacity, ownership, and the board's role.
Core rules
- Risk is the effect of uncertainty on objectives, expressed as likelihood and impact; it is not the same as a threat or a control gap.
- Risk appetite is the amount and type of risk the organization is willing to pursue; risk tolerance is the acceptable variation around that appetite; risk capacity is the maximum it can bear.
- Governance assigns accountability: the board sets appetite and oversight, executives own decisions, the risk function facilitates, and business owners own risks.
- The three lines model separates management (first), independent risk and compliance (second), and internal audit (third).
- Inherent risk is assessed before controls; residual risk after controls; target risk is what remains acceptable.
Worked example
A board says it will accept no more than $2 million annual loss from cyber. A business unit proposes a $3 million project with a $1.5 million residual exposure. The CRO calculates that the project's inherent loss estimate is $6 million and controls reduce it to $1.5 million. The decision: the project fits appetite after controls, but the residual must be tracked and reported because it approaches 75% of the appetite limit. The reasoning uses residual, not inherent, exposure and compares it to a stated limit.
Traps
- Equating risk appetite with a single number or with zero risk.
- Naming a risk owner who has no authority to fund treatment.
- Treating the risk register as an audit artifact rather than a decision log.