Free CRISC flashcards

When residual risk sits just above appetite but further controls would cost more than the potential loss, what treatment is appropriate?

Informed risk acceptance with documented business-owner sign-off. When the marginal cost of more controls exceeds the value at risk, accepting is the economically rational choice, and formal sign-off keeps the residual exposure owned and accountable rather than ignored.

Transferring a marginal over-appetite exposure to an insurer is the right call when controls would cost more than the loss.

Transfer adds premium cost on top of an exposure already smaller than further treatment spend, so it is hard to justify. When treatment cost exceeds the potential loss, documented acceptance is the rational response.

What provides the strongest evidence that an IT risk management approach is aligned with organisational strategy?

Deriving risk appetite, tolerance and treatment priorities directly from the approved strategic objectives. When these flow from strategy, business intent becomes the controlling input and the risk approach is demonstrably governed by strategy rather than run as an isolated technical exercise.

Mapping each IT risk scenario to the business objectives it could impair proves the risk approach is steered by strategy.

Mapping risks to objectives shows useful traceability and documents exposure, but it does not prove the overall approach is steered by strategy. Strategic alignment is shown by deriving appetite, tolerance and treatment priorities from the approved objectives.

What four components must an IT risk scenario bind together to be useful for analysis and response?

A usable scenario links a threat actor, the triggering event, the affected asset, and the resulting business loss consequence. Likelihood and impact estimates depend on all four being present, so a complete scenario gives analysts enough context to size the risk and design a proportionate response.

A detailed network and data-flow diagram of a platform constitutes a risk scenario.

An architecture diagram is an input that supports analysis, not a scenario in itself, because it names no event, no actor, and no loss outcome. A scenario must connect actor, event, asset, and consequence.

How should the enterprise architecture function manage IT risk when a business unit wants to buy a platform that duplicates an existing capability?

Architecture review compares each proposed change against the agreed target-state architecture. Running the proposed platform through that review surfaces redundancy with the existing capability and the integration burden before money is committed, so the risk is addressed pre-approval rather than after deployment fragments the estate.

A routine duplicate-platform purchase should be escalated straight to the audit committee for an independent buy or no-buy decision.

Audit-committee escalation sounds rigorous but bypasses the architecture review, which is the correct first-line mechanism for catching duplication and integration risk. It is also disproportionate to a routine procurement decision.