Governance and Management of IT · Topic 3 of 5
Enterprise Risk, Privacy and Data Governance
Enterprise risk management, risk appetite and treatment, privacy principles and impact assessments, and data ownership and classification for CISA.
- 3 min
- Includes a diagram
- The board sets risk appetite; owners manage risks within it.
- Four treatments: mitigate, transfer, avoid, accept.
- Privacy by design: PIA or DPIA before new high-risk processing.
What it is
Enterprise risk management (ERM) is how the organization identifies, assesses, treats and monitors risk across the whole business, IT included. A privacy program protects personal information and meets privacy laws. Data governance decides who owns data, how it is classified and how its quality and protection are maintained.
How it works
Risk management
| Term | Meaning |
|---|---|
| Risk appetite | The amount of risk the organization is willing to accept to pursue its objectives, set by the board |
| Risk tolerance | Acceptable variation around the appetite for a specific objective |
| Inherent risk | Risk before controls |
| Residual risk | Risk remaining after controls |
| Risk register | Record of risks, owners, ratings and treatment |
Risk treatment options
| Option | Example |
|---|---|
| Mitigate (reduce) | Add controls such as encryption or monitoring |
| Transfer (share) | Insurance, outsourcing with contractual liability |
| Avoid | Stop the risky activity |
| Accept | Formally accept residual risk within appetite, by an owner with authority |
Each risk needs a named risk owner in the business, not in IT or audit. The auditor checks that risks are assessed consistently, that treatment matches appetite, and that accepted risks were accepted at the right level.
Risk analysis can be qualitative (high, medium, low ratings) or quantitative (monetary values such as annualized loss expectancy). Qualitative is faster; quantitative supports cost justification.
Privacy program and principles
Common privacy principles found in laws and frameworks include:
- Lawful basis and consent for collecting personal data.
- Purpose limitation: use data only for the stated purpose.
- Data minimization: collect only what is needed.
- Accuracy, storage limitation and security of personal data.
- Transparency and individual rights such as access and correction.
- Accountability: the organization can show compliance.
A privacy impact assessment (PIA), called a data protection impact assessment (DPIA) under the EU GDPR, is performed before new processing of personal data that may carry high risk, so privacy is designed in. A privacy program has an owner such as a data protection officer, policies, training, records of processing and breach procedures.
Data governance and classification
| Role | Responsibility |
|---|---|
| Data owner | Business manager accountable for the data; decides classification and who may access it |
| Data custodian | Implements and operates the controls (often IT) |
| Data user | Uses data under the rules |
Classification levels such as public, internal, confidential and restricted drive handling, access and retention rules. Data governance also covers data quality, data lineage (where data came from) and retention and disposal.
When asked who should decide access to a data set or its classification, choose the data owner, not IT or the security team.
How the exam asks about this
- "Who should accept a residual risk?" The business risk owner with the authority set by the risk appetite.
- "A new system will process health data." Perform a privacy impact assessment before design is finalized.
- "Who classifies data?" The data owner.
What to remember for the exam
- The board sets risk appetite; owners manage risks within it.
- Four treatments: mitigate, transfer, avoid, accept.
- Privacy by design: PIA or DPIA before new high-risk processing.
- Data minimization and purpose limitation are core privacy principles.
- Owner classifies, custodian protects, user follows the rules.
Transferring risk through insurance or outsourcing does not transfer accountability. The organization is still answerable to regulators and customers.
Common mistakes
Letting IT own business risks. Risk owners sit in the business.
Doing the PIA after go-live. It belongs at the design stage.
Confusing owner and custodian. The owner decides; the custodian implements.
Check yourself
Who sets the organization's risk appetite?
The board of directors.
What is residual risk?
The risk that remains after controls have been applied.
When should a privacy impact assessment be performed?
Before new processing of personal data that may be high risk, during design.
Topic 3 of 5 in Governance and Management of IT
Test yourself on Governance and Management of IT
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.