Chapter 1 of 4 · ISACA CRISC
Governance
Strategy, roles, culture, policies, resilience and assets, plus ERM, lines of defense, risk profile, appetite and frameworks.
- 7topics
- 34 minfast track
- 2diagrams and exhibits
- 26%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Strategy, Structure, Roles and ResponsibilitiesCRISC governance basics: link IT risk to strategy, goals and objectives, and know who does what, from board and risk owner to…5 min
- 2Risk Culture, Ethics, Policies and StandardsCRISC risk culture and ethics, tone at the top, and the policy hierarchy of policies, standards, procedures and guidelines, with…5 min
- 3Business Processes and Resilience (BCP and DRP)CRISC view of business processes and resilience: critical processes, BCP versus DRP, crisis management, tabletop exercises and…5 min
- 4Organizational Asset ManagementCRISC asset management: building the asset inventory, assigning owners, classifying and valuing assets, CMDB, shadow IT and why…4 min
- 5Enterprise Risk Management and Lines of DefenseCRISC ERM and lines of defense: how IT risk fits enterprise risk, COSO ERM 2017, ISO 31000, and the IIA Three Lines Model roles…Diagram5 min
- 6Risk Profile, Risk Appetite and Risk ToleranceCRISC risk profile, risk capacity, appetite and tolerance: who sets them, how to express thresholds, and what to do when risk…Diagram5 min
- 7Risk Frameworks and Legal, Regulatory and Contractual RequirementsCRISC risk frameworks and obligations: COBIT 2019, Risk IT, NIST 800-39 and 800-37, ISO 27005, plus laws, regulation and…5 min
About this chapter
What this chapter covers
Governance is 26% of the ISACA CRISC exam. It tests whether you understand the business you are protecting: its strategy and objectives, how it is organized, its culture, its policies, its critical processes and assets, and how IT risk can damage all of them.
The domain has two parts. Organizational governance (1A) covers strategy, structure and roles, culture and ethics, policies and standards, business processes and resilience, and asset management. Risk governance (1B) covers enterprise risk management, the lines of defense, the risk profile, risk appetite and tolerance, and the frameworks and legal, regulatory and contractual requirements that shape the program.
The exam has 150 multiple choice questions in four hours. Questions are written from the risk practitioner's viewpoint and ask what you should do FIRST, which option is BEST, or what is MOST important. The practitioner advises and facilitates; senior management sets appetite, risk owners accept risk, and control owners run controls.
How the topics fit together
Everything in risk management starts with business objectives, because risk is uncertainty that affects those objectives. Governance then decides who owns what, how much risk is acceptable, and which rules and frameworks the organization follows.
When two options both look reasonable, choose the one that ties the decision back to business objectives and the approved risk appetite. ISACA rarely rewards a purely technical answer in this domain.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.