Governance · Topic 1 of 7
Strategy, Structure, Roles and Responsibilities
CRISC governance basics: link IT risk to strategy, goals and objectives, and know who does what, from board and risk owner to control owner.
- 5 min
- Risk is measured against objectives, so knowing the strategy comes first.
- Governance (board) evaluates, directs and monitors; management plans, builds, runs and monitors.
- The risk owner is accountable and accepts residual risk; the practitioner only advises.
What it is
Strategy, goals and objectives describe where the organization wants to go and how it will measure success. IT risk only matters because it can stop those objectives being met, so the risk practitioner starts every engagement by understanding them.
Organizational structure, roles and responsibilities decide who sets direction, who makes risk decisions and who does the work. Clear roles turn risk management from a document into accountable action.
How it works
From strategy to IT risk
A strategy is cascaded into business goals, then into IT goals and enabling processes. COBIT 2019 calls this the goals cascade: stakeholder needs drive enterprise goals, which drive alignment goals for IT. A risk is significant when it threatens a goal that matters to the strategy.
The practitioner collects and reviews existing information before judging risk: strategic plans, annual reports, organization charts, process maps, prior risk assessments and audit reports. This is the first supporting task of the job practice, and it explains why "understand the business" is so often the FIRST step in exam answers.
| Input | What it tells the practitioner |
|---|---|
| Strategic plan | Which objectives risk must protect or enable |
| Business model and markets | Where revenue, customers and dependencies sit |
| Organization chart | Who can own and accept risk |
| Prior assessments and audits | Known weaknesses and open issues |
| Regulatory obligations | Requirements the business must meet |
Risk is not only downside. A new technology that the business does not adopt can also be a risk to strategy, so the practitioner considers opportunity as well as loss.
Governance versus management
COBIT 2019 separates the two clearly. Governance evaluates stakeholder needs, sets direction and monitors performance; it is the job of the board. Management plans, builds, runs and monitors activities in line with that direction; it is the job of executives and their teams.
| Governance (board) | Management (executives) |
|---|---|
| Evaluate, direct, monitor | Plan, build, run, monitor |
| Sets risk appetite | Operates within appetite |
| Approves risk policy | Implements the policy |
| Holds management accountable | Reports to the board |
Key roles in risk management
| Role | Responsibility |
|---|---|
| Board of directors | Ultimate accountability; approves appetite and risk policy; oversees ERM |
| Senior management and executives | Set the tone, allocate resources, own enterprise risks in their areas |
| Chief risk officer (CRO) | Leads the risk function, reports on the enterprise risk profile |
| Risk committee | Reviews major risks and escalations, often a board or executive committee |
| Risk owner | Accountable for a specific risk; decides on treatment and accepts residual risk |
| Control owner | Accountable for a control working as designed |
| Risk practitioner | Facilitates assessments, advises, monitors and reports |
| Internal audit | Independent assurance over risk management and controls |
The risk owner should be the person with the authority and budget to manage the risk, usually the business process owner. IT often runs the systems but rarely owns the business risk.
RACI and segregation of duties
A RACI chart (Responsible, Accountable, Consulted, Informed) records roles for each risk activity. Only one party should be accountable for each activity. Overlapping or missing accountability is a governance weakness in itself.
Segregation of duties prevents one person from controlling a process end to end. Requesting, approving, executing and reviewing should sit with different people where the risk justifies it.
A worked example
A retailer's strategy is to double online sales in three years. The practitioner reviews the plan and sees that the e-commerce platform is the key dependency. Outages, payment fraud and data breaches on that platform therefore threaten the main strategic objective.
The practitioner proposes that the head of online sales owns these risks, because that person carries the revenue target and the budget. The IT operations manager is the control owner for availability controls. The risk committee receives a quarterly report on the platform risks against appetite.
How the exam asks about this
- "What should the risk practitioner do FIRST when starting a new risk assessment?" Understand the business objectives and context of the area being assessed.
- "Who should own the risk of a business application failing?" The business process owner who depends on the application, not IT.
- "Which is the BEST indicator that IT risk management is aligned with the business?" Risks are expressed in terms of their impact on business objectives.
What to remember for the exam
- Risk is measured against objectives, so knowing the strategy comes first.
- Governance (board) evaluates, directs and monitors; management plans, builds, runs and monitors.
- The risk owner is accountable and accepts residual risk; the practitioner only advises.
- Each activity should have exactly one accountable party in a RACI chart.
- Missing or unclear ownership is itself a significant governance finding.
The risk practitioner never owns or accepts a business risk. If an option has the practitioner or the CISO accepting risk on behalf of the business, it is almost always wrong.
Common mistakes
Assigning the risk to IT because IT runs the system. Ownership follows business impact and authority, not who maintains the technology.
Starting with a technical scan. A vulnerability scan without business context cannot tell you which findings matter. Context comes first.
Treating the board as an operational body. The board sets direction and oversees; it does not design or run controls.
Check yourself
Why does the risk practitioner review the strategic plan before assessing IT risk?
Risk is uncertainty affecting objectives, so the practitioner must know which objectives matter before judging which risks are significant.
What is the difference between a risk owner and a control owner?
The risk owner is accountable for the risk and accepts residual risk; the control owner is accountable for a specific control operating as designed.
What does COBIT 2019 mean by separating governance from management?
Governance evaluates needs, sets direction and monitors, while management plans, builds, runs and monitors activities within that direction.
Topic 1 of 7 in Governance
Test yourself on Governance
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.