IT risk management is the heart of the CRISC certification. This guide covers the essential concepts you need to master for exam success.
The Risk Management Lifecycle
CRISC follows a structured approach to risk management:
Risk Identification Techniques
Asset-Based Approach
Start with your assets (data, systems, infrastructure) and identify threats to each.
Threat-Based Approach
Start with known threats (malware, insider threat, natural disaster) and map them to vulnerable assets.
Scenario-Based Approach
Develop risk scenarios: "What if a ransomware attack encrypted our financial databases?"
Exam tip: CRISC favors the scenario-based approach because it links threats, vulnerabilities, and business impact.
Risk Assessment Methods
Quantitative Assessment
Uses numbers and financial values:
Example:
Qualitative Assessment
Uses descriptive scales (High/Medium/Low) in a risk matrix:
When to use which:
Risk Response Strategies
1. Risk Mitigation (Reduce)
Implement controls to reduce likelihood or impact.
2. Risk Transfer (Share)
Shift risk to a third party.
3. Risk Avoidance (Eliminate)
Stop the activity that creates the risk.
4. Risk Acceptance
Acknowledge the risk and take no action.
Exam tip: Risk acceptance must ALWAYS be a management decision, never a technical team decision.
Key Risk Indicators (KRIs)
KRIs are metrics that provide early warning of increasing risk:
Risk Register
The risk register is your central document for tracking risks. Each entry includes:
Frameworks for CRISC
Know these frameworks and how they relate to risk management:
Ready to tackle the CRISC exam? Start with our CRISC Course covering all 4 domains with practice MCQs and flashcards.