ISACA Certified in Risk and Information Systems Control

Risk work needs limits set from above. You define appetite, tolerance and capacity, establish risk policy and the structures that oversee it, and place responsibility across the three lines.

• Risk appetite, tolerance and capacity
• Risk policy and standards
• Risk committees and escalation
• The three lines model
• Risk ownership and accountability
• Integrating risk into decisions

You build A risk appetite statement and escalation matrix for a named organization.

Scenarios make risk specific enough to assess. You identify threats, vulnerabilities and assets, build scenarios from them, and use external sources to spot emerging risk before it reaches the register.

• Asset identification and valuation
• Threat and vulnerability sources
• Developing risk scenarios
• Emerging risk and horizon scanning
• Risk from projects, change and third parties
• Building the risk universe

You build A set of ten risk scenarios for one business service, each tied to an asset and a threat.

Analysis turns scenarios into priorities. You estimate likelihood and impact, compare qualitative and quantitative methods, distinguish inherent from residual risk and aggregate risks for decision makers.

• Likelihood and impact estimation
• Qualitative and quantitative techniques
• Risk matrices and their pitfalls
• Inherent and residual risk
• Aggregating and prioritizing risks
• Business impact analysis as an input

You build A completed risk analysis of ten scenarios, with ratings, assumptions and a prioritized register.

Every risk needs a decision someone owns. You choose among avoidance, mitigation, transfer and acceptance, weigh cost against benefit, assign owners and manage exceptions.

• Avoid, mitigate, transfer and accept
• Cost-benefit analysis of responses
• Risk owners and acceptance authority
• Response plans and timelines
• Exceptions and compensating measures
• Responding to third-party risk

You build A response plan for five risks, with cost-benefit reasoning and named owners.

Controls should answer specific risks. You select control frameworks and types, design controls to address scenarios, assign ownership and implement them with the teams who operate them.

• Control frameworks and catalogs
• Control types and design principles
• Mapping controls to risk scenarios
• Control ownership and documentation
• Implementing controls with operations
• Control costs and trade-offs

You build A control map that links ten scenarios to designed controls, owners and evidence.

A control that is not tested is an assumption. You test design and operation, use indicators of control health, handle audit findings and track remediation, and monitor continuously where possible.

• Control assessment and testing methods
• Control effectiveness indicators
• Working with audit and assurance findings
• Remediation tracking
• Continuous control monitoring
• Self-assessment and independent review

You build A control testing program for five controls, with test steps and results.

Risk information must reach the people who decide. You design key risk indicators with thresholds, keep the register current, and report in forms that executives and committees can act on.

• Key risk indicators and thresholds
• Leading and lagging indicators
• Maintaining the risk register
• Dashboards and risk reports
• Escalation when thresholds are crossed
• Reporting to different audiences

You build A key risk indicator set and a risk dashboard for an executive committee.

You cannot assess risk in technology you do not understand. This module covers how infrastructure, applications, cloud and emerging technology fit together, and where each introduces risk.

• Infrastructure, networks and data centers
• Applications and development life cycle
• Cloud, virtualization and containers
• Enterprise architecture and risk
• Emerging technology: AI, IoT and automation
• Technology life cycle and obsolescence

You build A technology risk map of one business service, showing each layer and its main risks.

Risk practitioners need security fundamentals to judge controls. You cover access management, cryptography, network and endpoint protection, vulnerability management, incident handling and recovery.

• Confidentiality, integrity and availability
• Identity and access management
• Cryptography and key management in outline
• Network and endpoint security
• Vulnerability and incident management
• Business continuity and disaster recovery

You build A security control review of one system from a risk perspective, with gaps and risks noted.

Personal data adds risk of its own. You classify data, trace it through its life cycle, assess privacy risk and apply the controls and obligations that follow from privacy law.

• Data classification and ownership
• Privacy principles and obligations
• Data flows and the data life cycle
• Privacy risk assessment
• Privacy controls
• Retention and disposal

You build A privacy risk assessment of one data flow, with risks and controls recorded.

One engagement runs the whole practice. You set context and appetite, identify and analyze risk, choose responses and controls, define indicators and report to the unit’s leadership.

• Setting context, scope and appetite
• Identifying and analyzing risk
• Choosing responses and designing controls
• Defining indicators and monitoring
• Reporting to leadership

You build A full risk assessment package for a business unit: register, controls, indicators and report.