IT Risk

Identification

Risk and Control

IT Risk
Monitoring and
Assessment
Reporting

Risk Response
and Mitigation
 Context Establishment

Risk Assessment

Communication and Consultation

Risk Identification

Monitoring and Review

Risk Analysis

Risk Evaluation

Risk Treatment
 Identify Assets

Identify Threats

Identify Existing
Controls

Identify Vulnerabilities

Feed Into Risk Estimation

Identify Consequences
Process

Exhibit 1.5: Risk Identification Process

 Conservative: Aggressive:
Risk- averse Risk Taking

Behavior
Towards
Taking Risk

Risk
Learning Culture Compliance
Culture Behavior Behavior
Towards Towards
Negatives Policy
Blaming Non-
Culture Outcomes Compliance Compliance

Source: ISACA, Exhibit 1.6: Elements of Risk Culture

 Expectation:
Strategy, Policies,
Procedures,
Awareness,
Training, etc.

Effective IT Risk
Communication

Status:
Capability:
Risk Profile,
Risk Management
Key Risk Indicators,
Process Maturity
Loss Data, etc.

Source: ISACA, Exhibit 1.9: Risk Communication Components

 Board of Directors

Enterprise Strategy

Senior Management

Strategic Plans

Reporting Business Units Risk Management Reporting

Risk Guidance

Business Operations
and Processes Risk Monitoring

Source: ISACA, Figure 0.1: Risk Governance