The Certified in Risk and Information Systems Control (CRISC)

The most important factor to have in place to ensure the effectiveness of risk and security metrics reporting is an organizational reporting process. An organizational reporting process is a set of procedures that defines the roles, responsibilities, frequency, format, and distribution of the risk and security metrics reports. An organizational reporting process helps to ensure that the risk and security metrics are relevant, accurate, consistent, and timely, and that they provide useful information for decision making and performance improvement. An organizational reporting process also helps to align the risk and security metrics reporting with the enterprise’s objectives, strategies, and policies, and to communicate the risk and security status and issues to the appropriate stakeholders. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.3.2, page 2421

According to the ISACA Risk and Information Systems Control study guide and handbook, the primary benefit of selecting an appropriate set of key risk indicators (KRIs) is that they provide a warning of emerging high-risk conditions. KRIs are metrics that monitor changes in the level of risk exposure and contribute to the early warning signs that enable organizations to report risks, prevent crises, and mitigate them in time. KRIs help risk managers to identify potential threats, assess their impact and likelihood, and take proactive measures to reduce the risk or seize the opportunity12

1: ISACA Risk and Information Systems Control Study Guide, 4th Edition, page 33 2: ISACA Risk and Information Systems Control Handbook, 1st Edition, page 25

The first step in response to an identified risk is updating the risk profile to reflect the new exposure. This informs further actions such as treatment planning or tolerance reassessment.

According to the CRISC Review Manual (Digital Version), the next course of action when a risk practitioner finds the IT department’s recovery time objective (RTO) for a key system does not align with the enterprise’s business continuity plan (BCP) is to consult with the IT department to update the RTO. The RTO is the maximum acceptable time that an application, computer, network, or system can be down after an unexpected disaster, failure, or comparable event takes place. The RTO should be aligned with the BCP, which is a set of policies, procedures, and resources that enable the organization to continue or resume its critical business functions in the event of a disruption. Consulting with the IT department to update the RTO helps to:

Ensure that the RTO reflects the current business requirements and expectations for the availability and recovery of the key system

Evaluate the feasibility and cost-effectiveness of achieving the RTO with the existing IT resources and capabilities

Identify and implement the necessary changes or improvements in the IT infrastructure, processes, and controls to meet the RTO

Test and validate the RTO and the IT recovery procedures and verify their compatibility and consistency with the BCP

Communicate and coordinate the RTO and the IT recovery plan with the relevant stakeholders, such as the business owner, the risk owner, and the senior management

References = CRISC Review Manual (Digital Version), Chapter 3: IT Risk Response, Section 3.3: Risk Response Options, pp. 174-1751

A primary benefit of engaging the risk owner during the risk assessment process is prioritization of risk action plans across departments, because this helps to ensure that the most critical and relevant risks are addressed first, and that the resources and efforts are allocated and coordinated efficiently and effectively. A risk owner is the person or group who is responsible for the day-to-day management and mitigation of a specific risk, and who has the authority and accountability to make risk-related decisions. A risk assessment is the process of identifying, analyzing, and evaluating the risks that may affect the organization’s objectives, performance, or value. A risk action plan is the set of actions and tasks that are designed and implemented to reduce the likelihood and impact of a risk, or to exploit the opportunities that a risk may create. By engaging the risk owner during the risk assessment process, the organization can benefit from the following advantages:

The risk owner can provide valuable input and feedback on the risk identification, analysis, and evaluation, based on their knowledge, experience, and perspective of the risk and its context.

The risk owner can help to develop and implement the risk action plan, based on their understanding of the risk objectives, expectations, and outcomes, and their ability to influence and control the risk factors and sources.

The risk owner can help to prioritize the risk action plan, based on their assessment of the risk severity, urgency, and importance, and their consideration of the costs, benefits, and feasibility of the risk actions.

The risk owner can help to coordinate the risk action plan across departments, by communicating and collaborating with other risk owners, stakeholders, and resources, and by aligning and integrating the risk actions with the organization’s strategy, processes, and culture. References = Risk Owners — What Do They Do1

According to the CRISC Review Manual1, peer reviews are the process of evaluating the quality and validity of risk analysis by independent experts or colleagues. Peer reviews are conducted to ensure that the risk analysis is consistent, objective, and reliable, and that it follows the established standards and methods. The primary reason for conducting peer reviews of risk analysis is to minimize subjectivity of assessments, as peer reviews can help to reduce personal biases, preferences, and assumptions that may affect the risk analysis outcomes. Peer reviews can also help to identify and correct any errors, gaps, or inconsistencies in the risk analysis, and to improve the risk analysis skills and knowledge of the reviewers and the reviewees. References = CRISC Review Manual1, page 209.

 Key control indicators (KCIs) are metrics that measure how well a specific control is performing in reducing the causes, consequences, or likelihood of a risk1. Key risk indicators (KRIs) are metrics that measure changes in the risk exposure or the potential impact of a risk2. By linkingan effective KCI to relevant KRIs, the organization can monitor changes in the risk environment and assess how the control is influencing the risk level3. This can help the organization to:

Identify emerging or escalating risks and take timely and appropriate actions

Evaluate the effectiveness and efficiency of the control and make improvements if needed

Align the control with the risk appetite and tolerance of the organization

Communicate the risk and control status to stakeholders and regulators

References = Risk and Information Systems Control Study Manual, Chapter 6: Risk Response and Mitigation4

 The greatest concern for the risk practitioner when the potential vendor has offered to perform quarterly self-audits of its controls instead of having annual independent audits is that the controls may not be properly tested. Self-audits are audits that are performed by the vendor itself, without the involvement of an external or independent party. Self-audits may not be reliable, objective, or consistent, as the vendor may have biases, conflicts of interest, or lack of expertise in auditing its own controls. Self-audits may also not follow the same standards, criteria, or methodologies as independent audits, and may not provide sufficient assurance or evidence of the effectiveness of the controls. The other options are not as concerning as the possibility of improper testing of the controls, as they are related to the outcomes, expectations, or approaches of the controls, not the quality or validity of the controls. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.3: IT Control Assessment, page 6

According to the ISACA Risk and Information Systems Control study guide and handbook, the most comprehensive approach to capture the risk scenario of collecting and storing credit card information is event tree analysis (ETA). ETA is a forward, top-down, logical modeling technique that explores the responses and outcomes of a single initiating event, such as a data breach or a cyberattack. ETA can help to identify all possible consequences of the scenario, such as financial losses, reputational damages, legal liabilities, regulatory penalties, and customer dissatisfaction. ETA can also help to assess the probabilities of the outcomes and the effectiveness of the controls and mitigation strategies12

1: ISACA Risk and Information Systems Control Study Guide, 4th Edition, page 33 2: ISACA Risk and Information Systems Control Handbook, 1st Edition, page 25