Risk is the combination of the likelihood of an event and its impact.

I&T risk is a business risk, specifically, the business risk associated with the use, ownership, operation, involvement, influence and adoption of information and technology

Processes

Organizational structures

Principles, policies and procedures

Information

Culture, ethics and behavior

People, skills and competencies

Services, infrastructure and applications

Enterprise risk management (ERM) committee

Chief risk officer (CRO)

Audit department

Compliance department

I&T risk officers/managers

KRIs, KPIs and KGIs

Incident reports

Business strategy (e.g., emerging technologies)

Policies

Audit reports or other reviews

Risk report (current and mitigation status)

Risk register

Regulations

Threat intelligence

Risk tolerance

Risk appetite

Meeting minutes

Risk management strategy

Risk mitigation actions

Policy (change control)

A. Risk register

B. Risk action plan

C. Loss events (historical and current)

D. Risk factors

E. Independent assessment findings

It defines the frequency of reporting, types of information about I&T risk and recipients of that information.

Common, very easy and intuitive technique to present risk.

Risk appetite is the broad-based amount of enterprise I&T risk that an enterprise is willing to accept in pursuit of its mission (or vision).

Risk tolerance is the acceptable level of variation that management is willing to allow for any particular risk as it pursues the enterprise’s objectives.

Risk capacity is the objective magnitude or amount of loss that an enterprise can tolerate without risking its continued existence.

Key risk indicators (KRIs) are metrics capable of showing that the enterprise is subject to—or has a high probability of being subject to—a risk that exceeds the defined risk appetite or tolerance

Information on upcoming or likely combinations of control, value and threat conditions that impose a noteworthy level of future I&T risk.

Leadership skills

Analytical capability

Critical thinking

Interpersonal capabilities

Communication

Influencing

Lateral thinking (thinking outside the box)

Technical understanding

Organizational and business awareness

Risk expertise

Training and coaching

Experience

Education

Typical qualifications and certifications

Knowledge

Technical skills

Behavioral skills

Connect to Enterprise Business or Mission

Align With Enterprise Risk Management

Balance Costs and Benefits

Promote Ethical and Open Communication

Establish Tone at the Top and Accountability

Use a Consistent Approach Aligned to Strategy

Core IT risk policy

Information security policy

Crisis management policy

Third-party IT service delivery management policy

Business continuity policy

Program/project management policy

Human resources (HR) policies

Fraud risk policy

Compliance policy

Ethics policy

Quality management policy

Service management policy

Change management policy

Delegation of authority policy

Whistleblower policy

Internal control policy

Intellectual property (IP) policy

Data privacy policy

1. Scope

2. Validity

3. Management Commitment and Accountability

4. Risk Governance

5. Risk Management Framework

General (Enterprisewide)

IT Risk Professional

Management

The use of established policies and procedures

Incentive and reward programs

Awareness programs

Program/Project risk advisory services

I&T incident management services

Architecture advisory services

I&T risk intelligence services

I&T risk management services

Crisis management services

Data sources

Infrastructure for knowledge repositories

Intelligence integration architecture

Governance, risk and compliance (GRC) tools

Analysis tools

Tools for risk communication/reporting

Knowledge repositories

Business continuity tools

I&T Risk Scenarios

Risk Scenario Categories Mapped to COBIT 2019 Governance and Management Objectives

Template for Risk Register Entry

IT Risk Reporting Examples

Sample Risk Maps