CIA Part 1, Unit 7: Risk Management
Free study notes for Section C: Governance, Risk Management, and Control, which is 30% of the CIA Part 1 exam. Topics: Risk management cycle, Appetite and responses, Types of risk, COSO ERM, ISO 31000, Who does what.
Practice 123 free questionsOpen CIA Drill
Risk management cycle
- Steps: Identify context, identify risks, assess and prioritize, respond, monitor.
- Assess: Significance, likelihood, and ways to manage. Qualitative or quantitative.
- Methods: Risk maps, modeling, decision trees, Monte Carlo simulation.
- Monitor: Track risks and responses, residual risk, and new risks.
Appetite and responses
- Risk appetite: The types and amount of risk the organization will accept.
- Risk tolerance: Acceptable variation in performance.
- Risk capacity: The maximum risk it can take.
- Responses: Accept, avoid, reduce, share, or pursue.
- Residual risk: What remains after responses. Inherent risk is before them.
Types of risk
- Strategic: Economic, political, regulatory, reputation, brand, changing customer needs.
- Operational: Failed processes, people, or systems.
- Financial: Interest-rate, exchange-rate, credit, liquidity, market.
- Hazard: Insurable events such as disasters.
- Other: Reputational, environmental, social responsibility, and sustainability risk.
COSO ERM
- Premise: Every organization exists to provide value for stakeholders.
- Components: Governance and culture; strategy and objective setting; performance; review and revision; information, communication, and reporting.
- Principles: Twenty, spread across the five components.
- Risk views: Risk, category, profile, and portfolio. Portfolio is the most integrated.
- Limits: Judgment, cost-benefit, errors, collusion, management override.
ISO 31000
- Style: Principles-based and applies to any organization.
- Principles: Eight, including inclusive, dynamic, best available information, and continual improvement.
- Process: Communication, scope and context, assessment, treatment, monitoring, recording.
- Assessment: Identify, analyze, evaluate.
- Assurance approaches: Key principles, process elements, maturity model.
Who does what
- Board: Oversees risk management and the system's effectiveness.
- Management: Sets risk attitude and manages risk.
- Internal audit: Gives assurance on the whole risk management system.
Test yourself on this unit
Reading is only half of studying. CIA Drill has 123 free exam-style questions for this unit, each with an explanation, and spaced review that brings missed questions back. You can also take timed mock tests that follow the real exam weighting.