SecurityX Enterprise Risk Management Frameworks Quiz

COBIT is an IT governance and management framework that aligns IT activities with business goals and integrates risk management. ITIL focuses on IT service management, TOGAF on enterprise architecture, and PMBOK on project management; none of them is primarily an IT governance framework.

Governance is effective when risk management objectives directly support organizational strategy, so the risks taken match what the business is trying to achieve. This alignment keeps risk decisions consistent with the organization’s risk appetite and strategic goals.

Risk acceptance means acknowledging a risk and choosing not to take further action, usually because it falls within risk tolerance or the cost of treatment outweighs the benefit. Mitigation reduces likelihood or impact, avoidance eliminates the risky activity, and transfer shifts the impact to a third party, such as an insurer.

Regulators and auditors expect documented evidence that controls exist and are operating as intended. Records, logs, and audit trails of control activities are how an organization demonstrates compliance during an audit or investigation.

An integrated framework brings risks from every function into one view, so leadership can see interdependencies and prioritize consistently. It does not remove the need for compliance audits or internal controls, and no framework can guarantee zero risk exposure.

The Three Lines Model separates operational management (first line), risk and compliance oversight functions (second line), and independent internal audit (third line), giving clear accountability and independent assurance. Centralized, decentralized, and flat structures describe how authority is distributed, not how management and oversight duties are separated.

Risk response, also called risk treatment, is the step where an organization decides how to handle an identified risk: accept, avoid, transfer, or mitigate it. The choice depends on the risk’s likelihood and impact and the organization’s risk appetite.

Training and awareness help employees understand their compliance obligations and how to meet them in daily work. Ignoring best practices, minimizing documentation, and avoiding external audits all weaken a compliance program rather than strengthen it.

Governance depends on regularly monitoring and reviewing risk management processes and controls to confirm they remain effective as threats, business conditions, and regulations change. Without this ongoing oversight, controls can drift out of alignment with the organization’s risk appetite.

Risk tolerance defines the acceptable level of variation or exposure an organization will withstand for a specific objective or risk, setting the practical limits within its broader risk appetite. Eliminating all risk is not achievable, transferring all risk is a single response strategy, and avoiding all business opportunities would undermine the organization’s objectives.

COSO ERM gives organizations a structured, enterprise-wide approach to identifying, assessing, and managing risk in line with strategy and objectives. It is not limited to financial reporting, it does not replace internal audit, and no framework can eliminate all risk; the goal is to manage risk within acceptable levels.

Likelihood is the probability or chance that a risk event will occur within a given timeframe. Combined with impact, it is used to calculate or rank overall risk during an assessment.

Governance sets strategic direction, accountability, and oversight, while compliance ensures the organization meets specific laws, regulations, and internal requirements. The two are related but distinct; neither is inherently more important than the other, and governance applies to every type of organization, not only financial institutions.

Residual risk is what remains after controls and mitigation have been applied, since few risks can be eliminated entirely. Risk before any controls are applied is inherent risk, unmeasurable risk is a separate concept, and transferring risk to an insurer is a risk response, not a definition of residual risk.

Compliance frameworks require organizations to put controls in place, backed by policies and procedures, that ensure regulatory requirements are consistently met. These controls are then tested and documented to show adherence during audits.

A risk register is a central record of identified risks, their likelihood and impact, owners, and planned responses, used to track risks over time. It supports risk assessment and monitoring rather than replacing them, and it is not a financial ledger.

ISO/IEC 27005 provides guidance for managing information security risk and supports the ISO/IEC 27001 family. ISO 9001 covers quality management, ISO 31000 covers general risk management rather than information security specifically, and ISO 14001 covers environmental management.

Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. Leadership typically sets it, and it guides how risks are prioritized and treated across the organization.

Due diligence means investigating and understanding the obligations, risks, and requirements that apply before acting. Paying fines is a consequence of non-compliance, hiring consultants is one possible resource, and documenting communications is a record-keeping practice; none of these is the investigation itself.

The board of directors holds ultimate accountability for risk oversight and sets the organization’s risk appetite. A risk committee often supports the board but reports to it, department managers own risks within their own areas, and external auditors provide independent assurance rather than oversight.