Learning Objectives

• Identify and evaluate IT and enterprise risk in alignment with organizational business objectives
• Select and implement appropriate information security and information systems controls
• Develop risk response and mitigation strategies that reflect business priorities
• Design governance processes to support ongoing monitoring and risk reporting
• Prepare for the CRISC exam using practical scenarios, exam-focused review, and practice questions

Course Outline

Module Domain 1: Governance

Addresses risk assessment concepts, standards, and frameworks; organizational strategy, goals, and objectives; organizational structure, roles, and responsibilities; organizational culture and assets; policies, standards, and business processes; enterprise risk management and risk management frameworks including the three lines of defense; risk profile, risk appetite, and risk tolerance; and professional ethics requirements in laws, regulations, and controls.

Module Domain 2: IT Risk Assessment

Addresses risk events, threat modeling, and the threat landscape; vulnerability and control deficiency analysis; risk scenario development; the risk register; risk analysis methodologies; business impact analysis; and inherent, residual, and current risk.

Module Domain 3: Risk Response and Reporting

Addresses risk treatment options and risk response strategies; risk and control ownership; managing risk from internal processes, third parties, and emerging sources; control types, standards, and frameworks; control design, selection, and analysis; control implementation, testing, and effectiveness evaluation; risk treatment plans; data collection, aggregation, analysis, and validation; risk and control monitoring and reporting techniques; and performance, risk, and control metrics.

Module Domain 4: Information Technology and Security

Addresses enterprise architecture; IT operations management; project management; disaster recovery management; data life cycle management; the system development life cycle; emerging technologies; information security concepts, frameworks, standards, and awareness training; business continuity management; and data privacy and protection principles.