CRISC Certified in Risk and Information Systems Control flashcards

The foundational step of creating a formal organizational structure, such as an AI ethics committee, to define ethical principles, fairness metrics, and oversight mechanisms for AI systems.

• Provides a structured approach to ethical AI.
• Establishes organizational definitions of fairness and responsibility.
• Ensures systematic, rather than ad-hoc, bias mitigation.

Memory trick: Before you fix the AI's heart, you need a council to define 'good'.

The process of explicitly defining, documenting, and assigning specific risk management roles and responsibilities to individuals or departments within an organization.

• Establishes clear accountability for risk management.
• Ensures systematic execution of risk activities.
• Crucial for demonstrating governance maturity.

Memory trick: To make your risk management 'Official', you need to give everyone a 'Job Title' (R&R).

Hierarchical documents that define an organization's objectives, mandatory requirements, and detailed steps for achieving them, respectively.

• Policies state 'what' should be done.
• Standards state 'how' to meet policies.
• Procedures detail 'who, what, when, where, why' for specific tasks.

Memory trick: Train, attest, then rest, for compliance is best.

The process of adapting global corporate policies to incorporate specific legal, regulatory, and cultural requirements of different local jurisdictions while maintaining overall organizational standards.

• Ensures compliance with diverse local laws.
• Balances global consistency with local relevance.
• Crucial for multinational operations in regulated industries.

Memory trick: Global policies are the main recipe; local policies are the specific spice blends for each region.

The establishment of clear roles and responsibilities for risk management and overall governance as a foundational element for organizational stability and sustainable growth, especially in rapidly scaling environments.

• Prevents inconsistent risk-taking.
• Ensures accountability for risk decisions.
• Supports strategic alignment and long-term sustainability.

Memory trick: No clear roles means no clear path, leading to chaos and collapse.

A structured set of principles, policies, responsibilities, and oversight mechanisms designed to ensure that artificial intelligence systems are developed and used in an ethical, fair, transparent, and accountable manner.

• Addresses concerns like bias, transparency, and accountability.
• Provides a systematic approach to ethical AI.
• Essential for maintaining trust and regulatory compliance.

Memory trick: AI's ethical path needs a framework, not just code or PR.

The practice of translating complex security policies and standards into actionable, developer-friendly guidelines and integrating them directly into the software development lifecycle.

• Ensures 'shift-left' security, embedding controls early.
• Reduces friction between security requirements and development speed.
• Leverages automation to enforce policy adherence continuously.

Memory trick: Policy Simple, Devs Nimble, Pipeline Stable.

The ability to understand and apply knowledge about how an organization operates, makes money, and achieves its strategic goals.

• Involves understanding financial, market, and operational drivers.
• Enables risk professionals to align risk management with business strategy.
• Critical for effective communication with senior management.

Memory trick: Strategic and financial understanding wins the board's ear.

A formal document that articulates the amount and type of risk an organization is willing to take to achieve its strategic objectives, providing clear boundaries and guidance for risk-taking activities.

• Defines acceptable risk levels.
• Guides risk-related decision-making.
• Communicated to all stakeholders.

Memory trick: Appetite for risk defines the security culture's main dish.

A corporate approach that establishes overarching ethical principles and guidelines globally, while allowing for specific adjustments to meet local legal and cultural requirements.

• Balances global consistency with local relevance.
• Addresses diverse legal and cultural contexts.
• Promotes ethical and compliant operations worldwide.

Memory trick: Think 'Global Roots, Local Blooms' – core ethics are universal, but expression varies.

The cornerstone of an Enterprise Risk Management program, defining the amount of risk an organization is willing to accept or retain to achieve its objectives, setting the strategic context for all risk activities.

• Sets strategic boundaries for risk.
• Guides all subsequent ERM activities.
• Approved by the board/senior management.

Memory trick: Before you build, know what risks you're willing to eat.

A structured system of overarching principles and guidelines that provides a consistent organizational approach, while allowing for localized adaptations to meet specific regional requirements.

• Balances global consistency with local compliance and operational needs.
• Ensures common understanding of core values and objectives.
• Facilitates efficient risk management in diverse regulatory environments.

Memory trick: Global Guide, Local Ride, Policy Pride.

The ability to understand and evaluate business decisions from a comprehensive perspective, considering strategic objectives, financial implications, risk appetite, operational impacts, and long-term value creation.

• Integrates strategic, financial, and risk considerations.
• Essential for board-level decision-making.
• Ensures decisions align with organizational goals and risk tolerance.

Memory trick: Before you leap, check your map (strategy) and your tolerance for heights (risk appetite).

The practice of embedding risk identification, assessment, and mitigation directly into the iterative and continuous processes of agile development and DevOps pipelines, ensuring that risk is managed proactively and continuously throughout the software development lifecycle.

• Shifts risk left (earlier in the lifecycle).
• Enables continuous feedback and adaptation.
• Aligns with the speed and flexibility of modern development.

Memory trick: For fast-paced change, risk must be baked in, not bolted on.

The process of formally documenting a significant identified risk and communicating it to relevant stakeholders, including project sponsors and governance bodies, along with proposed response options.

• Ensures transparency and informed decision-making.
• Critical for project and organizational governance.
• Facilitates appropriate resource allocation for risk response.

Memory trick: Find a risk? Document, tell, and plan, then let the leaders command.

The internal organizational mechanisms, such as oversight committees, established to ensure continuous monitoring, enforcement, and ultimate accountability for outsourced functions, particularly regarding critical areas like data security and regulatory compliance.

• Accountability cannot be fully outsourced.
• Requires active internal oversight.
• Ensures alignment with organizational standards and regulations.

Memory trick: Outsource the work, but keep the eyes and the buck stops here.

The application of XAI techniques to ensure that AI systems' decisions can be understood, audited, and justified, thereby supporting ethical governance, transparency, and accountability, especially in sensitive applications.

• Enhances trust and accountability in AI.
• Facilitates identification and mitigation of bias.
• Supports regulatory compliance and ethical oversight.

Memory trick: XAI is the AI's interpreter, showing its logic for trust and justice.

The formal arrangement of tasks, reporting relationships, and accountability within an organization, crucial for effective governance and risk management.

• Defines who is accountable for what.
• Impacts communication and decision-making.
• Needs to support risk management objectives.

Memory trick: Cross-train to keep the knowledge flowing.

The framework and principles guiding the responsible development, deployment, and use of artificial intelligence to ensure fairness, transparency, accountability, and prevention of harm.

• Addresses issues like bias, discrimination, and privacy.
• Ensures AI aligns with societal values and legal norms.
• Critical for maintaining trust and avoiding adverse impacts.

Memory trick: An AI's heart must be fair and ethical, not just smart.

An approach that integrates ethical considerations and principles directly into the design, development, and deployment of systems, especially AI, from the earliest stages, ensuring that ethical values are embedded into the technology's architecture and functionality.

• Proactive, not reactive, ethical management.
• Aims to prevent ethical issues before they arise.
• Crucial for AI and systems handling sensitive data.

Memory trick: To build a trustworthy AI, bake ethics into its very code, don't just sprinkle it on top later.

Formal approval and support from the board of directors for the Enterprise Risk Management (ERM) framework, policy, and risk appetite statement.

• Provides strategic mandate for ERM.
• Ensures ERM is integrated into governance.
• Demonstrates top-level commitment to risk management.

Memory trick: Remember, for ERM to stand tall like a monument, the Board must lay the first stone.

A governance approach characterized by continuous monitoring of the regulatory landscape, flexible internal policy development, and rapid adaptation to evolving legal requirements, particularly in fast-changing technological or market environments.

• Enables innovation while maintaining compliance.
• Essential for ambiguous or nascent regulatory fields.
• Requires continuous scanning and policy iteration.

Memory trick: Blockchain's blurred lines need agile eyes and adaptive policies.

A practice that integrates security and compliance automation into every phase of the software development lifecycle (SDLC), fostering a 'shift-left' approach to identify and mitigate vulnerabilities early and continuously.

• Security is continuous, not an afterthought.
• Automates security checks in CI/CD pipeline.
• Aligns with agile development principles.

Memory trick: Shift security left, integrate it right, keep it tight.

The process of identifying, disclosing, and mitigating situations where an individual's personal interests could improperly influence their professional judgment or actions within an organization.

• Disclosure is the first step.
• Recusal from conflicted decisions is key.
• Aims to preserve impartiality and integrity.

Memory trick: When money and duties meet, disclose and step back from the seat.

The process of ensuring that organizational risk appetite and tolerance are clearly communicated and integrated into the daily decision-making, behaviors, and objectives of all employees, fostering a shared understanding of appropriate risk-taking.

• Links risk appetite to daily actions.
• Promotes consistent risk behavior.
• Essential for strategic goal achievement.

Memory trick: Appetite for risk guides discovery's path.

The practice of embedding security and compliance policies, controls, and checks directly into the automated DevSecOps pipeline to ensure continuous enforcement and adherence from development through operations.

• Enables 'shift-left' security and compliance.
• Ensures continuous adherence to regulations.
• Reduces vulnerabilities and compliance gaps proactively.

Memory trick: Build security and compliance into the pipeline, don't just bolt it on at the end.

The board of directors provides strategic oversight, defines organizational direction, sets risk appetite, and ensures accountability, rather than engaging in day-to-day operational management.

• Sets strategic direction and risk appetite.
• Oversees management performance and compliance.
• Ensures long-term value creation and stakeholder protection.

Memory trick: The board is the captain, setting the course and watching the horizon, not steering the ship or checking the engine.

A governance strategy that harmonizes global corporate policies with diverse local legal and regulatory requirements, typically by establishing global minimum standards and allowing for stricter local adaptations.

• Ensures global consistency and local compliance.
• Balances corporate control with regional autonomy.
• Critical for managing compliance risk in multinational operations.

Memory trick: Build a bridge between global and local: strong foundations, flexible arches.

The process of embedding risk management activities and considerations directly into an organization's strategic planning, decision-making, and operational processes.

• Moves risk from a siloed function to a core business enabler.
• Ensures risk is considered proactively in all major initiatives.
• Helps align risk management with organizational objectives.

Memory trick: Strategic integration makes risk a business partner, not just a gatekeeper.

A comprehensive program designed to identify, assess, manage, and monitor risks associated with all external entities (e.g., vendors, suppliers, partners) that have access to an organization's systems, data, or processes.

• Holistic management of external risks.
• Includes assessment, monitoring, and oversight.
• Crucial for supply chain resilience.

Memory trick: Govern the entire chain, don't just patch a link.

The systematic process of identifying, assessing, and responding to risks throughout the entire project lifecycle, from initiation to closure, ensuring risk considerations are embedded in all project activities.

• Embeds risk activities into project phases.
• Ensures continuous risk monitoring and response.
• Proactive rather than reactive approach.

Memory trick: Link Risks Early, Often, and Always in Projects.

A framework for managing risk and opportunity across the entire organization, aligning with strategic objectives.

• Involves all levels of the organization.
• Integrates risk management into strategic planning.
• Aims to enhance value creation and protection.

Memory trick: First, set the appetite before you feast on risks.

The amount and type of risk that an organization is willing to pursue or retain in the pursuit of its strategic objectives.

• Set by the board and senior management.
• Guides decision-making across all levels of the organization.
• Forms the foundation for effective enterprise risk management.

Memory trick: Appetite First, Then the Rest, Build on Trust.

The initial, essential elements of organizational governance that establish structure, accountability, and decision-making processes for a nascent or growing entity.

• Provides clarity on who is responsible for what.
• Enables efficient decision-making and resource allocation.
• Forms the basis for scaling operations and implementing other governance components.

Memory trick: Startup's Start, Roles Impart, Governance Heart.

The amount and type of risk that an organization is willing to pursue or retain. It guides decision-making and resource allocation.

• Set by the board and senior management.
• Expressed qualitatively and quantitatively.
• Influences strategic planning and operational decisions.

Memory trick: Appetite's compass guides strategic ships.

The systematic process of embedding risk management activities (identification, analysis, response planning, monitoring) into all phases and aspects of a project's lifecycle to ensure that potential threats and opportunities are continuously addressed.

• Risk is an ongoing consideration, not a one-time event.
• Involves all project stakeholders.
• Aims to minimize negative impacts and maximize positive outcomes.

Memory trick: A project manager ensures risk management is a thread woven through the entire project tapestry.

The process of justifying security investments to senior leadership (e.g., board) by translating technical benefits into tangible business value, including risk reduction, financial impact mitigation, and alignment with strategic organizational objectives.

• Focuses on business outcomes, not just technical features.
• Quantifies financial and reputational impacts.
• Aligns security with strategic goals for board approval.

Memory trick: For the board, security ROI means linking tech to business gain and strategic aim.

A structured system of policies, processes, and responsibilities that ensures data is managed, used, and protected in an ethically responsible manner throughout its lifecycle, beyond mere legal compliance.

• Guides all data handling decisions.
• Integrates ethics into data lifecycle.
• Proactive and comprehensive approach.

Memory trick: Govern data ethically, from its birth to its grave.

A comprehensive investigation into a target entity's ethical practices, culture, and compliance history during a merger, acquisition, or partnership.

• Identifies potential reputational, legal, and operational risks.
• Informs decision-making regarding the viability and terms of a transaction.
• Ensures alignment with the acquiring organization's ethical standards and risk appetite.

Memory trick: Merge with Care, Ethics Beware, Dig Deeper, Don't Despair.

The process of ensuring that external vendors' and partners' risk management practices, policies, and controls align with an organization's own internal standards and risk appetite.

• Internal policies may exceed regulatory minimums.
• Negotiation is a key tool in third-party risk management.
• Proactive alignment reduces overall organizational risk.

Memory trick: Always align your partners' shields to your kingdom's standards.

A governance strategy for multinational organizations that combines global overarching principles (e.g., ethics, reporting) with the flexibility for local business units to develop and implement specific policies and procedures tailored to regional legal, regulatory, and cultural contexts.

• Balances global consistency with local relevance.
• Crucial for compliance in diverse international markets.
• Protects brand reputation and avoids legal penalties.

Memory trick: Go global with ethics, go local with rules, keep the brand shining.

Obligations arising from laws, government regulations, and agreements that an organization must adhere to, impacting its risk posture.

• Vary significantly by industry and geography.
• Non-compliance can lead to fines, reputational damage, and legal action.
• Require continuous monitoring and adaptation.

Memory trick: Assess the laws before crossing borders.

The process of disseminating the board-approved risk appetite statement across the organization to guide decision-making at all levels.

• Ensures alignment of strategic goals with risk tolerance.
• Translates high-level strategy into actionable guidance.
• Fosters a unified risk culture.

Memory trick: Board's Appetite needs to be digested by everyone from top to bottom.

Communicating risks to the board of directors in a manner that connects them directly to strategic business objectives and the organization's overall risk appetite.

• Focuses on 'why it matters' to the business.
• Avoids excessive technical detail.
• Enables strategic decision-making and resource allocation.

Memory trick: Report to the Board like you're talking to the 'Captains of the Ship' – focus on the destination, not every wave.

A set of policies and procedures tailored to meet the specific legal, regulatory, and cultural requirements of a particular geographic region or jurisdiction, while remaining consistent with an organization's overarching global governance principles.

• Balances global consistency with local compliance.
• Addresses unique regional legal and cultural nuances.
• Essential for multinational corporations operating in diverse environments.

Memory trick: Think globally, act locally – policies must flex to fit the regulatory map.

The practice of using robust contractual agreements, such as Data Processing Agreements (DPAs) and specific security clauses, to ensure compliance with an organization's home jurisdiction's data protection laws when processing data in a jurisdiction with less stringent regulations.

• Crucial for legal and regulatory compliance.
• Maintains data subject trust.
• Mitigates risks associated with varying international laws.

Memory trick: When cloud laws differ, contractually bind for safety and trust.

The adherence to legal and regulatory requirements stipulating that certain data must be stored and processed within the geographical borders of a specific country or jurisdiction.

• Driven by national security, privacy, or economic policies.
• Often requires physical infrastructure within the country.
• A key consideration for global data architecture and cloud strategies.

Memory trick: When local laws demand data stays home, you build a local home for the data.

An approach that embeds ethical considerations and principles into the entire lifecycle of technology development, from conception and design to implementation and operation, ensuring responsible innovation.

• Proactive ethical integration.
• Addresses societal, privacy, and bias concerns.
• Goes beyond mere compliance.

Memory trick: Design ethics into the AI, don't just patch it later.

The practice of embedding compliance requirements and controls directly into business processes and IT systems, often through automation, to ensure consistent and continuous policy adherence.

• Reduces reliance on manual adherence.
• Makes compliance an inherent part of operations.
• Strengthens governance by enforcing policies systematically.

Memory trick: Don't just 'Tell' people the rules; 'Build' the rules into their tools.

The core purpose of Enterprise Risk Management (ERM) is to integrate risk and opportunity management across an organization to enhance strategic planning and objective achievement.

• Holistic view of risk and opportunity.
• Supports strategic decision-making.
• Goes beyond mere compliance or tactical fixes.

Memory trick: ERM is the compass for the whole enterprise, guiding strategic success.

The professional duty to report significant risks, ethical breaches, or non-compliance to appropriate higher authorities within an organization when direct resolution is not possible or sufficient.

• Protects the organization from undue risk.
• Upholds professional integrity and ethics.
• Ensures informed decision-making at appropriate levels.

Memory trick: When the ethical alarm blares, the CISO's duty is to signal UP.

The systematic process of embedding risk management activities throughout all phases of a project's lifecycle, from initiation to closure.

• Ensures proactive identification and mitigation of project risks.
• Aligns project execution with organizational risk appetite.
• Prevents late-stage surprises and costly rework.

Memory trick: Project's Path, Risks' Wrath, Integrate to Last.

The shared attitudes, values, and beliefs that shape risk-taking behavior and risk management practices within an organization.

• Influences how employees identify, assess, and respond to risks.
• Driven by leadership and reinforced through communication and incentives.
• Crucial for effective risk management and governance.

Memory trick: Communicate the 'why' to grow the culture.

The system of rules, practices, and processes by which an organization directs and controls its supply chain activities to achieve strategic objectives while managing risks.

• Ensures ethical, environmental, and social compliance across the supply chain.
• Mitigates risks associated with third-party vendors.
• Includes mechanisms for monitoring, auditing, and enforcement of standards.

Memory trick: Green Chain, Clean Gain, Audit to Maintain.

The practice of creating an overarching global governance framework that provides core principles, while simultaneously enabling the development of localized policies and procedures to meet specific regional legal, regulatory, and cultural requirements.

• Balances global consistency with local adaptability.
• Essential for multinational organizations operating in diverse regulatory environments.
• Prevents over-regulation and fragmentation.
• Ensures compliance while maintaining operational efficiency.

Memory trick: Think global, act local, but with a bridge in between.

The system by which an organization is directed and controlled. It encompasses the framework of authority, accountability, and oversight.

• Ensures objectives are achieved.
• Provides oversight for risk management.
• Includes roles, policies, and processes.

Memory trick: Integrate risk, don't separate it from agile.

The moral principles that govern the collection, use, protection, and sharing of patient data, particularly in highly sensitive contexts like clinical trials.

• Prioritizes patient privacy, autonomy, and well-being.
• Requires strict adherence to regulations like GDPR and HIPAA.
• Informs decisions on data security, sharing, and consent.

Memory trick: Patient's Trust, Data Must, Secure it First, No Bust.

A hierarchical set of documented guidelines that define an organization's rules, mandatory requirements, and detailed steps for performing specific tasks to ensure consistency, compliance, and effective risk management.

• Policies: High-level statements of intent.
• Standards: Mandatory requirements for implementing policies.
• Procedures: Detailed, step-by-step instructions for tasks.

Memory trick: Without clear PSPs, operations become a chaotic choose-your-own-adventure.

The practice of embedding enterprise-level risk management processes and oversight directly into project governance structures, such as gate reviews, to ensure that project-specific risks are managed in alignment with the organization's overall risk appetite and strategic objectives.

• Connects project risk to enterprise risk.
• Provides formal checkpoints for risk review and decision-making.
• Aims for a balance between project delivery and organizational risk tolerance.

Memory trick: To bridge project speed with enterprise safety, build risk checkpoints into the project's journey.

The process of adapting an organization's global policies and procedures to meet specific local legal, regulatory, and cultural requirements, while maintaining alignment with the overall enterprise governance framework.

• Balances global consistency with local compliance.
• Addresses unique regional laws and customs.
• Prevents over-compliance or under-compliance.

Memory trick: Think globally, act locally, but link the two tightly.