CRISC Certified in Risk and Information Systems ControlGovernanceMedium
A Chief Information Officer (CIO) is preparing to present the annual IT risk posture to the board of directors. The board has expressed concerns about the increasing complexity of IT risks and their potential impact on the organization's strategic objectives. To ensure the presentation is effective and supports strategic decision-making, what should be the CIO's PRIMARY focus when reporting IT risks to the board?
- APresenting IT risks in the context of their potential impact on strategic business objectives and the organization's risk appetite.
- BFocusing on the number of security incidents handled by the IT team over the past year.
- CProviding a detailed list of all identified technical vulnerabilities and their CVSS scores.
- DOutlining the specific technical controls implemented to mitigate each IT risk.
Show answer & explanationAnswer & explanation
Correct answer: A. Presenting IT risks in the context of their potential impact on strategic business objectives and the organization's risk appetite.
The board is primarily concerned with strategic implications and overall organizational health. Reporting IT risks in the context of strategic business objectives and the organization's risk appetite helps the board understand the 'so what' of IT risks and enables them to make informed strategic decisions.
Why the other options are wrong
- B. While incident metrics provide operational insight, they don't directly link to strategic objectives or the board's need for high-level risk understanding.
- C. Detailed technical vulnerabilities and CVSS scores are too granular for a board-level discussion, which focuses on strategic impact.
- D. Outlining specific controls is too operational and detailed for the board; their focus is on whether risks are managed appropriately at a strategic level, not the minutiae of control implementation.
Strategic Risk Reporting for Boards
Communicating risks to the board of directors in a manner that connects them directly to strategic business objectives and the organization's overall risk appetite.
- Focuses on 'why it matters' to the business.
- Avoids excessive technical detail.
- Enables strategic decision-making and resource allocation.
Memory trick: Report to the Board like you're talking to the 'Captains of the Ship' – focus on the destination, not every wave.