CRISC Certified in Risk and Information Systems Control All-in-One Exam Guide, Second Edition, 2nd Edition

APPENDIX A

Implementing and Managing a Risk Management Program

This appendix takes a more pragmatic view of building and managing a risk management program. Rather than the somewhat academic view in the CRISC job practice, we draw directly from our experience building several risk management programs in our careers.

We have built or improved numerous risk management processes and programs between the three of us. The process and technique are not overly complicated. The most challenging part of building a risk management process is figuring out how to engage with executives in the organization—so that they understand what the process is all about and participate meaningfully. After all, it’s their business, and we just want to make sure they ...