Risk Implementation
About 25% of the CIS-RC exam — see all 7 domains.
Risk Management identifies, assesses, monitors, and responds to risk across the scoped enterprise.
Risk framework. A risk framework groups risk statements into manageable categories so large risk libraries stay organized. You associate risk statements to a framework. It does not define scoring: scales and thresholds come from risk criteria in classic risk, or from a risk assessment methodology (RAM) in Advanced Risk.
Risk statement. A reusable definition of a potential risk ("the thing that could happen"), independent of where it applies. Associating risk statements (or a risk framework) with an entity type generates risks (instances), one per risk statement per entity, in the risk register.
Risk (register). A risk is the scoped instance of a risk statement tied to an entity, tracked in the risk register with owner, scores, treatment, and lifecycle state.
Risk assessment / scoring. Risk is evaluated typically on inherent vs residual dimensions using likelihood × impact (significance) to produce a risk score. Methodologies can be qualitative (scales like Low/Med/High) or quantitative (numeric/monetary). Risk appetite and tolerance thresholds determine whether a risk is acceptable.
Risk assessment methodologies. Classic risk assessments use questionnaires built in the Risk Assessment Designer. Advanced Risk Assessment uses a risk assessment methodology (RAM) that defines the assessment types (inherent, control effectiveness, residual, target), the factors (manual, automated, scripted, group), scoring logic, and rating criteria; residual risk can be calculated from inherent risk and control effectiveness. Indicator results can also update risk scores. Reassessment can be scheduled (reassessment frequency, risk assessment scheduler).
Indicators and KRIs.
- Indicators are automated or manual tests/measurements attached to controls or risks; they pull data from the platform (or external sources) to evaluate effectiveness or exposure on a schedule.
- Control indicators evaluate control effectiveness; risk indicators measure risk exposure.
- Key Risk Indicators (KRIs) are higher-level metrics that signal changing risk levels against thresholds; breaches can trigger alerts, tasks, or risk re-scoring. (Note: ServiceNow also uses GRC Metrics in IRM for broader periodic trend tracking, distinct from real-time indicators.)
Risk response / treatment. For each risk: Accept, Avoid, Mitigate (treat), or Transfer. Mitigation links to controls and remediation; issues capture problems needing action.
Advanced Risk and continuous monitoring. GRC: Advanced Risk extends core Risk with Advanced Risk Assessment (RAMs; qualitative, semi-quantitative, and quantitative scoring such as ALE; score roll-up across risk statement and entity hierarchies), risk appetite and tolerance, and target risk assessment. Continuous monitoring for risks is a separate integration between Risk Management and Security Operations Vulnerability Response that uses indicators to flag high-impact vulnerabilities between formal assessments.
Exam gotchas:
- Risk statement = definition; Risk = scoped instance in the register (parallels objective→control).
- Inherent (before controls) vs residual (after controls) risk.
- KRI = threshold-based signal; indicator = the underlying automated/manual measurement.
Sample questions from this domain
Three of the 75 in this domain, with the reasoning. The full set is in the question bank.
In Risk Management, what is the risk register?
- A. The risk library that holds the risk frameworks and the risk statements
- B. The list of risk events that records the losses and near misses that occurred
- C. The central repository of identified risks tracked by the organization ✓
- D. The risk statement hierarchy used to roll scores up across risk types
Why: The risk register is the central repository for all potential risks that could occur anywhere in the organization. The risk frameworks and risk statements sit in the risk library, which is a separate construct from the register of risks. Losses and near misses are recorded as risk events, not as the register itself. A risk statement hierarchy rolls assessed scores up across risk types such as operational or IT risk; it is a scoring and reporting structure, not the repository of risks.
What is a risk statement in Risk Management?
- A. A grouping of related risk definitions into manageable categories within the risk library
- B. A specific risk recorded against one entity, with its own owner, scores, and risk response
- C. A reusable definition of a risk that can be applied to entities to create specific risk records ✓
- D. A potential or actual loss, near miss, or gain that is recorded after an event occurs in the business
Why: A risk statement (table sn_risk_definition) is a reusable definition of a risk; associating it with entity types generates specific risk records on the entities. Grouping risk statements into manageable categories is the job of a risk framework. A specific risk on one entity with its own owner, scores and response is a risk record (sn_risk_risk) generated from the statement. A loss, near miss or gain recorded after something happens is a risk event.
How is inherent risk generally distinguished from residual risk?
- A. Inherent risk is the risk remaining after controls; residual risk is the level the organization aims to reach
- B. Inherent risk is the risk before controls/mitigation; residual risk is the risk remaining after controls are applied ✓
- C. Inherent risk is the risk before controls; residual risk is the desired level expected after planned responses
- D. Inherent risk is the score from the first assessment; residual risk is the score from the latest reassessment
Why: Inherent risk is the risk before controls or mitigation are considered, and residual risk is the risk that remains after controls are applied (in Advanced Risk, calculated from inherent risk and control effectiveness). Describing residual risk as the desired level expected after planned responses confuses it with target risk, the optimum level the organization aims to reach once its action plan is executed. Calling inherent risk the post-control value reverses the definitions. The difference is about whether controls are considered, not about which assessment cycle produced the score.