ISACA IT Risk Fundamentals Certificate: key terms

Flashcards for this exam ISACA IT Risk Fundamentals Certificate guide

• Enterprise Risk Management (ERM)Organization-wide approach to identifying, assessing, and managing all risks to achieve objectives.Intermediate
• Factor Analysis of Information Risk (FAIR)Open quantitative model that decomposes risk into loss event frequency and loss magnitude for financial analysis.Advanced
• ImpactThe magnitude of harm or consequence if a risk event occurs.Foundational
• Inherent RiskLevel of risk before any controls or treatments are applied.Intermediate
• Key Risk Indicator (KRI)Metric that provides early warning of increasing risk exposure.Intermediate
• LikelihoodThe chance or probability that a risk event will occur within a time frame.Foundational
• Monte Carlo SimulationStatistical technique that runs many randomized iterations over input ranges to produce a probability distribution of outcomes.Advanced
• Qualitative Risk AnalysisRisk analysis that ranks risks using descriptive scales such as low, medium, and high rather than monetary values.Intermediate
• Quantitative Risk AnalysisRisk analysis that assigns numeric, usually monetary, values to assets, impacts, and probabilities.Intermediate
• RiskThe combination of the likelihood of an event and its impact on objectives; in security, a threat exploiting a vulnerability to harm an asset.Foundational
• Risk AnalysisProcess of comprehending the nature of risk and determining its level by considering likelihood and impact.Foundational
• Risk AppetiteBroad amount and type of risk an organization is willing to pursue or retain to achieve its objectives.Foundational
• Risk CapacityMaximum amount of risk an organization can absorb before its viability or objectives are seriously threatened.Intermediate
• Risk EvaluationComparing analyzed risk levels against risk criteria to decide which risks need treatment and in what priority.Intermediate
• Risk IdentificationProcess of finding, recognizing, and describing risks that could affect objectives.Foundational
• Risk IT FrameworkISACA framework addressing IT-related business risk, organized into risk governance, risk evaluation, and risk response domains.Advanced
• Risk ProfileSnapshot description of the overall set of risks an organization or unit faces at a point in time.Intermediate
• Risk ScenarioDescription of a plausible event in which a threat exploits a vulnerability to cause a specific business impact.Intermediate
• Risk ToleranceAcceptable variation around objectives or risk appetite for a specific risk or category.Foundational
• Semi-Quantitative Risk AnalysisHybrid approach that assigns numeric scores to qualitative scales to rank and combine risks.Intermediate
• ThreatAny potential cause of an unwanted incident that may harm an asset, such as an actor, event, or circumstance.Foundational
• VulnerabilityA weakness in an asset, control, or process that a threat could exploit.Foundational