CRISC · Domain 1 of 4

CRISC Domain 1: Governance

Governance decides who owns risk, how much of it the enterprise will carry, and which rules it must follow. Every later CRISC answer is judged against those decisions, so this is where the exam's logic is set.

Exam weight
26%
Official subtopics
11
Estimated questions estimate
~39
Suggested study time estimate
35–45 hrs

About 19 min read Reviewed October 2026

Overview

Domain 1 covers the business context a risk practitioner works inside. Part A, organizational governance, is about the enterprise itself: its strategy and objectives, structure and accountabilities, culture and ethics, policies and standards, business processes and their resilience, and the assets it depends on. Part B, risk governance, is about how risk is directed and overseen: enterprise risk management, the lines of defense, the risk profile, risk appetite and tolerance, and the frameworks, laws, regulations and contracts that set the rules.

The domain exists because IT risk only means something in relation to business objectives. A vulnerability is a low priority if it threatens nothing the enterprise cares about, and a severe one if it threatens a revenue line. Domain 2 assesses risk against the appetite and asset values set here. Domain 3 decides responses using the ownership model set here. Domain 4 applies the policies and standards set here to technology.

How it's tested

Domain 1 questions are short business scenarios written from the risk practitioner's seat. They ask what you should do FIRST, what is MOST important, or who is PRIMARILY responsible. The options usually mix one governance action with several plausible technical or operational actions. Most of the work is spotting which role the question puts you in and what that role can actually decide.

  • Who decides?

    The scenario describes a risk decision and asks who should make it. The answer is almost always the accountable business owner or senior management, not IT, audit or the risk practitioner.

  • Alignment check

    A proposal, control or project is described and you must find the MOST important consideration. Alignment with business objectives and risk appetite usually beats cost, technical elegance or industry popularity.

  • Framework or obligation fit

    You are asked which requirement applies, or what to do when a law, contract and internal policy pull in different directions. You need to tell mandatory obligations from internal choices.

Reasoning it through

A department adopts a cloud tool without approval, and you find it holds customer data. Before reaching for blocking the tool, ask what governance requires. The risk must be identified, assigned to an owner and compared with appetite. The best FIRST step is usually to assess the risk and raise it with the accountable business owner so a decision can be made. Shutting the tool down on your own authority goes beyond the practitioner's role.

Subtopics 11

Official subtopics from the ISACA outline, in outline order.

1.A.1 Strategy, Goals, and ObjectivesRisk management exists to protect and enable what the enterprise is trying to achieve.
What it means
Strategy sets the direction, goals turn it into targets, and objectives make those targets specific and measurable. IT risk is defined by its potential effect on those objectives.
What to understand
Before you can rate a risk you need to know which objective it threatens. A risk program that cannot trace its priorities back to business objectives is not aligned, however technically thorough it is.
How it shows up
Questions ask for the MOST important input to a risk assessment or a new risk program. Understanding business objectives usually beats listing threats or vulnerabilities first.
Common confusion
Candidates treat security goals as the objectives. In CRISC, security and risk goals support business objectives and do not replace them.
1.A.2 Organizational Structure, Roles, and ResponsibilitiesWho is accountable for what, and how risk decisions flow through the organization.
What it means
The structure sets reporting lines, decision rights and accountability. Typical roles are the board, executive management, risk committees, business process owners, risk owners, control owners, the CISO, the risk function and internal audit.
What to understand
Accountability for a risk sits with the business owner who benefits from the activity creating it. The risk practitioner facilitates, analyzes and advises but does not own business risk. The board and senior management set direction and appetite.
How it shows up
A scenario describes a decision about accepting, funding or treating a risk and asks who should make it, or what is wrong with how it was made.
Common confusion
Mixing up responsibility with accountability. Many people can be responsible for doing work on a risk, but only one owner is accountable for the outcome.
1.A.3 Organizational Culture and EthicsThe shared behaviors that decide whether risk is reported, discussed and acted on.
What it means
Culture is how people actually behave around risk, as opposed to what policy says. Ethics covers the integrity expected of staff and of the risk practitioner, including honest reporting.
What to understand
A risk-aware culture surfaces problems early. A blame culture hides them, which makes every risk report less reliable. Tone at the top, meaning visible leadership behavior, shapes culture more than training does.
How it shows up
You see a symptom such as incidents going unreported, risks always rated low, or managers quietly overriding controls, and must find the underlying cause or the best corrective action.
Common confusion
Treating culture as a training problem. Training raises awareness, but culture changes when leadership behavior and incentives change.
1.A.4 Policies and StandardsThe documents that turn governance intent into enforceable requirements.
What it means
Policies state management's intent and are approved at a senior level. Standards set specific mandatory requirements that support a policy. Procedures give step-by-step instructions, and guidelines are advisory.
What to understand
Policies should be stable, high-level and aligned with business objectives and appetite. When a policy cannot be met, the answer is a formal exception process, not quiet non-compliance or rewriting the policy to fit one case.
How it shows up
A question names a document and asks what kind it is, who should approve it, or the BEST response when a business unit cannot comply.
Common confusion
Putting technical detail, such as a specific encryption algorithm, into a policy. That detail belongs in a standard, so the policy does not need rewriting every time technology changes.
1.A.5 Business Processes and Resilience (e.g., DRP, BCP)Understanding how the business runs and how it keeps running through disruption.
What it means
Business processes are the chains of activity that deliver value, and resilience is their ability to absorb and recover from disruption. Business continuity planning (BCP) keeps critical business functions running. Disaster recovery planning (DRP) restores the technology those functions depend on.
What to understand
Resilience starts with knowing which processes are critical and what they depend on: people, technology, facilities and third parties. A DRP is a component of continuity, not a substitute for a BCP.
How it shows up
Questions ask what should drive recovery priorities, or what is missing when IT recovers systems quickly but the business still cannot operate.
Common confusion
Using BCP and DRP interchangeably. Restoring servers does not restore a business process if staff, suppliers or workspace are unavailable.
1.A.6 Organizational Asset ManagementKnowing what the enterprise owns, what it is worth and who is responsible for it.
What it means
Asset management covers identifying, classifying, valuing and assigning ownership for information, systems, hardware, software, people and facilities across their life cycle.
What to understand
An accurate inventory with owners and business value is a precondition for risk assessment. Value comes from the asset's importance to business processes, not its purchase price.
How it shows up
A scenario reveals unknown or unowned assets, such as shadow IT or orphaned data, and asks what should happen FIRST or what the root problem is.
Common confusion
Valuing an asset by replacement cost alone. A cheap database can be extremely valuable because of the process it supports or the data it holds.
1.B.1 Enterprise Risk Management (ERM)Managing all types of risk in one integrated, enterprise-wide approach.
What it means
ERM brings strategic, financial, operational, compliance and IT risk into one view, so leadership can compare and prioritize risks consistently against objectives and appetite.
What to understand
IT risk management should feed into ERM using shared terminology, rating scales and reporting, not run as a separate silo. Integration lets leaders trade an IT risk off against a market or credit risk on equal terms.
How it shows up
Questions ask for the MAIN benefit of integrating IT risk into ERM, or what goes wrong when IT uses different rating scales from the rest of the enterprise.
Common confusion
Thinking ERM means one central team manages every risk. ERM is a consistent approach and a consolidated view. Ownership stays with the business.
1.B.2 Lines of DefenseSeparating who owns risk, who oversees it and who independently assures it.
What it means
The first line is operational management, which owns and manages risk day to day. The second line provides oversight, frameworks and challenge, for example risk management and compliance. The third line, usually internal audit, provides independent assurance to the board.
What to understand
Each line has a distinct job, and the model breaks down when one line does another's work. The clearest example is internal audit designing or running the controls it later audits. The Institute of Internal Auditors updated this concept as the Three Lines Model in 2020, but the outline's term is lines of defense.
How it shows up
A scenario shows a role overlap and asks what is wrong, or asks which line a given activity belongs to.
Common confusion
Placing the risk practitioner in the first line. The risk function is normally a second-line role that supports and challenges the business owners who sit in the first line.
1.B.3 Risk ProfileThe overall picture of the risk the enterprise is carrying at a point in time.
What it means
The risk profile summarizes current exposure across the enterprise, drawn from the risk register and other sources and aggregated so leadership can see the whole.
What to understand
The profile changes as the business, threats and controls change, so it must be kept current. Comparing the profile with risk appetite shows leadership where exposure is above or below what it wants.
How it shows up
Questions ask which event should trigger a profile update, such as an acquisition, a new market or a major system change, or what the profile is used for.
Common confusion
Treating the risk profile and the risk register as the same thing. The register is the detailed list. The profile is the aggregated view built from it.
1.B.4 Risk Appetite and Risk ToleranceHow much risk leadership will accept, and how far actual results may vary from that.
What it means
Risk appetite is the broad amount of risk the enterprise is willing to accept in pursuit of its objectives, set by the board and senior management. Risk tolerance is the acceptable variation around that appetite for specific objectives or risk types, often expressed as measurable thresholds.
What to understand
Appetite is strategic and owned by leadership. Tolerance makes it operational and measurable. Both must stay within risk capacity, which is the most loss the enterprise can absorb. When exposure exceeds tolerance, escalation is required.
How it shows up
A KRI crosses a threshold, or a project's assessed risk sits above appetite, and you must choose the next step. That is usually escalation to whoever holds the authority, not unilateral acceptance or blocking.
Common confusion
Using appetite and tolerance as synonyms, or believing the risk practitioner sets appetite. The practitioner helps stakeholders choose thresholds. Leadership sets them.
1.B.5 Risk Frameworks, Legal, Regulatory, and Contractual RequirementsThe external and adopted rule sets that shape how risk is managed.
What it means
Frameworks such as COBIT, ISO 31000 and the NIST risk publications give structure and common language. Laws and regulations impose mandatory obligations. Contracts impose obligations the enterprise agreed to, such as customer security clauses or card-industry requirements.
What to understand
Frameworks are adopted and tailored, while legal and contractual obligations must be met. Compliance sets a floor and does not prove that risk is within appetite. A framework should fit the enterprise's size, sector and objectives rather than be applied wholesale.
How it shows up
Questions ask what a new regulation should trigger FIRST, usually a gap assessment against current practice. Others ask how to tell a legal obligation from a contractual one.
Common confusion
Treating PCI DSS as a law. It is an industry standard enforced through contracts with card brands and acquiring banks, so the obligation is contractual unless a jurisdiction has written it into law.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Risk appetite

    The broad amount of risk the enterprise is willing to pursue or retain to meet its objectives.

    Remember
    Set by the board and senior management. The risk practitioner advises but does not set it.
    Tested as
    It is the yardstick for most decisions in Domains 1 and 3.
    Trap
    Choosing an answer in which IT or the risk function defines appetite.

  • Risk tolerance

    The acceptable deviation from appetite for a particular objective, often expressed as a measurable threshold.

    Remember
    Tolerance turns appetite into numbers that can be monitored, often through KRIs.
    Tested as
    A breached threshold should lead to escalation.
    Trap
    Reading tolerance as permission to ignore anything below appetite.

  • Risk capacity

    The largest loss the enterprise can absorb before its survival or core objectives are threatened.

    Remember
    Appetite must sit at or below capacity.
    Tested as
    Explains why appetite cannot simply be raised to make a risky project acceptable.
    Trap
    Confusing capacity, an objective limit, with appetite, a leadership choice.

  • Risk owner

    The person accountable for managing a risk and for deciding how to respond to it.

    Remember
    Usually the senior business manager who benefits from the activity that creates the risk.
    Tested as
    The default answer to 'who should accept this risk?'
    Trap
    Picking the CISO, IT manager or risk practitioner as the owner of a business risk.

  • Governance vs. management

    Governance evaluates options, sets direction and monitors results. Management plans, builds, runs and monitors activities within that direction.

    Remember
    In COBIT 2019, governance is the board's evaluate-direct-monitor role, and management carries out the work.
    Tested as
    Helps you see which level a decision belongs at.
    Trap
    Choosing an operational management answer for a question about setting direction.

  • Lines of defense

    Owning and managing risk (first line), overseeing and challenging it (second), and independently assuring it (third).

    Remember
    Internal audit must not design or run the controls it audits.
    Tested as
    Questions about role conflicts and independence.
    Trap
    Accepting internal audit sign-off as a substitute for first-line ownership.

  • Risk profile

    The aggregated view of current enterprise risk exposure.

    Remember
    Built from the register, compared against appetite, and updated when the business changes.
    Tested as
    Mergers, new markets and major changes should trigger an update.
    Trap
    Treating it as a static annual document.

  • Tone at the top

    The attitude toward risk and control that leadership shows through its actions.

    Remember
    It drives culture more strongly than policies or training.
    Tested as
    It is the root cause behind many culture scenarios.
    Trap
    Picking more awareness training when the scenario shows leaders overriding controls.

  • Policy exception

    A formally approved, documented and time-bound deviation from a policy requirement.

    Remember
    Exceptions need a risk assessment, approval from someone with authority, compensating controls where possible, and an expiry date.
    Tested as
    It is the correct response when a business unit cannot comply.
    Trap
    Rewriting the policy for one unit, or tolerating informal non-compliance.

  • BCP vs. DRP

    BCP keeps critical business functions running. DRP restores the IT services they depend on.

    Remember
    DRP is a subset of continuity, and business priorities drive both.
    Tested as
    Resilience scenarios in Part A.
    Trap
    Assuming fast system recovery means the business has recovered.

  • Contractual vs. regulatory obligation

    Regulatory obligations come from law or regulators. Contractual obligations come from agreements the enterprise signed.

    Remember
    Both are binding, but they have different sources, enforcement routes and consequences.
    Tested as
    Questions that ask you to classify a requirement.
    Trap
    Calling an industry standard enforced by contract a law.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Risk appetite vs. risk tolerance vs. risk capacity

ConceptMeaningKey differenceCommon trap
Risk appetite How much risk leadership is willing to take in pursuit of objectives A strategic choice made by the board and senior management Assuming the risk function sets it
Risk tolerance The acceptable variation around appetite for a specific objective or risk Operational and measurable, often monitored through KRI thresholds Using it as a synonym for appetite
Risk capacity The largest loss the enterprise can absorb and still survive An objective limit, not a preference Thinking leadership can raise it by deciding to

First vs. second vs. third line

ConceptMeaningKey differenceCommon trap
First line Business and operational management that owns and manages risk Owns the risk and runs the controls Handing risk ownership to the risk function
Second line Risk management, compliance and similar oversight functions Sets frameworks, monitors and challenges, but does not own business risk Second-line staff accepting risk on the business's behalf
Third line Internal audit Provides independent assurance to the board and audit committee Audit designing controls and then auditing them

Policy vs. standard vs. procedure vs. guideline

ConceptMeaningKey differenceCommon trap
Policy Management's high-level statement of intent Mandatory and approved at a senior level Filling it with technical detail that ages quickly
Standard A specific requirement that supports a policy Mandatory and measurable Treating it as optional advice
Procedure Step-by-step instructions for doing a task Mandatory and operational Confusing the how (procedure) with the what (standard)
Guideline Recommended practice Advisory, not mandatory Enforcing it as if it were a standard

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. The practitioner makes the call

    What candidates pick
    The risk practitioner accepts the risk, approves the exception or blocks the activity.
    Why it looks right
    The practitioner is the person in the scenario, and acting decisively feels responsible.
    Why it's wrong
    CRISC treats the practitioner as an adviser and facilitator. Risk decisions belong to the accountable owner or senior management.

    Clue to watch for If the option has 'you' deciding on behalf of the business, look for one that informs or escalates to the owner instead.

  2. Technical fix first

    What candidates pick
    Deploy a control, patch, tool or configuration change right away.
    Why it looks right
    It directly reduces exposure and looks like progress.
    Why it's wrong
    Without knowing the business objective, owner and appetite, you cannot tell whether the control is needed, proportionate or approved.

    Clue to watch for Words such as FIRST or MOST important with a new initiative usually point to understanding objectives or assessing the risk before treating it.

  3. Compliance equals safety

    What candidates pick
    The option that achieves regulatory compliance, presented as proof that risk is managed.
    Why it looks right
    Compliance is concrete and auditable, and failing it has obvious consequences.
    Why it's wrong
    Regulations set minimum requirements for a general population. The enterprise's actual risk may still sit outside its appetite.

    Clue to watch for If the scenario mentions risk that remains after compliance is achieved, the answer goes beyond compliance.

  4. Audit owns the control

    What candidates pick
    Ask internal audit to design, implement or run a control because it understands controls well.
    Why it looks right
    Audit has the expertise and is often available.
    Why it's wrong
    It destroys the independence that makes third-line assurance worth anything.

    Clue to watch for Any option in which audit builds what it will later assess is a lines-of-defense violation.

  5. Training fixes culture

    What candidates pick
    Run more security awareness training.
    Why it looks right
    It is the familiar answer for people problems, and it is cheap and visible.
    Why it's wrong
    If leaders override controls or punish people who report problems, training will not change behavior. The cause is tone at the top or incentives.

    Clue to watch for Look for who is behaving badly. If it is management, the fix is a governance one.

  6. Rewrite the policy

    What candidates pick
    Change the policy so a business unit that cannot comply becomes compliant.
    Why it looks right
    It removes the conflict quickly.
    Why it's wrong
    Policies reflect enterprise intent and appetite. One unit's difficulty calls for a documented, approved, time-bound exception with compensating controls.

    Clue to watch for A single unit or system cannot comply. That points to an exception, not a policy change.

  7. Contract treated as law

    What candidates pick
    Classify an industry standard enforced through agreements as a regulatory requirement.
    Why it looks right
    Such standards are widely mandated and feel like law.
    Why it's wrong
    The source of the obligation determines who enforces it and what the consequences are. Contractual obligations come from agreements, not statutes.

    Clue to watch for Watch for words such as 'agreement', 'merchant', 'customer contract' or 'service provider'.

Answer framework

For any Domain 1 governance scenario, work through these steps before choosing an answer.

  1. Identify the business objective or process the scenario puts at stake, because risk is only meaningful relative to what the enterprise is trying to achieve.
  2. Determine whose decision this is: the accountable risk owner, senior management or the board, rather than IT, audit or yourself as practitioner.
  3. Compare the situation with the defined risk appetite and tolerance thresholds, and note any gap between current exposure and those limits.
  4. Check which obligations apply, separating legal and regulatory requirements from contractual commitments and from internal policy choices.
  5. Choose the option that informs, escalates or structures the decision through proper governance channels, and reject options where someone acts outside their role.

Practice question

A product team plans to launch a customer-facing service next month. The risk practitioner's assessment shows its residual risk is above the enterprise's approved risk appetite. The product director argues the revenue justifies proceeding. What should the risk practitioner do FIRST?

Want more like this? The CRISC practice test has questions for every domain.

Checklist

0 of 15

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with roles and accountability, because nearly every Domain 1 question turns on who decides. Learn the risk owner, control owner, practitioner and lines-of-defense model until you can place any role from a scenario in seconds. Then study appetite, tolerance and capacity together as one connected idea rather than three definitions.

Next, work through Part A in order: strategy, structure, culture, policies, processes and assets. For each one, ask how it would show up as a problem in a scenario. Most candidates underestimate culture and ethics and the business resilience subtopic. Both appear as symptoms rather than labels, so practice reading the cause behind the symptom.

Leave frameworks and legal requirements for last. You do not need to memorize framework clauses. Focus on what each framework is for and how obligations differ by source.

After this domain, practice mixed question sets with Domain 3. The ownership and appetite logic you build here decides most of the risk response questions there, and practicing them together shows whether the reasoning carries over.

FAQ

How much of the CRISC exam is Domain 1?

Governance carries 26% of the exam under the outline effective 3 November 2025. That is the second-largest share after Domain 3.

Is Domain 1 technical?

Very little. It is about business context, accountability and oversight. Candidates who answer from a technical point of view tend to choose actions that are reasonable in themselves but taken by the wrong role or at the wrong time.

What is the difference between risk appetite and risk tolerance?

Appetite is the overall amount of risk leadership is willing to take to achieve its objectives. Tolerance is the acceptable variation around that appetite for a specific objective, usually expressed as a threshold you can monitor.

Does the risk practitioner ever accept risk?

In CRISC scenarios, risk acceptance belongs to the accountable risk owner or senior management. The practitioner analyzes, advises, documents and escalates so that the right person can decide.

Do I need to memorize COBIT or ISO 31000?

You need to know what major frameworks are for and how they are used, such as COBIT for governance and management of enterprise IT and ISO 31000 for risk management principles. Clause-level detail is not the focus of the outline.

Why is business resilience in the Governance domain?

The current outline places business processes and resilience, including DRP and BCP, under organizational governance. That reflects the view that continuity priorities are a business decision before they are a technical one.

How does Domain 1 connect to the rest of the exam?

It defines the objectives, owners, appetite and obligations that later domains depend on. Domain 2 measures risk against them, and Domain 3 chooses responses within them.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have worked through ownership, the lines of defense and how appetite and tolerance shape every decision. See whether you can apply that reasoning under exam conditions.

Take the CRISC practice test Check your CRISC readiness

Keep going