The three lines of defense model is a framework that describes the roles and responsibilities of different stakeholders in the risk management and internal control processes of an organization. The three lines of defense are:
* The first line of defense: the operational management and staff who are responsible for identifying, assessing, and responding to the risks, as well as implementing and maintaining the controls within their areas of activity.
* The second line of defense: the risk management, compliance, and security functions who are responsible for establishing the risk policies and standards, providing guidance and support, monitoring and reporting on the risk performance and compliance, and facilitating the risk management and internal control processes across the organization.
* The third line of defense: the internal audit function who is responsible for providing independent and objective assurance on the effectiveness and efficiency of the risk management and internal control processes, as well as recommending improvements and best practices. The stakeholders who are typically included as part of a line of defense within the three lines of defense model are the legal team, who belong to the second line of defense. The legal team is responsible for ensuring that the organization complies with the relevant laws and regulations, as well as for advising and assisting the organization on the legal aspects and implications of the risk management and internal control processes. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.4.1, p. 32-33

セクション: ボリューム D

The primary focus of an ongoing risk awareness program should be to enable better risk-based decisions, as this can help the organization to achieve its objectives, optimize its performance, and manage its risks effectively. An ongoing risk awareness program is a process of educating, communicating, and engaging the stakeholders about the organization's risk management framework, methodology, and practices. An ongoing risk awareness program can help the stakeholders to understand the risk context, criteria, appetite, and profile of the organization, and to identify, assess, treat, monitor, and review the risks that may affect their roles and responsibilities. By doing so, an ongoing risk awareness program can empower the stakeholders to make informed and rational decisions that balance the benefits and costs of risk-taking, and that align with the organization's strategy and goals.
References:
*ISACA, Risk IT Framework, 2nd Edition, 2019, p. 761
*ISACA, Managing Human Risk Requires More Than Just Awareness Training2

リスク ヒート マップは、リスク イベントをその発生可能性と影響度に基づいてマトリックスで表示するグラフィカル ツールです。同じ色でコード化されたリスク イベントは、リスク発生可能性 (リスク イベントの発生確率または発生頻度) が類似しています。リスク スコア、リスク影響、リスク対応もリスク イベントのその他の属性ですが、リスク ヒート マップでは色分けで表されません。
参考資料 = ISACA リスクおよび情報システム制御認定 (CRISC) 認定試験の質問と回答、質問 7、CRISC レビュー マニュアル、第 6 版、202 ページ。

買収時に上級管理職が検討すべき最も重要な要素は、対象組織のリスク選好度とリスク許容度です。リスク選好度とリスク許容度は、組織が目的達成のために受け入れるリスクの量と種類を反映しています。対象組織のリスク選好度とリスク許容度を検討することで、上級管理職は、それらが自社のものと互換性があるかどうか、また買収によって買収組織に重大なリスク エクスポージャーまたは機会が生じるかどうかを判断できます。リスク フレームワークと方法論、主要リスク指標 (KRI) しきい値、およびリスク コミュニケーション プランも検討すべき要素ですが、リスク選好度とリスク許容度ほど重要ではありません。参考文献
= ISACA リスクおよび情報システム制御認定 (CRISC) 認定試験の質問と回答、質問 8、CRISC レビュー マニュアル、第 6 版、97 ページ。