Domain 1 – Section A Review: Organizational Governance

Domain 1 is not about controls.
It's about structure, authority, alignment, and sequencing.

Before moving into Risk Governance, you need to recognize the recurring patterns in Section A.

The Organizational Governance pattern

Across Strategy, Structure, Culture, Policies, Processes, and Assets, CRISC consistently favors:

• Governance before controls
• Structure before speed
• Alignment before enforcement
• Accountability before action
• Process correction before tactical fixes

If you see a control problem, ask:

Is this really a governance problem?

Often, it is.

The 6 core signals in Section A

1. Strategy appears

Think:

• Alignment
• Advisory action
• Business impact

Avoid:

• Immediate technical control deployment

2. Roles & responsibilities appear

Think:

• Who owns risk?
• Is authority correct?
• Is independence preserved?

Avoid:

• Blurring oversight and execution

3. Culture appears

Think:

• Tone at the top
• Repeated behavior patterns
• Accountability gaps

Avoid:

• Adding controls to fix behavioral problems

4. Policies & standards appear

Think:

• Governance hierarchy
• Policy first
• Standards enforce policy

Avoid:

• Jumping directly to implementation

5. Business processes appear

Think:

• Lifecycle integration
• Proactive risk embedding
• Fix process, not symptom

Avoid:

• Late-stage mitigation without structural correction

6. Assets appear

Think:

• Identification
• Classification
• Ownership
• Business value alignment

Avoid:

• Equal protection for unequal assets

10 exam-style practice questions

These are intentionally scenario-heavy.

Question 1

An organization launches a new revenue-generating mobile application aligned to aggressive growth targets. Security identifies moderate control gaps that may delay launch.

What should the risk practitioner do FIRST?

A. Delay launch until all control gaps are resolved
B. Implement compensating controls immediately
C. Assess risk impact in business terms and present findings to leadership
D. Escalate to regulators

Question 2

IT management formally accepts risk for a critical enterprise system without involving executive leadership.

What governance issue is MOST significant?

A. Weak encryption
B. Inadequate monitoring
C. Improper risk ownership
D. Incomplete asset inventory

Question 3

Despite formal policies, employees regularly bypass change management procedures to meet deadlines.

What is the MOST effective corrective action?

A. Increase system logging
B. Add additional approval checkpoints
C. Reinforce executive accountability and governance expectations
D. Conduct another risk assessment

Question 4

A new regulatory requirement impacts data retention practices. Internal standards do not reflect the change.

What should be done FIRST?

A. Perform a compliance audit
B. Update enterprise policy
C. Deploy retention controls
D. Notify regulators

Question 5

Multiple projects consistently discover compliance gaps after deployment.

What governance weakness is MOST likely present?

A. Weak incident response
B. Reactive risk integration into business processes
C. Poor vulnerability scanning
D. Inadequate asset encryption

Question 6

An organization cannot determine the business impact of a recently discovered system vulnerability because no asset classification exists.

What is the MOST appropriate corrective action?

A. Deploy compensating controls
B. Conduct penetration testing
C. Establish formal asset classification aligned to business value
D. Escalate to regulators

Question 7

Internal audit assists management in implementing new security controls after identifying deficiencies.

What governance principle is being compromised?

A. Risk appetite alignment
B. Independence
C. Risk tolerance definition
D. Asset ownership

Question 8

Different departments define their own security requirements for similar systems, resulting in inconsistent controls.

What governance weakness does this indicate?

A. Insufficient automation
B. Weak enterprise standards enforcement
C. Inadequate encryption algorithms
D. Low risk tolerance

Question 9

A high-severity technical vulnerability is discovered on a low-impact internal system.

What factor should primarily guide prioritization?

A. Technical severity rating
B. Media exposure risk
C. Business impact and asset value
D. Industry benchmarks

Question 10

Executive leadership frequently overrides formal risk processes to accelerate product launches.

What is the MOST significant governance concern?

A. Lack of encryption
B. Weak asset inventory
C. Tone at the top undermining governance culture
D. Incomplete vulnerability scanning

Section A master rule

When answering Domain 1 Section A questions, ask yourself:

• Is this a structural issue?
• Is ownership clear?
• Is governance aligned?
• Is sequencing correct?
• Am I thinking enterprise-level?

If you fix structure before controls, you'll usually choose correctly.