CGEIT: Certified in the Governance of Enterprise ITDemo

IT risk is business risk associated with the use and operation of IT. A risk self-assessment should therefore address the related business risk first, so improvement opportunities for IT services can be prioritized by their potential business impact and aligned with enterprise risk management. Residual risk, capability measures, and mappings are useful assessment artifacts but do not replace evaluating the business risk the service may create.