CGEIT: Certified in the Governance of Enterprise IT

Compliance with applicable local regulations can require operating conditions or constrain available risk treatments. Such a legal obligation is a stronger basis for a formally governed exception to the enterprise’s normal risk appetite than local practices, framework alignment, or technical differences. ISACA identifies laws and regulations as externally imposed requirements and distinguishes them from controls used to manage risk within appetite and tolerance.