CRISC: Certified in Risk and Information Systems Control

Risk policies formally define the organization's risk-management expectations, including the level of risk it is prepared to accept. Risk assessments evaluate risk exposure, while risk sharing and transfer agreements are risk-treatment mechanisms.