Organizational Structure Roles and Responsibilities, within ISACA CRISC Domain 1 (Governance), is the deliberate design and documentation of governance structures — committees, oversight bodies, and defined roles — that assign clear risk ownership, decision-making authority, and accountability across an enterprise. This is NOT about designing org charts or HR reporting hierarchies; it IS about ensuring every material risk has a named owner, an oversight body, and a tested escalation path. The governing framework is the Three Lines Model (IIA 2020): Line 1 (business management controls), Line 2 (risk oversight and compliance functions), and Line 3 (independent internal audit assurance). CRISC professionals use RACI matrices, governance charters, and committee mandates to formalize these structures.
Where it stops · what it isn't
- —IS: Governance structures — risk committees, audit committees, CRO authority, board-level oversight — that enable risk management accountability
- —IS: Role definitions that clarify who is Responsible, Accountable, Consulted, and Informed (RACI) for each risk decision
- —IS: Three Lines Model implementation — structural separation of management controls, risk oversight, and independent assurance
- —IS NOT: Designing org charts, HR reporting hierarchies, or compensation structures — those are organizational design, not risk governance
- —IS NOT: The risk management process itself (identifying, assessing, and responding to risks) — covered in separate CRISC domains
- —IS NOT: IT-specific role definitions (e.g., system administrator privileges) unless tied to governance accountability structures
- —Governance structure ≠ organizational hierarchy: A CRO may report administratively to the CFO but hold direct access to the Board Risk Committee — the governance structure is the latter relationship, not the former
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESOrganizational Culture and Assets (prerequisite cubelet)Three Lines Model (IIA 2020 framework)
ENABLESStrategy and Risk AlignmentRisk Appetite and Tolerance SettingRisk Escalation and Reporting Processes
PART OFCRISC Domain 1: Governance
RELATED TOEnterprise Risk Management (ERM) Frameworks
CONSTRAINSRisk Decision-Making Authority at each organizational level