Which item is explicitly listed as part of Tier 1 risk coverage?

• A. Governance
• B. Information and Information Flow
• C. Environment of Operation
• D. Mission of Business Process

Answer: (A)

Understanding Tier 1 risk coverage means focusing on the overarching framework that governs risk across the organization. Governance is at the top of this framework because it establishes who is accountable for risk, sets policies and risk appetite, and provides the authority for implementing controls, monitoring risk, and making escalation decisions. This high-level oversight ensures consistency in how risk is managed across all functions and layers, which is exactly what Tier 1 is meant to capture.

The other items relate to how risk appears or is managed in practice, but they don’t define the governance structure itself. Information and Information Flow deal with data handling and communications, which are important but fall under operational or information management concerns rather than the top-level governance framework. Environment of Operation covers the operating context and infrastructure, which are critical components of risk but are typically addressed within more specific risk domains or at lower tiers. Mission of Business Process focuses on the business goals and how processes support the mission, a strategic aim that sits alongside governance but isn’t the governance mechanism that Tier 1 explicitly governs.