There is an understanding that risk is important and needs to be managed, but it is viewed as a technical issue and the business primarily considers the downside of IT risk

Decisions involving risk lack credible information

Risk appetite and tolerance are applied only during episodic risk assessments

Risk management skills exist on an ad hoc basis, but are not actively developed