Risk Management 1
Study plans 2016-2017 - IMT4762 - 5 ECTS

Expected learning outcomes


  • Possesses advanced knowledge within frameworks /standard in Risk Management 
  • Possesses insight and good understanding of the practical work of Risk Management in practical life


  • Is able to practice existing frameworks, standards and methods and to challenge established knowledge and practice in the technology area.
  • Is able to use a given standard, framework or method in Risk Management and Risk Assessment in an organisation.
  • Is able to understand the nature of a Rsik Framework and how to apply this to an organisation
  • Is able to understand the major principles of Risk Management
  • Is able to understand which practical guidance and techniques are available
  • Guide to assist with the implementation of a Risk Management framework
  • Is able to apply a Risk Management standard/ framework to a practical case study

General Competence

Having completed the course, the students should have:

  • An advanced level of understanding of the structure and content of a risk management framework/ standard
  • An understanding of the advantages, challenges and complexity of working with Information Security Management and IT related risks in organisations.
  • An understanding of how to make well-informed decisions about and to respond to the extent of the IT risk


  • Risk Management in the context of an Information Security Management system
  • Study of framework / standards for risk assessment

Teaching Methods

Group works
Net Support Learning
Project work

Teaching Methods (additional text)

The course will include an introductory lecture providing an overview of the course content. The primary teaching method for the course is project work. The students are required to carry out and document a risk assessment activity by means of a case study.

Students are expected to present their work-in-progress at the seminars for discussions. Guidance, supervision and feedback will be provided during seminars only and given on material presented at the seminars only. Students that cannot be present during the seminars are expected to be present by means of the Fronter Teleconference tool.

The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC’s learning management system (Fronter).

Form(s) of Assessment

Oral exam, individually
Evaluation of Project(s)

Form(s) of Assessment (additional text)

An overall evaluation based on a 100 point scale, where project work counts 40 points and oral presentation counts 60 points. Conversion from 100 point scale to A-F scale according to recommended conversion table. In specific circumstances, emneansvarlig can slightly adjust the limits in the conversion table to enforce compatibility with the qualitative descriptions on the A-F scale

Grading Scale

Alphabetical Scale, A(best) – F (fail)

External/internal examiner

Evaluated by external and internal examiner.

Re-sit examination

Next time the course is running.

Teaching Materials

  • ISO/IEC 27005:2011. Information security risk management
  • ISACA.www.isaca.org.  COBIT 5 for Risk
  • ISACA (www.isaca.org). The Risk IT Practitioner Guide. 2009.

 Additional Recommended reading

  • ISACA. COBIT 5. www.isaca.org
  • ISO/IEC 27001:2013. Information security management systems - Requirements