CRISC - Certified in Risk & Information System Control

2.3 Current State of Controls It is very important for a risk practitioner to determine the current state of control before making any recommendation. Regular review of IT risk and control environments will help to determine current position. A gap analysis is done to determine the gap between desired state of control vis-à-vis current state. It helps to identify the disparity and to determine further level controls to bridge the gap or disparity. A risk practitioner can determine current state of control by evaluating following documents and procedures: Risk Assessment Audit Reports & Third-Party Assurance Business Continuity and Disaster Recovery Plans Capability maturity models Control Self-Assessment Incident Reporting Procedure and Logs Vulnerability Assessment and Penetration Testing Let us discuss each in detail: Risk Assessment Risk assessment is the process to identify and evaluate the risk and its potential impact. Main objective of performing a risk assessment is to: ...