RM-02—Risk Assessment

>Control Description

Organization management performs an annual risk assessment. Results from risk assessment activities are reviewed to prioritize mitigation of identified risks.

Theme

Process

Type

Detective

Policy/Standard

Risk Management Standard

>Implementation Guidance

1. Ensure Risk Management Standard shall be in place which RM-01 defines the requirements for annual risk assessment. 2. Ensure that the results of risk assessment are reviewed and mitigation is performed on priority. 3. Any identified issues should have a corresponding risk treatment plan or corrective action plan in place. Each issue shall be tracked to completion.

>Testing Procedure

1. Validate that Risk Management Standard is in place and defines the requirements for annual risk assessment. 2. Validate evidence for the review of results of risk assessment and mitigation of risks. 3. Validate that any identified issues were tracked to completion, according to its corresponding risk treatment plan or corrective action plan.