Once remediation actions have been implemented, the risk practitioner evaluates whether the new or enhanced controls are designed appropriately and operating effectively. In the CRISC framework, this post-implementation evaluation is used to determine how much risk remains after controls are in place—this isresidual risk. Inherent risk is the risk level before considering any controls; therefore it is assessed earlier in the process. Audit risk relates to assurance work, not specifically to the outcome of a remediation plan. Aggregated risk refers to a combined view of multiple risks and is not the direct output of evaluating one specific remediation initiative. By assessing control design (fit for purpose) and operating effectiveness (working as intended), the practitioner can compare the new residual risk level to risk appetite and tolerance, and determine whether additional treatment is needed.
[Reference:CRISC Review Manual – Risk Assessment domain (inherent vs residual risk and control evaluation)., ===========, ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit