What should a risk practitioner do FIRST when an assessment reveals a control is not operating as intended?
Recommend updates to the control procedures
Determine the root cause of the control issue.
Discuss the status with the control owner.
Recommend compensating controls.
Submit