According to the CRISC Review Manual1, stakeholders are the individuals or groups that have an interest or stake in the outcome of the IT system and its risks. Stakeholders include the system owners, users, operators, developers, managers, auditors, regulators, and customers. It is most important to ensure that agreement is obtained from stakeholders when testing the security of an IT system, as this helps to define the scope, objectives, and expectations of the test, and to obtain the necessary authorization, support, and resources for the test. Agreement from stakeholders also helps to avoid any conflicts, disruptions, or misunderstandings that may arise during or after the test, and to ensure the validity and acceptance of the test results and recommendations. References = CRISC Review Manual1, page 198, 224.