CRITICAL RISK / FIELD ASSESSMENT
The challenge
An organisation had established critical risks, controls and verification activities.
The question wasn't whether the framework existed.
It was whether the controls were providing the protection the organisation believed they were.
The work
We went into the field.
We examined how critical controls were understood, implemented and verified where exposure occurred.
We compared system expectations with operational reality and looked for the conditions affecting control effectiveness.
What this revealed
The work created a clearer picture of where confidence was justified, where controls were vulnerable and where verification activity wasn't providing enough evidence to support the decisions being made.
The response
The findings provided a practical basis for strengthening control requirements, verification and the conditions supporting effective implementation.